What should a compliance programme include?
Although Spain has no comprehensive regulation of compliance, two key documents offer guidance: Article 31 bis.5 of the Criminal Code and Circular 1/2016 of the State Attorney General’s Office.
These documents focus mainly on criminal compliance, but they can serve as references for other areas of compliance.
These guidelines are essential for preventing criminal offences, because they determine whether a company’s compliance programme can mitigate or even exclude its criminal liability if an offence is committed.
Main elements of an effective compliance programme
- Risk Identification: Identify the areas of the company where offences may occur and build a risk map. It is crucial to know the laws that affect the company and the specific challenges it faces.
- Protocols: Design internal rules and measures that show the company’s commitment to compliance. This is where a code of ethics and other specific measures come in.
- Adequate Resources: Make sure the programme has the staff and material resources it needs.
- Whistleblowing Channel: Set up a reporting channel that lets both employees and third parties report possible breaches, always guaranteeing confidentiality.
- Disciplinary System: Establish internal measures to sanction conduct that breaches internal or external policies, while always respecting individual rights.
- Review and Update: Assess and update the compliance programme regularly, especially after an incident or a significant change in the organisation or in the relevant laws.
- Ethical Culture: Beyond documentation, it is essential to foster a culture that puts ethics and respect for the law first.
- Clear Documentation: Every compliance programme must be well documented, precise and tailored to the company’s reality.
Conclusion
Setting up a compliance programme means building a culture of integrity and accountability. The guidelines above are specific to criminal compliance, but their principles can and should be applied to all areas of compliance.