Compliance management system: Let’s use the clear competitive advantage

• Compliance/Data Protection/ESG

Large companies have already taken many precautions in the area of compliance and have the resources to implement them. However, smaller companies can and should also take important steps to avoid non-compliance. Ethically correct behaviour in business transactions is not a “nice-to-have”, but is in line with contemporary expectations for sustainable business practices and ultimately a clear competitive advantage.

What is meant with compliance?

In simple terms, compliance refers to adherence to laws and internal company guidelines and directives on the one hand and the ethically correct behaviour of a company and its employees in business dealings on the other hand.

Companies must comply with national and applicable international law and even legal provisions that transcend territorial boundaries. Of course, contractual obligations, self-regulatory obligations of the industry and relevant legal enforcement practices of state authorities and courts must also be complied with. Depending on the industry, the focus of corporate compliance can be on different legal areas, e.g. anti-corruption, data protection compliance, competition law, HR compliance, financial compliance, fraud prevention, regulatory compliance with regard to various products (e.g. pharmaceuticals), etc.

Why is compliance so important?

It is a pity some business owners and employees underestimate compliance. Sometimes they realize too late that the costs of detected compliance violations is very high. Failure to comply with regulations can result in expensive fines and investigation/defence costs, loss of sales or loss of reliable business partners or disappointed employees. The time spent by management on investigations and processing the case should also not be underestimated.

A forward-looking, properly developed and implemented compliance management system creates a common understanding and culture of compliance with values and requirements throughout the company, helps to avoid potential financial and reputational risks in business processes and creates a significant competitive advantage in the long term.

What is a compliance management system?

The term “compliance management system” refers to all precautions and measures taken to ensure company-wide compliance. A comprehensive compliance management system includes:

1. Preventive measures: such as the creation of internal compliance guidelines (e.g. a code of conduct), the hiring of employees with integrity and the election of superiors who exemplify a compliance culture, the training of employees with regard to various legal aspects and internal company guidelines,  the clear definition of responsibilities for compliance and compliance management, the definition of compliance targets as part of compliance management and transparent reporting on the status and progress also support a sustainable, value-based corporate culture.
2. Monitoring measures: include the review of business processes and transactions through spot checks or major internal or external controls and audits. The regular collection of reports from individual areas of the company and reviews of training attendance, as well as internal or independent investigations into potential compliance violations, are also part of traditional monitoring.
3. Corrective measures and sanctions for non-compliance include process improvements, in particular stricter or more frequent preventive measures in the area of employee training, or stronger monitoring measures, up to and including appropriate sanctions of employees or the termination of business relationships.

Suggestions for your compliance management and recommendations for action

Every company is individually organised and has company-specific compliance risks to consider. Below you will find possible examples of various compliance measures, which are by no means exhaustive:

1) Prevention:

• Developing and approving a company Code of conduct and specific company compliance policies relevant to your industry and making these rules a part of the employment contracts and contracts with business partners.
• Making sure applicants and employees share your company values.
• Communicating your expectations of compliance (“tone from the top”) to employees and business partners and demonstrating these in your day-to-day work at all times (“role model”).
• Carrying out a risk analysis for potential non-compliance that could specifically affect your company and define appropriate preventive measures.
• Training your employees and managers on the company Code of conduct, various legal aspects and other internal company guidelines that must be observed, and, if necessary, also training important business partners.
• Carrying out due diligence on potential business partners and imposing contractual obligations on business partners to comply with applicable legal regulations.
• Offering your employees the opportunity to contact and consult their line manager or the relevant specialists (compliance function, other internal or external experts) at any time in case of uncertainties and doubts.
• Setting up channels for possible whistleblowing for employees and business partners (including an anonymous whistleblower hotline).

2) Monitoring:

• Encouraging your employees to report possible violations of the Code of conduct and/or legal requirements, taking such reports seriously, following up on them and ensuring that employees who report possible violations do not suffer any disadvantages as a result of the report made.
• Reviewing business processes and transactions and carrying out internal and external audits.
• Checking whether employees have attended in-house compliance training courses.

3) Enforcement:

• Do not tolerate non-compliance and take appropriate measures and sanctions in the event of compliance violations.
• Define and implement improvements where gaps are identified.
• Take appropriate measures and sanctions under labor law (warning, bonus reduction, termination, etc.) or, if necessary, terminate business relationships with an offending business partner.