You might want to change your @sql definition to something like the following:

set @SQL = 'SELECT Company_NO,

'''' as CompanyName, --Added extra quote marks

CASE isNull(post_date, 0)

WHEN 0 THEN DATEPART(yyyy, DATEADD(mm, - 6, create_date))

ELSE DATEPART(yyyy, DATEADD(mm, - 6, post_date)) END AS Year

FROM CompanyOrder

WHERE CompanyType IN (' + @param + ')'

Notice that this is vulnerable to SQL injection. To prevent this you need to change the code to a parametrized code. I'll work on it and post again.