Constructing "five-in-one" risk management system to lead and guarantee the high-quality development of paper industry in China

I. The construction of "five-in-one" risk management system with characteristics of Chinese paper industry
(A) What is the "five-in-one" system
"Five-in-one" refers to legal affairs, compliance, internal control, risk and audit through scientific collaboration and close cooperation to achieve enterprise risk closed-loop management. The characteristics of China Paper's "five-in-one" system are that legal affairs focuses on "use", supporting various businesses through transaction design, legal application, and dispute resolution, and leading the company to achieve its business goals; compliance focuses on Compliance focuses on "compliance", through prior layout and active requirements, so that all operating units, departments and employees are bound by laws and regulations, regulatory provisions and internal rules and regulations; internal control focuses on "construction", through the setting of systems and processes, so that the company's operation is both compliant and efficient; through the establishment of institutions and positions, the company will be able to provide a more effective and efficient service. Internal control focuses on "building", through the setting of systems and processes, so that the company's operation is both compliant and efficient; through the setting of institutions and positions to form effective constraints, so as to avoid potential risks; risk focuses on "prevention", through the combination of corporate strategy and the internal and external environment, to identify and assess risks, select response strategies to achieve risk prevention, avoidance, transfer and resolution; audit focuses on "improvement", through independent, objective The audit focuses on "improvement", through an independent and objective position to check and evaluate the internal control and risk management of the enterprise, and realize the optimization of the whole risk control system through the feedback of the results.
(2) Why build a "big risk control" system
In 2015, SASAC proposed to explore the establishment of an integrated management platform for legal, compliance, risk and internal control in its "Opinions on Comprehensively Promoting the Construction of Central Enterprises under the Rule of Law". 2021, 18 central enterprises have started to promote The construction of the "X" bit one big wind control system. China Paper continues to benchmark advanced, promote reform and development, closely combined with the actual development, and strive to improve the prospective of risk identification, risk control comprehensiveness, risk disposal scientific, and gradually build the "big wind control" system to promote corporate compliance governance.
(3) How to build a "big risk control" system
When it comes to building a "big risk control" system, we must first mention the "three lines of defense" of enterprise risk management, namely, the business department of the enterprise as the front-end department is the first line of defense; the risk management function is the second line of defense; and the internal audit function is the third line of defense.
China Paper's "big risk control" system is based on the risk compliance department's integration of legal affairs, compliance, risk, internal control and audit in one control reality, and on the basis of the "four-in-one", it incorporates audit to strengthen supervision and management. Compared with the "four-in-one" system, which focuses on the second line of defense for risk prevention and control, it combines the efficiency of legal affairs with the prevention and control characteristics of internal control, compliance and risk to achieve the unity of efficiency and risk prevention and control. China Paper's "five-in-one" emphasizes the support and early warning of the second line of defense to the first line of defense, and the feedback and improvement of the third line of defense to the first and second lines of defense, ultimately achieving the purpose of reinforcing the three lines of defense and enhancing systematic risk prevention.
China Paper's "big wind control" system is a "five-in-one" risk control system that runs through the "three lines of defense".
The first line of defense is composed of the company's business departments (procurement, sales, etc.) and related post personnel, who are responsible for the main responsibility for the risks that occur in the business, responsible for implementing various specific risk compliance management systems, improving the operational processes of each business line, and identifying, evaluating, responding to, monitoring and reporting various types of risks within their respective areas of responsibility at the front end of the business. However, at the same time, legal affairs and risk are front-loaded to the first line of defense, with legal opinions and risk assessment reports as a grip to provide opinions related to management and strategic development to anticipate risks in advance.
The second line of defense consists of risk management committee, compliance management committee and risk compliance department, which is the supervisor and organizer and coordinator of risk compliance management, responsible for coordinating relevant functional departments and branches to manage compliance risk matters, and formulating various management systems and standards, etc. At this time, legal affairs, compliance, risk, internal control and audit are placed in the second line of defense, with committee operation, contract review, risk reminder letter, post-investment evaluation and mid-appointment audit as the grasp to assist the first-line core business departments in risk control. The third line of defense consists of the audit committee and the audit department, which are responsible for inspecting and evaluating the operation and operational effectiveness of the corporate compliance management system and the implementation of compliance management policies.
At the same time, legal affairs is also placed in the third line of risk, with litigation case management as the grip, together with audits with various types of audits (outgoing, special, internal control evaluation, etc.) and non-compliant operation recovery as the grip, to supervise and inspect risk compliance management and follow up on matters rectification and reform, forming a closed-loop control.
Second, the implementation of the "five-in-one" big wind control system
(I) Recognize "where we are"
By benchmarking the risk system model and compliance system model of China Chengtong Holdings Group Co., China Paper's risk and compliance systems are both close to the third level of the five-level system, with risk prevention and control close to "standardized" and compliance management close to "preliminary standardized level ". Combined with the actual analysis, the main reasons for the shortcomings are: first, the risk management strategy is not clear; second, the risk warning and monitoring means are single; third, the system personnel strength needs to be improved; fourth, the system system needs to be improved; fifth, the culture is not yet in place; sixth, the risk management information system has not yet been established.
(2) Clarify "where to go"
In order to build "five-in-one" front efficient and synergistic China paper system big risk control system, comprehensively improve compliance management and risk prevention and control ability, for the enterprise's high-quality, sustainable development escort.
At the strategic level, according to the different stages of enterprise development, formulate risk management strategies that fit with the company's strategies; around the enterprise development strategies, establish a unified risk management framework, determine risk appetite, risk tolerance, etc.; rule of law construction as a key task of the company's reform and development into the company's development planning and annual work plan.
At the management level, establish a sound legal compliance and risk internal control system; embed the compliance process into the business and continuously optimize all aspects of reasonable rule making, compliance execution and compliance auditing; develop risk management solutions for each type of risk or each major risk according to the risk management strategy; establish a key risk indicator (KRI) early warning mechanism to intelligently identify potential risks.
At the level of support and guarantee, we build a risk compliance management information system and a risk event database to achieve significant risk tracking and management internally and effective early warning of predicted risks externally; strengthen talent echelon construction and training, establish a risk compliance talent training system, reserve professional talents in "five-in-one" professional fields, and realize the operation of risk compliance training mechanism. The training mechanism for risk compliance is mature, the culture is in place, and the quality of business personnel is significantly improved.
(3) Determine "how to go"
In order to achieve the first three-year goal under the rule of law construction, China Paper has formulated a "three-step" strategy.
Step 1: In 2021, improve the configuration and implement responsibilities. Establish and improve the organization system and system of comprehensive risk management system, and solve the existing main problems of risk compliance.
Step 2: 2022: Collaborative management. Coordinate and plan the business positioning, strategic objectives and annual work tasks of risk, compliance, internal control, legal affairs and audit, and explore the risk compliance management assessment mechanism and information system construction.
Step 3: In 2023, system integration. Implement the risk compliance management information system, establish and adjust the risk monitoring and early warning index system and risk measurement technology according to the actual business situation, and implement the integration of comprehensive risk management with strategic management and performance management.
Effectiveness of the "Five-in-One" risk control system
Since the establishment and implementation of the "five-in-one" big wind control system, China Paper has deeply integrated the requirements for the construction of central enterprises under the rule of law into enterprise risk management, and has achieved positive results in all aspects.
Take legal affairs and compliance for example.
In the first line of defense, through the rules and regulations "abolition reform", strengthen the system of the whole life cycle management; by pay close attention to the three audit rate, to promote business compliance in accordance with the law; through the whole staff knowledge contest, through the legal "last kilometer".
In the second line of defense, through the implementation of the first responsible person's responsibility, leading the rule of law construction in depth; through the establishment of the general legal adviser system, promoting the implementation of rule of law compliance work; through the annual rule of law work conference, coordinating the key rule of law work tasks in the phase; through the establishment of full-time legal institutions, providing service personnel security; through the main leaders to learn the law, to create the rule of law propaganda "conveyor belt ".
In the third line of defense, through "a case a policy, a case a summary", the causes of the case, handling strategies, lessons learned through the ledger management for the "whole process" of tracking, and through the case summary analysis and thematic seminars, reverse the mechanism management to check the problem The case summary analysis and seminars, reverse the mechanism management to investigate the problem, find deficiencies, make recommendations, to achieve closed-loop case management.

Translated with www.DeepL.com/Translator (free version)