Corporate Compliance
A compliance system is effective when the rules are clear, responsibilities are identified, and controls are integrated into daily operations. We support companies in analyzing risk areas and reviewing procedures, delegations, and controls, coordinating the work with internal functions and specialized consultants.
Starting from the real risks of the company
Compliance helps ensure accountability and accountability for decisions. A company that entrusts purchasing, payments, personnel management, and public administration relations to the same people has different needs than a group with separate functions. The starting point is understanding how the work is actually carried out, even when practices have diverged from the organizational chart.
We examine activities, decision-making processes, third-party relationships, and documentation. We compare written rules with practices and identify areas where unclear authority, missing controls, or undocumented steps could expose the company. The result is a thoughtful list of actions, with defined priorities and responsibilities.
Model 231: adoption and implementation
Legislative Decree 231/2001 regulates the liability of an entity for certain crimes committed in its interest or to its advantage. The organizational model is not a general certification of compliance: its relevance also depends on the suitability of the safeguards and their effective implementation. The system must be tailored to the risks of the activity, updated, and supported by verifiable controls.
The work may include mapping sensitive activities, reviewing protocols and contractual clauses, coordinating delegations and powers of attorney, information flows, the disciplinary system, and training support. The role of the supervisory body remains separate from the firm's assistance. Before the assignment, we define the necessary skills and the contribution of criminal, technical, and organizational specialists.
Whistleblowing: making the reporting channel work
The provisions of Legislative Decree 24/2023 first require verifying whether and within what scope they apply to the organization. The analysis concerns the permitted reports, the recipients of protection, the internal channel, and the person responsible for management. An email address listed on the website alone does not resolve the organization of the process.
We support companies in defining procedures: receiving and evaluating reports, confidential discussions, managing conflicts of interest, investigations, and document retention. We coordinate confidentiality and data protection with audit and defense requirements. A report must be examined; it is not equivalent to proof of the alleged fact.
Delegations, procedures and relationships with third parties
Frequently asked questions
Who can commit the company?
Who authorizes an expense and who monitors performance?
What happens when the responsible party is absent?
These are operational questions that a procedure must address. We verify the consistency between formal powers, amount limits, actual responsibilities, and approval flows, without attributing an automatic liberating effect to a simple delegation.
In our relationships with suppliers, agents, consultants, and partners, we review disclosure requirements, declarations, control clauses, and remedies in the event of violations. Contractual provisions must be compatible with internal processes: introducing an obligation that no one verifies could leave the critical issue untouched.
An example: the company opens a new business
Let's imagine a company acquiring a business unit and maintaining the previous procedures. However, managers, suppliers, authorizations, and payment methods change. Our job is to identify the points of discontinuity, verify the powers, reconcile contracts and procedures, and define which controls need to be updated before the start-up. This is an illustrative example, not a job description.
The discussion involves existing administrators, operational managers, and consultants. We do not replace the company's technical or management support: we clarify the legal aspects, alternatives, and activities that must be entrusted to the appropriate expertise.
Documents and practical outcomes
For the initial assessment, the organizational chart, bylaws, delegations and powers of attorney, any applicable Model 231, code of ethics, operating procedures, significant contracts, and documentation of critical issues that have already emerged are useful. For whistleblowing, the channel procedure, assignments, disclosures, and agreements with suppliers are also required. We agree on protected procedures for confidential documents and access limits for reports.
The feedback process distinguishes what requires immediate action, what can be planned, and what needs to be monitored. The plan specifies activities, contact persons, and subsequent checks. New operations, organizational changes, or incidents may require a review before the periodic review.
Questions to clarify at the beginning
Is it necessary to redo everything if a model and procedures already exist? Not necessarily: first, let's check whether the documents still describe the organization and whether the safeguards are working. The priority may be implementing an already established rule, not producing a new document.
Who manages the channel and who carries out the checks? These roles must be explicitly defined, with appropriate skills, autonomy, and tools. Legal assistance, reporting management, and supervisory duties are not presumed to be intertwined. Scope and responsibilities are agreed upon before the start of the process.
Related services
References: Legislative Decree 231/2001; Legislative Decree 24/2023; ANAC guidelines on internal channels; opinion of the Privacy Guarantor.