Many small and medium-sized businesses only find legal gaps when something has already happened: an inspection, a lawsuit from a partner or a complaint from an employee. By then, fixing the problem usually costs far more than finding it early. This article gives you a legal health self-check tool for businesses: 20 legal review criteria across 5 operating areas, with the evidence needed for each criterion, how to score, how to set priorities and a 180-day remediation roadmap. You can complete it in one session with your accounting, HR and sales staff, then use the result to decide what to fix yourself and what needs a lawyer.
- 20 criteria in 5 areas: internal governance and capital; contracts; employment; intellectual property and licences; tax, invoices and data.
- Score on evidence: Met = 1 point, Partly met = 0.5, Not met = 0. A criterion that does not apply is removed from the denominator.
- 6 critical criteria (★): a single critical criterion at 0 points puts the business in the highest priority level, even if the total score is high.
- The score thresholds and priority levels are an FC Legal practical framework, not a classification set by law.
- Some standards have changed: non-cash payment records are required from VND 5 million to deduct VAT; fire safety follows Law No. 55/2024/QH15 and Decree No. 105/2025/ND-CP.
1. What are the 20 criteria for?
This is a self-assessment tool for business owners, accountants and HR to work out together where the business has gaps and what to do first. It does not replace a review by a lawyer. The service itself is explained in What is a Legal Health Check?, and warning signals in 7 warning signs of legal risk. This article focuses on scoring and action.
Self-scoring in one working session- Appoint a coordinator and invite accounting, HR and sales
- Gather the charter, the register of members, the 10 largest contracts, HR files and licences
- Answer each criterion and write down the evidence
- Score, calculate the converted score and set the priority level
- Make a task list with owners and deadlines
2. How to score and set priorities
- Met (1 point): the documents exist and the business actually follows them in practice.
- Partly met (0.5): a document exists but is out of date, unsigned or applied inconsistently.
- Not met (0): nothing exists, no evidence can be found, or you know it is being done wrongly.
- Not applicable: remove it from the denominator.
Converted score = (total points ÷ number of applicable criteria) × 20. If you think “it is probably fine” but cannot find the documents, score 0.
The score thresholds and priority levels below are only for putting tasks in order. The law does not classify “legal health” by score; each breach is still assessed under the rules of its own field.
| Result | Priority level | What to do |
|---|---|---|
| A ★ criterion at 0 points, or a converted score below 12 | A: act now | Contain the issues within 30 days; have a lawyer look at the original documents before you fix them yourself |
| 12 to 16.5, with no ★ criterion at 0 | B: planned remediation | A 90-day plan; standardise documents and processes |
| 17 or more, with no ★ criterion at 0 | C: maintain | Re-score every 6–12 months and whenever there is a major change |
The ★ criteria are where a mistake can affect members’ liability, the validity of contracts, the ability to keep operating or the right to deduct tax. A business that scores 18 but fails on fire safety is still at level A.
3. Area 1: Internal governance and capital (criteria 1–4)
| # | Self-check question | Evidence needed to score “Met” |
|---|---|---|
| 1 ★ | Has the charter capital been fully contributed on time, or has a change been registered? | Capital contribution records; change of registration file |
| 2 | Does the charter match the current ownership structure, with clear authority and a way to resolve deadlock? | Latest charter, actual list of members |
| 3 | Are the register of members/shareholders, minutes and resolutions complete? Are related-party transactions approved by the right body? | Registers, resolutions filed by year |
| 4 | Are there internal rules on managing the company seal, digital signatures and signing authority? | Internal rules, seal/token log |
- Members of a multi-member limited liability company must contribute the committed capital in full within 90 days from the date of the enterprise registration certificate. After that deadline, the company must register a change of capital within 30 days. A member who has not contributed in full remains liable, in proportion to the committed capital, for obligations that arose before that change (Clauses 2 and 4, Article 47, Law on Enterprises 2020; other company types have similar rules).
- A seal may be a physical seal or a digital signature; seals are managed under the charter or the company’s internal rules (Article 43).
- Transactions with related persons must be approved by the competent body (Articles 67, 86 and 167, Law on Enterprises No. 59/2020/QH14, as amended by Law No. 76/2025/QH15).
Charter capital is often registered at a high figure to create a good image, and then nobody tracks the contribution deadline. In a dispute, capital contribution records are the first thing people ask for. When the seal and the digital signature token are held by one person without internal rules, the business will find it hard to prove which documents were signed with proper authority.
Keep one single “corporate file”: all registration changes, the current charter, the register of members/shareholders, capital contribution records, and the rules on the seal and digital signatures.
4. Area 2: Contracts (criteria 5–8)
| # | Self-check question | Evidence needed to score “Met” |
|---|---|---|
| 5 ★ | Do you check the counterparty’s legal status and the signatory’s authority (scope and term of the authorisation)? | Check sheet, power of attorney filed with the contract |
| 6 | Are the contractual penalty and damages clauses drafted under the right governing law (civil or commercial)? | Reviewed contract templates |
| 7 | Are there delivery, acceptance and receivables reconciliation records? Do you track the limitation period for bringing a claim? | Full set of records for major contracts |
| 8 | Is the dispute clause clear and workable? Is there an approval process before signing? | Contract templates, approval process |
- A transaction made by a person without authority to represent, or beyond that authority, does not create obligations for the person represented, except in cases set by law (Articles 142 and 143, Civil Code 2015).
- Commercial contracts: the penalty must not exceed 8% of the value of the breached part of the obligation, except in the case in Article 266 (Article 301, Commercial Law 2005). If a penalty is agreed, both the penalty and damages may be claimed, unless the law provides otherwise (Article 307).
- Civil contracts: if the parties only agree a penalty, and do not agree that both a penalty and damages apply, the breaching party only pays the penalty (Clause 3, Article 418, Civil Code 2015).
- Limitation periods: 2 years for commercial disputes (Article 319, Commercial Law); 3 years for civil contract disputes (Article 429, Civil Code).
Using one template for every relationship leads to two opposite errors: a penalty above the cap in a commercial contract, or a civil contract that does not state the right to claim both a penalty and damages. A well-drafted contract without performance records still makes debt recovery difficult. See also Authority to sign commercial contracts and Contract Health Check: 12 signs your company’s contract system needs a review.
Take the 10 highest-value contracts in force and check: does the signatory have authority, is the penalty above the cap, is there a penalty and damages clause, and are all performance records in place?
5. Area 3: Employment (criteria 9–12)
| # | Self-check question | Evidence needed to score “Met” |
|---|---|---|
| 9 | Does every employee have a contract of the right type and in the right form? | Staff list checked against contracts |
| 10 | Have work rules been issued (and registered, if required)? Are disciplinary actions and terminations based on correct grounds and procedure? | Work rules, files of disciplinary and termination cases |
| 11 ★ | Are social insurance, health insurance, unemployment insurance and PIT paid and declared for the right people at the right levels? | Payroll checked against the insurance list |
| 12 | Do staff who hold trade secrets have a confidentiality agreement with a clear scope? | Confidentiality agreements, list of positions that must sign |
- An employer with 10 or more employees must issue written work rules (nội quy lao động) and register them with the labour authority of the provincial People’s Committee (Articles 118 and 119, Labour Code 2019).
- Unlawful unilateral termination: the employer must take the employee back, pay salary and insurance for the days the employee was not allowed to work, and pay at least 2 additional months’ salary (Clause 1, Article 41).
- The parties may agree in writing on protecting business and technology secrets and on compensation for breach (Clause 2, Article 21).
Employment risk usually appears when the relationship ends: without valid work rules and written records, it is hard to prove the grounds. A gap between the salary actually paid and the salary used for insurance contributions can lead to back-payment obligations and action under social insurance law. Confidentiality agreements that are too broad and general are often hard to enforce.
Compare three lists: payroll, the social insurance list and the list of employment contracts. Every difference must be explained by documents.
Scored yourself but not sure you scored correctly?
FC Legal checks your self-assessment against the original documents, re-assesses the critical criteria and proposes a remediation order that fits your resources.
6. Area 4: Intellectual property and licences (criteria 13–16)
| # | Self-check question | Evidence needed to score “Met” |
|---|---|---|
| 13 | Have the trademarks and logos in use been searched and filed for registration? | Search results, application or protection title numbers |
| 14 | Are the rights to software, designs and content created by employees or contractors set out in writing? Is the software you use licensed? | Ownership clauses, software licences |
| 15 ★ | Are your actual business lines registered? Do conditional business lines have valid licences? | List of licences and expiry dates |
| 16 ★ | Do the head office, warehouses, workshops and shops meet fire safety requirements? | Fire safety file for each site |
- The Law on Intellectual Property applies the first-to-file principle: where applications are identical or similar, the protection title is in principle granted to the valid application with the earliest priority date or filing date (Article 90).
- Fire safety is now governed by the Law on Fire Prevention, Firefighting and Rescue No. 55/2024/QH15 and Decree No. 105/2025/ND-CP (in force from 1 July 2025), which replaces Decree No. 136/2020/ND-CP and Decree No. 50/2024/ND-CP.
Trademark risk usually appears late: the brand already has customers when the business finds that someone else filed first. For websites, software and brand identity created by freelancers or agencies, the business needs a written answer to “who is the owner?”. Many older documents still cite Decree No. 136/2020 or Decree No. 50/2024; check against the instruments currently in force.
Keep a table of “licence, site, expiry date, person in charge” and set reminders at least 60 days before expiry.
7. Area 5: Tax, invoices and data (criteria 17–20)
| # | Self-check question | Evidence needed to score “Met” |
|---|---|---|
| 17 ★ | Do you check suppliers and input invoices (tax code status, genuine transactions)? Are incorrect invoices handled under the current rules? | Search log, delivery records |
| 18 | Do purchase invoices of VND 5 million or more have non-cash payment records? | Invoices checked against bank statements |
| 19 | Is personal data collected on a legal basis and with notice? Have you determined how the new law applies to you? | Policy, notice templates, conclusion on scope of application |
| 20 | Are accounting records and books kept for the full period and retrievable? | Index of files by year, backups |
- Decree No. 123/2020/ND-CP, as amended by Decree No. 70/2025/ND-CP (applicable from 1 June 2025), changes how incorrect e-invoices are handled.
- From 1 July 2025, goods and services purchased for VND 5 million or more must have non-cash payment records to qualify for VAT deduction, with some exceptions (Law on Value-Added Tax No. 48/2024/QH15; Decree No. 181/2025/ND-CP).
- The Law on Personal Data Protection (Law No. 91/2025/QH15) takes effect on 1 January 2026; Decree No. 356/2025/ND-CP replaces Decree No. 13/2023/ND-CP. Small businesses and start-ups may choose to be exempt from some obligations (such as the impact assessment dossier) for 5 years, with the exceptions set out in the FAQ below.
- Accounting records must be kept for at least 5 years, 10 years or permanently, depending on the type (Law on Accounting No. 88/2015/QH13; Decree No. 174/2016/ND-CP). The Law on Tax Administration No. 108/2025/QH15 applies from 1 July 2026.
Invoice risk usually comes from suppliers: the invoice is correct in form, but the seller has stopped operating or the transaction cannot be proved, so the business may have the expense disallowed and lose the deduction. The payment threshold has dropped from VND 20 million to VND 5 million. For personal data, an SME’s first question is “are we exempt?”; for details, see Personal data compliance check: a 20-point Legal Health Check.
Every quarter, re-check the tax code status of your main suppliers and review the list of cash payments of VND 5 million or more before the filing period.
8. Remediation roadmap after scoring
This is a suggested FC Legal roadmap; the actual time depends on your size, the backlog and procedures at state authorities. The principle: verify first, fix second, because the right fix depends on how long the error has lasted and what obligations have already arisen.
| Period | Goal | What to do |
|---|---|---|
| Days 0–30 | Contain the ★ criteria | Verify capital contributions; review signing authority for contracts being performed; compare insurance with payroll; check licences and fire safety; review risky input invoices |
| Days 30–90 | Standardise documents | Update the charter and the rules on the seal and digital signatures; contract templates; work rules; confidentiality agreements; personal data policy |
| Days 90–180 | Maintain | File missing trademark applications; establish rights to digital assets; schedule the next self-check; assign someone to track legal changes |
9. Where should your business start?
If you do not have time for all 20 criteria, start with the 6 ★ criteria (1, 5, 11, 15, 16, 17). Answer these six questions honestly and you will know whether the business is at level A. Record the results in a table with the criterion, score, evidence, action, owner and deadline. This table is a good starting point when working with a lawyer or an outsourced in-house legal service.
Score yourself first, then ask a lawyer to re-check the criteria scored 0 or 0.5. This costs less than a full review from scratch and reduces the risk of misjudging how serious an issue is.
10. Frequently asked questions
What score means a business is legally safe?
The law does not set any score threshold. The 17/20 mark in this article is an FC Legal practical framework for putting tasks in order. Even with a high score, if a critical criterion is at 0, the business should deal with that criterion first.
How often should we repeat the self-check?
Our practical suggestion is every 6–12 months, and immediately after a major change: a change of members or shareholders, opening a branch or a new business line, a large increase in staff, or an important change in the law, such as the Law on Tax Administration No. 108/2025/QH15 applying from 1 July 2026.
Does a small business have to prepare a personal data processing impact assessment?
Small businesses and start-ups may choose to be exempt from this obligation for 5 years from 1 January 2026, unless they provide data processing services, process sensitive personal data or process data of 100,000 or more data subjects. The other obligations of Law No. 91/2025/QH15 still apply.
Does a self-check replace a lawyer’s review report?
No. The criteria help you find gaps and set priorities, but they cannot assess the validity of each document or the legal consequences of each breach. Use your self-check result as input for a meeting with a lawyer.
11. Legal basis and references
- Law on Enterprises No. 59/2020/QH14, as amended by Law No. 76/2025/QH15 (Articles 43, 47, 67, 86, 167)
- Civil Code No. 91/2015/QH13 (Articles 142, 143, 418, 429)
- Commercial Law No. 36/2005/QH11 (Articles 301, 307, 319)
- Labour Code No. 45/2019/QH14 (Articles 21, 41, 118, 119)
- Law on Intellectual Property (Article 90)
- Law on Fire Prevention, Firefighting and Rescue No. 55/2024/QH15; Decree No. 105/2025/ND-CP
- Decree No. 123/2020/ND-CP, as amended by Decree No. 70/2025/ND-CP
- Law on Value-Added Tax No. 48/2024/QH15; Decree No. 181/2025/ND-CP
- Law on Personal Data Protection No. 91/2025/QH15; Decree No. 356/2025/ND-CP
- Law on Accounting No. 88/2015/QH13; Decree No. 174/2016/ND-CP
- Law on Tax Administration No. 108/2025/QH15
Review your business’s legal health with an FC Legal lawyer
Identify the legal gaps in each area and a prioritised plan that suits your business.
- Review of governance, contract, employment, data and intellectual property records
- A risk report by priority level, with proposed fixes
- Support in standardising internal documents and processes
Please do not send confidential documents or personal data through the form.
This article is for reference. It reflects the rules in force at the time of publication. For legal advice on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
