The frank answer: there is no single legally mandated answer for how often every company must reassess compliance risk. No statute requires “all companies to conduct annual compliance reviews”. Review duties arise only in specific regulated sectors; for everyone else, the cadence is a governance decision driven by risk level. This article gives a review matrix by industry and risk tier, plus the triggers that demand an ad-hoc review.
1. Two sectors with mandatory compliance-assessment duties
These are the rare legal touchpoints that set specific requirements — applicable only within their sectors:
- Insurance: insurance enterprises must conduct annual and ad-hoc compliance assessments under Circular 70/2022/TT-BTC. An insurance-sector duty.
- Anti-money laundering: reporting entities must update their money-laundering risk assessment annually under Article 15.1 of the Law on Anti-Money Laundering 2022. Technical note: the correct basis is Article 15.1 — beware of confusing it with Article 17 when researching.
Neither duty may be stretched into a general obligation for all businesses. Claiming “the law requires every company to do annual compliance reviews” is wrong.
2. Practice: at least annually, plus ad-hoc on triggers
Outside the regulated sectors above, widely applied compliance-governance practice is:
- At least annually: one comprehensive compliance risk assessment per year — revisiting the risk matrix, internal-control effectiveness, and the year’s violations and near-misses.
- High-risk businesses (real estate, finance, FDI, heavily inspected sectors): practice is quarterly review, given faster legal changes and sensitive transactions.
- ISO 37301 (compliance management systems): certified organizations undergo annual certification surveillance — a structured form of compliance review under an international standard.
These cadences are practice, not general legal duties.
3. Recommended review matrix by industry and risk level
- Insurance: annual plus ad-hoc compliance assessment (mandatory under Circular 70/2022/TT-BTC).
- Financial institutions, AML reporting entities: annual update of money-laundering risk assessment (mandatory under AML Law Art. 15.1).
- Real estate, non-insurance finance, FDI: quarterly review (practice for the high-risk group).
- Ordinary businesses, medium-to-low risk: annual review (practice).
- ISO 37301-certified companies: follow the annual certification surveillance schedule.
4. Triggers demanding an immediate ad-hoc review
Whatever the cycle, these events require reassessment right away:
- New legislation directly affecting operations (a new law or guiding decree).
- Violations or near-misses: signs of internal-control gaps.
- Business-model changes: new lines of business, M&A, new markets, ownership restructuring.
- Inspection findings from state authorities with rectification recommendations.
Frequently asked questions
Does the law require every company to do annual compliance reviews?
No. Only certain sectors (insurance; AML reporting entities) have periodic assessment duties under sector rules. For ordinary companies, annual review is good governance practice.
Which article requires updating the money-laundering risk assessment?
Article 15.1 of the Law on Anti-Money Laundering 2022 (annual update). Take care not to confuse it with Article 17.
Do small businesses need compliance reviews?
No general legal duty, but a right-sized annual self-assessment catches contract, tax and labor risks early — far cheaper than handling violations.
How does ISO 37301 relate to the review cycle?
ISO 37301 is the international standard for compliance management systems; certified organizations must maintain assessments and undergo annual certification surveillance — creating a structured review rhythm.
Sources
- Circular 70/2022/TT-BTC: annual and ad-hoc compliance assessments for insurance enterprises (insurance sector only).
- Law on Anti-Money Laundering 2022, Art. 15.1: annual update of money-laundering risk assessment (distinguish from Art. 17).
- The “annual”/”quarterly” cadences and recommendation matrix in this article are governance practice (including ISO 37301 practice), not generally mandated legal duties.
Need to design or reassess your compliance program — from risk assessment and internal controls to a review cadence suited to your industry? Reach us via the Contact page of FLAT Law Firm.
The legal content of this article is reviewed by FLAT’s AI Legal Council and submitted to the owner for approval; it is not an opinion of a licensed lawyer and does not replace legal advice for specific cases.
For reference only, not legal advice.