Scenario: a European group has 4 Vietnamese subsidiaries. Internal audit finds: one missed 6 quarters of investment reports, another signed over-limit contracts without board resolutions, a third processes customer data with no impact assessment under Decree 356/2025. No authority has caught any of it — because internal audit caught it first. An annual internal audit costs a fraction of one penalty decision. Compliance control isn’t “cost” — it’s the cheapest “insurance”.
Internal control framework
- Control environment: charter, internal regulations, clear approval delegation;
- Risk assessment: legal-risk matrix (tax, labour, environment, investment, data) by likelihood × impact;
- Control activities: multi-level approvals for large deals, periodic reconciliations, segregation of duties;
- Information and communication: shared compliance calendar, periodic compliance reporting to the parent;
- Monitoring: independent internal audit assessing control effectiveness.
Internal audit: scope and frequency
- Scope: tax compliance (returns, payments, Appendix I), labour (contracts, social insurance, work permits), investment (IRC, reports), environment, fire prevention, personal data;
- Frequency: annual comprehensive audit + risk-based thematic reviews (e.g. pre-finalisation season, after new laws take effect);
- Independence: internal audit reports directly to the board/parent, not to the management it audits;
- Remediation tracking: every finding gets an action plan, owner, deadline — and re-testing.
Whistleblowing and compliance culture
- Anonymous channels: letting staff report violations (corruption, fraud, harassment) without fear;
- Whistleblower protection: anti-retaliation rules, strict handling of reprisals;
- Compliance training: periodic training for managers and key staff on new duties (e.g. Decree 356/2025 on data, Decree 219/2025 on foreign labour);
- Tone at the top: leadership by example — culture starts at the top.
Measurable benefits
- Early detection before inspections — internal remediation always costs less than fines;
- “Good-faith compliance” evidence at sanctioning (mitigating factors);
- Protecting managers from personal liability where reasonable control systems exist.
FAQs
Does a small (20-person) subsidiary need internal audit?
Yes — scaled to size: periodic compliance checks by the parent/chief accountant against a checklist, rather than a standalone audit unit. Controls must match risks.
Internal vs independent audit?
Internal audit serves governance (finding risks, improving controls), reporting to the board/parent. Independent audit serves outsiders (certifying financials), reporting to shareholders/authorities.
Are whistleblowing channels mandatory?
Not generally mandatory, but good governance practice; some sectors (securities, banking) have specific requirements.
How often to review compliance?
Comprehensive annually; thematic reviews when new laws bite (e.g. Decree 356/2025 from 1/1/2026) or major changes occur.
Note: This article is for reference only. Contact FLAT Law Firm.
This article has been quality-reviewed by the FLAW AI Legal Council
