Sin categoríaEffective Compliance: the Five Questions the Judge Will Ask Your Company

Your company has a compliance manual. It was commissioned years ago, it is bound, and nobody has opened it since. If criminal proceedings arrive tomorrow, that manual will be of no use to you. Worse: it can turn against you.

The company answers for itself

The starting point is worth recalling, because many business owners still do not believe it. Since 2010, the legal person answers criminally in an autonomous way. It can be convicted even if the material author of the offence is not identified, and it can be acquitted even if its administrator is convicted. And it answers through two routes: for the offences of its representatives and administrators, and for those committed by employees when there has been a serious breach of the duties of supervision. This second route is the one that surprises.

The penalties that destroy companies

The fine is the least of it. What kills are the others: prohibition on contracting with the public sector, loss of subsidies and tax benefits (including the refund of those already received), suspension of activities, closure of premises, judicial intervention and, at the extreme, dissolution. For many companies, the first of those penalties is the end of the business. And it arrives before the judgment: it arrives with the reputation.

The judge’s five questions

The law says that an effective organisation and management model, adopted before the facts, exempts or mitigates. The key word is effective, and the courts have been explicit about what it means. These are the questions with which it is examined: 1. Is the risk map real? A generic analysis, copied from another company, without identifying the specific risks of this activity and these processes, is worthless: in a construction company, a clinic and a logistics firm the risks look nothing alike. 2. Does the compliance body have real power? It must have autonomy, means and capacity for initiative; if it hierarchically depends on the person it must control, it is not independent, and the court will see it in five minutes. 3. Do the controls work? Existing on paper is not enough: there must be a record that they are executed, reviewed and that they detect things. A control that has never detected anything is suspicious, not reassuring. 4. Has anyone ever been sanctioned? A disciplinary regime never applied is a declaration of intent. And the uncomfortable question is: if nobody was ever sanctioned, is it that nothing ever happened, or that nobody was looking? 5. Is the model updated? A programme not reviewed in five years is a dead programme: the activity changes, the law changes, the risks change.

The whistleblowing channel is not a form

It is the piece most neglected and the one that weighs most. Since Law 2/2023, it is mandatory from 50 workers, and its absence is sanctioned by itself. But the real risk is not lacking it: it is having it and managing it badly. An internal report badly processed, or an informant against whom any unfavourable decision is later taken, turns a small problem into two big ones. And remember: if the harm arrives within the following two years, retaliation is presumed, and it is the company that must prove the contrary.

A living programme, or none

A model that passes that examination is the best investment an exposed company can make: it is, literally, the only defence the law recognises. One that does not pass it is an expense that also generates false security, and that at trial becomes proof that the company knew its risks and decided to do nothing real about them.