Audit & compliance
Organisational models under Legislative Decree 231/2001
We support the development and updating of organisational models under Legislative Decree 231/2001 and serve on supervisory bodies (Organismo di Vigilanza).
Service area Audit & compliance
What matters to you
Legislative Decree 231/2001 provides that companies are liable for certain offences committed in their interest or to their advantage by executives or employees. This so-called administrative liability of entities is in addition to the criminal liability of the individuals who acted.
A suitable and effectively implemented organisational model can, subject to the statutory conditions, help exempt the company from liability. To achieve this, the rules and controls must fit the company and actually be applied in day-to-day operations.
Request a consultation
Which risks the law covers
Liability relates to a statutory catalogue of offences (reati presupposto), which has been repeatedly extended since 2001. For medium-sized companies, the most relevant are offences in dealings with public bodies and public funding, breaches of occupational safety and environmental rules, corporate and tax offences, and money laundering.
Possible sanctions range from fines and confiscation of the proceeds to bans, such as exclusion from public contracts and grants or a prohibition on carrying on the business. For companies working with the public sector in particular, this can threaten their very existence.
Developing an organisational model
It starts with a risk analysis: we identify which offences could conceivably occur in which of your company’s processes and which controls are already in place. On this basis, the model is developed with a general section and special sections for the relevant risk areas.
A model is only effective if it is put into practice. This includes training employees, a disciplinary system for breaches and clear reporting lines to the supervisory body.
- Risk analysis (risk assessment) of business processes
- General section and special sections of the model
- Code of conduct (Codice etico)
- Disciplinary system and procedural rules
- Internal reporting channels for whistleblowers
The supervisory body (Organismo di Vigilanza)
The Organismo di Vigilanza (supervisory body) monitors the effectiveness of and compliance with the model and pushes for necessary updates. Its composition, powers and reporting lines must suit the company’s structure and ensure the necessary independence.
We act as an external member or as a single-member body. We carry out regular checks, review reports received, document our work and report to management.
What to watch out for
Template documents that do not match actual processes are often adopted. In the event of proceedings, however, the court examines whether the model was actually capable of preventing the offence. A model that has not been updated for years to reflect new predicate offences or changes in the company is just as problematic.
A model under Legislative Decree 231/2001 is not a legal requirement for most companies. In practice, however, it is increasingly expected in public tenders, by large clients or as part of accreditation processes.
Step by step
How we work together
Initial meeting and assessment
We get an overview of the organisation, areas of activity and existing rules and define the scope of the project.
Risk analysis
In discussions with the people responsible, we identify the relevant risk areas and assess existing controls.
Model and implementation
We draft the model, which is adopted by the management body, and train the employees concerned.
Monitoring and updating
In an advisory capacity, we support the adaptation of the model. As the supervisory body, we monitor its application and point out where updates are needed. Responsibility for adoption and implementation remains with the competent management body.
Frequently asked questions
Answers on introducing and maintaining an organisational model.
Is a model under Legislative Decree 231/2001 mandatory for us?
There is no general obligation for most private companies. However, a suitable and effectively implemented model can, subject to the statutory conditions, help exempt the company from liability. We also check whether there are specific requirements arising from tenders, licences or contractual relationships.
Is a model worthwhile for smaller companies too?
Yes, if the company operates in risk areas, for example with public contracts, subsidies or heightened occupational safety requirements. In small companies, the model can be leaner and, under certain conditions, the duties of the supervisory body can be performed by the management body itself.
How does the model relate to whistleblowing?
Companies with an organisational model must set up internal reporting channels through which suspected violations can be reported confidentially. We help with the setup and clarify who handles the reports.
How often does the model need to be updated?
Whenever new offences are added to the catalogue, the company changes significantly or violations reveal weaknesses. We also recommend a regular review, documented by the supervisory body in its annual report.
How can we help you?
In the initial meeting, we clarify your request and discuss what support you need.