作為控股型公司（或稱母公司）,，其特點(diǎn)是公司業(yè)務(wù)主要由下屬企業(yè)具體經(jīng)營,，公司主要負(fù)責(zé)對下屬企業(yè)的控制與管理,，公司利潤主要來源于對下屬企業(yè)的投資所得,?？毓尚凸竟芾泶┩阜娠L(fēng)險(xiǎn)是指,，由于母公司與下屬企業(yè)在內(nèi)控制度管理,、內(nèi)部決策機(jī)制等方面的權(quán)利義務(wù)界限不清,，導(dǎo)致在下屬企業(yè)涉及爭議糾紛時(shí),，外部第三方通過“揭開公司面紗”等方式追究母公司的法律責(zé)任；以及因母公司或下屬企業(yè)違反監(jiān)管規(guī)定或其他義務(wù),，導(dǎo)致相關(guān)監(jiān)管部門,、司法機(jī)關(guān)或外部第三方要求母公司承擔(dān)法律責(zé)任。

筆者結(jié)合常年服務(wù)控股型上市公司及央企集團(tuán)的經(jīng)驗(yàn),，在本文主要分析以下兩類管理穿透風(fēng)險(xiǎn)：

（1）母公司對下屬企業(yè)的管控,，是基于其作為控股股東、實(shí)控人,、受托管理人,、參股股東等身份。該等模式下,，可能因其自身管理決策不當(dāng),、上下級(jí)管理邊界不清、各不同法律實(shí)體之間權(quán)利義務(wù)關(guān)系不明而引發(fā)相關(guān)風(fēng)險(xiǎn),；

（2）母公司如涉足重監(jiān)管行業(yè)或涉及上市公司,，則可能導(dǎo)致公司對下屬運(yùn)營實(shí)體行使管控職能時(shí)，受監(jiān)管部門或司法機(jī)關(guān)追責(zé)而引發(fā)相關(guān)風(fēng)險(xiǎn),。

筆者以某國有控股型公司為例,，該公司投資行業(yè)包括醫(yī)療,、房地產(chǎn)、金融等,，旗下上市公司若干,，以該公司主體資格、所在監(jiān)管領(lǐng)域及行業(yè)為劃分標(biāo)準(zhǔn),，初步梳理了風(fēng)險(xiǎn)點(diǎn)（見表格）,。

筆者認(rèn)為，除表中所列情形之外,，還應(yīng)特別重視公司章程及內(nèi)部管理制度,、相關(guān)協(xié)議安排可能涉及的管理穿透風(fēng)險(xiǎn)。比如,，在公司章程及內(nèi)部管理制度中約定的控股股東,、實(shí)控人是否會(huì)嚴(yán)重影響下屬企業(yè)的法人獨(dú)立性原則（如財(cái)產(chǎn),、人員或機(jī)構(gòu)混同，大股東資金占用等）,？在經(jīng)營管理方面是否存在事實(shí)上的資質(zhì)掛靠,、借用等違法違規(guī)行為？這些均有可能導(dǎo)致被相關(guān)監(jiān)管部門,、司法機(jī)關(guān)或外部第三方要求控股公司承擔(dān)法律責(zé)任的風(fēng)險(xiǎn),。

控股型公司管理穿透風(fēng)險(xiǎn)涉及情形復(fù)雜、監(jiān)管領(lǐng)域及行業(yè)眾多,；且具有雙向性,，一旦出險(xiǎn)，母公司與下屬企業(yè)均可能因?qū)Ψ交螂p方的違法違規(guī)或違約行為導(dǎo)致不利的法律責(zé)任或后果,。鑒于此,，筆者有如下應(yīng)對建議：

第一，通過外聘律師從下屬企業(yè)法律性質(zhì),、所處監(jiān)管領(lǐng)域及所在行業(yè)監(jiān)管要求等方面,，對公司可能涉及的風(fēng)險(xiǎn)進(jìn)行梳理、識(shí)別,，并對該等風(fēng)險(xiǎn)予以定量分析,。

第二，針對風(fēng)險(xiǎn)的成因,、等級(jí)及發(fā)生頻次,，有針對性地制定風(fēng)險(xiǎn)應(yīng)對策略和措施，包括：依法建立公司內(nèi)控管理制度與決策審批機(jī)制,，確保通過股東會(huì),、董事會(huì)、派駐高管及監(jiān)事等形式依規(guī)參與下屬企業(yè)的經(jīng)營管理與決策,，嚴(yán)格遵守所在領(lǐng)域及行業(yè)的相關(guān)監(jiān)管規(guī)定與要求,。

第三，對公司風(fēng)險(xiǎn)予以信息化,、常態(tài)化管理,，如形成風(fēng)險(xiǎn)梳理成果文件并導(dǎo)入公司OA系統(tǒng)，按年度及時(shí)更新,、完善,，建立健全風(fēng)險(xiǎn)管控的長效機(jī)制及常態(tài)化管理。（原文刊載于《商法》雜志2019年第7期,。）

As a holding company (or parent company), its business is mainly operated by its subordinate enterprises. The company is mainly responsible for the control and management of its subordinate enterprises and its profits mainly come from its investment in them.

The management penetration risk faced by holding companies refers to the fact that, due to the unclear boundaries of rights and obligations between the parent company and the subordinate enterprise in internal control system management and an internal decision-making mechanism, when the subordinate enterprise is involved in disputes, the external third parties investigate the legal liability of the parent company by “piercing the corporate veil” and also other means.

Because the parent company or its subordinate enterprise violates regulatory requirements or other obligations, relevant regulatory authorities, judicial departments or external third parties require the parent company to assume legal liability.

This article mainly analyses the following two types of management penetration risks.

(1) The parent company’s control over its subordinate enterprises is based on its status as controlling shareholder, actual controller, trustee and participating shareholder. Under these modes, risks may arise because of improper management decisions, unclear management boundaries between superiors and subordinates, and unclear rights and obligations among different legal entities.

(2) If the parent company is involved in the heavily regulated industry, or if listed companies are involved, risks may arise due to investigation by the supervisory departments or judicial departments when the company exercises the supervisory and control functions over the subordinate operating entity.

The author takes a state-owned holding company with investments covering healthcare, real estate, finance, etc., and to which several listed companies are subordinated, as an example to preliminarily sort out the risk points based on the company’s qualifications, regulatory areas and industries (see table).

The author believes that, in addition to the situations listed in the table, special attention should be paid to the management penetration risks that may be involved in the articles of association, internal management system and relevant agreements or arrangements. For example, will the controlling shareholders and actual controllers stipulated in the articles of association and internal management system seriously affect the principle of corporate independence of subordinate enterprises (such as the confusion of property, personnel or body, and fund occupation by large shareholders, etc.)? Are there any illegal and irregular activities in operation and management, such as de facto qualification affiliation and borrowing? All these may lead to the risk of holding companies being required by the relevant regulatory authorities, judicial departments or external third parties to bear legal liability.

The controlling company’s management penetration risk involves complex situations, numerous regulatory areas and industries, and is bi-directional. Once risks occur, both the parent company and the subordinate enterprises may cause unfavourable legal responsibilities or consequences due to violations or breach of contract by the other party, or both parties. In view of this, the author has the following suggestions.

First, engage lawyers to sort out and identify the risks that may involve the company, and quantitatively analyze the risks of a legal nature of the subordinate enterprises, the regulatory areas in which they are located, and the regulatory requirements of the industry.

Second, in view of the causes, levels and frequency of risks, formulate risk response strategies and measures accordingly, including, but not limited to, establishing an internal control management system and decision-making approval mechanism in accordance with the law, ensuring participation in the management and decision-making of subordinate enterprises in accordance with regulations in the form of shareholders’ meeting, board of directors, and appointing of senior management and supervisors, and strictly abiding by relevant regulatory provisions and requirements in their areas and industries.

Third, the company should carry out informationized and normalized risk management, such as forming a document of risk, sorting it and importing it into a corporate office administration system, and timely updating and improving it on an annual basis, establishing and improving a long-term mechanism of risk control and regular management.

(Original source: CBLJ Issue 7, 2019.)