El ámbito empresarial moderno requiere de programas de compliance eficaces para evitar la responsabilidad penal y garantizar un funcionamiento ético y conforme a la ley. Además, este cumplimiento normativo refuerza la imagen y reputación empresarial ante la sociedad. Sin embargo, no está exento de desafíos.
The EU Anti-Corruption Directive harmonises corruption offences across member states, adding trading in influence, misappropriation, obstruction of justice and concealment of corruption-related assets to bribery, and extends corporate liability to acts committed for a company’s benefit. Fines can reach five percent of global turnover, with exclusion from public procurement on top. Companies need working anti-corruption policies, training and a reporting channel, not documents in a drawer.
How to Implement a Compliance Program in a Small Business Regulatory expectations for small businesses are increasing, particularly around internal reporting, data protection, and governance.
Scaling a business should not scale its liability. Growth adds employees, partners, systems and decision layers, and the informal compliance that worked at 20 people breaks at 200: policies sit in PDFs, nobody can prove who read what, and the evidence a regulator or insurer asks for does not exist. Companies that scale safely run compliance as a system: distributed policies, tracked training and documented due diligence.
Compliance is not about who can swim, it is about who gets a life vest. Risk-based programmes that only cover the people judged most exposed leave gaps that show up in an incident. Giving every employee, partner and supplier the same basic protection, clear policies, short training and a way to report, is simpler, cheaper and easier to prove than a tailored programme that looks thorough on paper.
The Apple and John Deere cases show that supply chain compliance does not stop at the parent company. Both were held publicly accountable for minerals sourced from conflict zones such as the Democratic Republic of the Congo, and the lesson is the same for any business: know where materials come from, screen and monitor suppliers at every link of the chain, and document it, because reputational damage lands on the brand, not the sub-supplier.
Portugal’s General Corruption Prevention Regime (RGPC), Decree-Law 109-E/2021, applies to public bodies and to private entities with 50 or more employees, including local branches of foreign companies. It requires a corruption risk prevention plan, a code of conduct, a confidential whistleblowing channel compliant with Law 93/2021, and mandatory training for executives and staff, with sanctions for non-compliance overseen by MENAC.
Setting up a robust compliance programme has become essential as the rules governing corporate conduct multiply. Yet there is no regulated guide to what exactly these programmes must contain, which raises the question of how to implement them.
The OIG’s 2023 General Compliance Program Guidance gives US healthcare SMEs a roadmap: understand what the guidance expects of an effective programme, tailor it to the organisation’s size and risk, assess and monitor risk continuously, enforce standards consistently, respond to issues quickly, and build a culture where compliance is everyone’s job. Written policies, training and a reporting channel are the practical core of all six steps.