Corporate compliance and Model 231: proof that the business has organised itself

Corporate compliance exists to ensure that for every obligation there is someone accountable for it, something that monitors it and evidence that remains. This is why every element of the guide comes with its rationale: what it is for, what happens if it is missing, and whose responsibility it is.

Yet anyone looking for a definition almost always finds nothing more than a list of laws. Nothing could be further from its real value. Corporate compliance is first and foremost a key factor in corporate governance: because a rule observed only on paper protects no one.

Let’s find out why.

What corporate compliance is: meaning and definition

If we are looking for a meaning of corporate compliance, then we need to talk about a company’s ability to operate in accordance with the rules that apply to it, whether laws, regulations or rules it has set for itself (such as the code of ethics, which we discussed in this article). A complete definition should also include the words “verifiable” and “continuous”, because being compliant on a single day is not enough. You need to be able to show an authority or a shareholder that the rules are applied and monitored over time.

The reason becomes clear when you look at who pays when compliance is missing. Penalties fall on the company, but the heaviest consequences often land on those who made the decisions or exercised oversight: directors, executives and, in some cases, individual employees. Corporate compliance is how an organisation moves the issue from individual fault to the system: if the rules exist, are understandable and are monitored, an error remains an incident; if they do not exist, it becomes a governance responsibility.

Translating the term compliance

The Italian translation of compliance is conformità, from the English verb to comply, meaning to conform. The English term has prevailed because the literal translation suggests simple obedience to the law, whereas compliance also includes prevention: identifying in advance which rules affect the company and where they might be breached. A genuine difference of method. After all, obedience is checked afterwards, whereas compliance is built beforehand.

Why corporate compliance concerns those who govern the company

Corporate compliance and governance are related concepts.

Under Italian law, anyone running a business in corporate form has a duty to establish organisational, administrative and accounting arrangements appropriate to the nature and size of the business (Article 2086 of the Civil Code, second paragraph, introduced by Legislative Decree 14/2019). Corporate compliance is part of those arrangements: it is the function that tells whether the organisation is capable of meeting what is required of it.

The principle also applies to personal data, the best-known case of corporate compliance. The GDPR provides that the data controller is responsible for compliance with the principles and must be able to demonstrate it (EU Regulation 2016/679, Article 5, paragraph 2). Claiming to be compliant is not enough: you must be able to prove it. This logic, proof of compliance, underpins all corporate compliance and explains why documentation is not bureaucracy but the company’s main defence when facing an inspection.

This has a practical consequence for decision-makers. To ensure sound corporate compliance, the Board of Directors must know at least three things: (i) which obligations are covered, (ii) who is accountable for each, and (iii) which signals must reach it. If it does not know, corporate compliance exists only on paper, and compliance that exists only on paper does not withstand scrutiny.

Corporate regulation: which rules fall within compliance

The regulations a company must comply with depend on its sector, size and markets, and fall into two families. The first is mandatory: laws and regulations that apply to all companies or to certain categories of company. The second is voluntary: codes, internal policies, standards and certifications that the company chooses to adopt and that, once adopted, become commitments it must honour.

Among the most common areas:

• Administrative liability of entities for offences committed by those working for the company (Legislative Decree 231/2001).
• Personal data protection (GDPR and national legislation).
• Health and safety at work.
• Anti-corruption and relations with the public administration.
• Reporting of wrongdoing, so-called whistleblowing (Legislative Decree 24/2023).
• Sector-specific rules, such as those for banking, insurance, healthcare or the environment.

How do you bring order to corporate compliance across all these areas? With a register of obligations: the list of rules that apply to the company, each with an owner and a review date. Without this list, corporate compliance is reduced to reacting to the latest regulatory change. With a register, however, you can see where the company is exposed, that is, where an obligation has no one overseeing it.

There is also an international standard that gives this work a structure: ISO 37301, published in April 2021, which sets out the requirements for a compliance management system, applies to organisations of any kind and replaced the earlier ISO 19600 guideline (ISO, technical committee TC 309). Its value lies not in the number of the standard but in the idea that corporate compliance is a system to be managed, with objectives, roles and continuous improvement, rather than a one-off obligation to be ticked off.

Corporate compliance and Model 231: proof that the company has organised itself

231 compliance refers to the point where compliance meets the company’s criminal liability. Legislative Decree 231/2001 provides that an entity is liable for offences committed in its interest or to its advantage by directors, managers and employees. The decree does, however, offer a way out: the entity is not liable if it can prove that, before the offence, it adopted and implemented an organisational and control model capable of preventing offences of that type, and entrusted oversight to an autonomous body.

The reason for this architecture is the same as for corporate compliance: the legislator does not ask a company to guarantee that no one makes mistakes; it asks it to demonstrate that it has organised itself to reduce risk. The 231 Model is therefore among the most structured forms of corporate compliance provided for by the Italian legal system. We explain how it is built, what it contains and when it is genuinely effective in our guide to the 231 Model. 

Whistleblowing: the channel that feeds compliance

Reporting and whistleblowing are the source of information that compliance cannot build on its own. Legislative Decree 24/2023 requires an internal reporting channel for, among others, private companies that employed an average of at least fifty employees over the last year and for those that adopt a 231 model, regardless of headcount (Legislative Decree 24/2023, Article 2). The channel must guarantee confidentiality and may be managed by an autonomous, trained person or office, or by an external party (Article 4).

The deadlines are precise: acknowledgement of receipt within seven days and feedback within three months (Article 5). Retaliation is prohibited, and those who carry it out face administrative fines of 10,000 to 50,000 euros (Articles 17 and 21). The reason it matters for corporate compliance is practical: people working inside the company see problems before any audit does. A channel that works is an early warning system; a channel that exists but that nobody trusts leaves the company in the dark about what is happening.

Who handles compliance in a company: roles and responsibilities

The compliance officer is the role that organises and oversees corporate compliance: identifying the applicable rules, translating obligations into procedures, monitoring adherence, training people and reporting to senior management. This is not the same as the person accountable for compliance. Responsibility lies, in order, with those who govern, with those who manage individual areas and with each person for what they do.

This is why it makes sense to think in terms of levels of oversight, each with a different task:

1. Operational functions, the first to encounter risk, apply the procedures and are accountable for them in their day-to-day work.
2. The compliance function, together with risk management, defines the rules, checks them and updates them.
3. An independent check, such as internal audit or the supervisory body, verifies that the first two levels actually work.

The reason for the separation is independence: those who monitor cannot be the same people who operate. This is why the compliance officer reports to those who govern, not to the head of an area they must oversee. In small companies roles are concentrated, but the principle does not change: if there is no dedicated role, at the very least the same person should not both apply a rule and certify that it has been followed. Anyone wishing to map how roles and delegated authority connect to the company’s set-up can start from the company’s organisational structure and the RACI matrix (which we covered in this in-depth article).

How to build corporate compliance: six steps

A corporate compliance system is built starting from risks, not from rules. A company that starts from a list of laws ends up overseeing everything in the same way, and therefore nothing properly. One that starts from where an error would cost most decides where to concentrate its controls. It is the same logic as risk management, from which corporate compliance inherits its method.

The list has no final step that closes the work, because corporate compliance is never finished. Every new activity, every market, every major supplier changes the landscape of obligations.

To decide whether the corporate compliance system is ready, it helps to work through each obligation individually using this grid. The examples below are illustrative:

The last column is the one the two top-ranking guides in the SERP do not cover, and the one that matters most. It establishes when an issue stops being operational and becomes a decision for those who govern. Without this rule, compliance produces plenty of information and no decisions.

Corporate compliance, risk management and internal control

The internal control system is the set of rules, procedures and structures that keeps the company on track towards its objectives; corporate compliance is one of its safeguards. They are distinguished by the question they answer:

• Corporate compliance: are we following the rules that apply to us?
• Risk management: which events could prevent us from achieving our objectives, and how much risk are we willing to accept?
• Internal audit: do our controls actually work, and is that confirmed by someone who does not run them?

The distinction prevents duties from overlapping. When a single function carries out all three activities, no one is independent of what they assess, and controls lose credibility. Two further topics complete the picture: compliance risk management, that is, how the risk of non-compliance is assessed, and conflicts of interest, which test the independence of those who carry out controls.

Corporate compliance and work: careers, training and master’s degrees

Working in corporate compliance means handling compliance as a compliance officer, specialist or analyst, in companies across every sector and in consultancy firms. Backgrounds vary: law and economics are the most common, but engineering, political science and audit and risk management skills also count. What sets a strong profile apart is not the number of rules memorised, but the ability to translate them into understandable procedures and explain them to decision-makers.

Master’s in compliance: when it is really needed

A master’s in compliance is most useful for those coming from a different background who want to acquire the function’s method and language. Before choosing one, it is worth checking three things: whether the programme covers both regulation and the organisation of controls, whether it includes case studies or work placements, and how well the qualification is recognised in the target sector. The qualification does not replace experience: in compliance, experience consists above all in having seen how controls break down in practice.

Compliance advisory: when you need it and what to ask

Corporate compliance advisory is useful at three moments: when the company does not yet have a dedicated function and needs to build the system, when its exposure changes (a new business activity, a new market, an acquisition) and when an independent opinion on the existing system is needed. In some cases the law itself provides for the use of external parties: the reporting channel, for example, can be entrusted to an autonomous, trained external party (Legislative Decree 24/2023, Article 4).

Good advisory leaves the company with a system it can manage on its own. Before engaging a corporate compliance consultant, it is worth asking who, after the project, will be responsible for each obligation, what evidence there will be for each control and how the system will be updated. If the answers are vague, the risk is buying a manual that nobody will apply. A system copied from another context risks giving the impression of being protected without actually being so.

Main mistakes in corporate compliance

Errors in corporate compliance almost always stem from the same root: treating compliance as a document rather than as a responsibility. The most common:

• Mistaking compliance for paperwork: codes and procedures that nobody has read or applied. A document without controls proves nothing.
• Failing to assign a named owner, leaving obligations “to the department”.
• Assigning controls to people who work in the area being controlled.
• Failing to set out when and how an issue is escalated to the Board of Directors.
• Neglecting training, or delivering it only once.
• Failing to update corporate compliance when regulations, activities or markets change.
• Ignoring reports: a channel that is active but ignored produces the worst possible outcome, a company that knew and did not act.