ESTABLISHMENT OF AN ADEQUATE AND EFFECTIVE COMPLIANCE MANAGEMENT SYSTEM – FOLLOWING GLOBALLY ACKNOWLEDGED STANDARDS, PRINCIPLES AND MODELS
ESTABLISHMENT OF AN ADEQUATE AND EFFECTIVE COMPLIANCE MANAGEMENT SYSTEM – FOLLOWING GLOBALLY ACKNOWLEDGED STANDARDS, PRINCIPLES AND MODELS

Summary/Abstract: General pricniples of law such as the rule-of-law, proprotionality, transparency or separation of powers (checks and balances) principle also shape compliance.4 However, this interpretation is indirect, hermeneutical and holistic in nature. Specific compliance standards, principles and models have been developed to increasingly integrate compliance into the nature and structures of companies, state, and non-governmental organizations. These efforts culminate in increasingly sophisticated compliance management systems tobe able to inegrate such principles in operations and to proof compliance. Global standards for such management systems, such as the ISO 373015 have been developed by the International Organization for Standardization6 . Such standards emphasize concepts like adequacy and effectiveness, the three-lines model, conflicts of interest, transparency and documentation, internal control systems, audits, and reviews. Corporate structures and cultures are not directly comparable to state structures. Entrepreneurship is characterized by entrepreneurial risk decisions. Consequently, specific principles such as the risk-based approach have emerged, and corporate decisions are guided by the business judgment rule.7 Compliance regulations, enforcement trends, and case law related to compliance have reached new heights, with indications of further intensification. Compliance is increasingly becoming an integral component of every organization, driven by top management and the chief compliance officer. It has become evident that compliance secures the viability and license to operate for companies. Compliance is no longer merely a defensive mechanism, as it was often perceived in the past. Instead, it serves as a competitive advantage and a guarantee for market viability. The ISO 37301 states: ‘Organizations that aim tobe successful in the long term need to establish and maintain a culture of compliance, considering the needs and expectations of interested parties. Compliance is therefore not only the basis, but also an opportunity, for a succesful and sustainable organization.‘8 Clear normative indicators of this shift include competition law, ESG9 and data, artificial intelligence legislation. EU competition law decisions have become famous due to huge companies being addressed with relatively high fines in global scales.10 The mechanism for competition fines is published by the EU Commission.11 Poor reputation, deficiencies, or even violations in environmental or human rights areas have become almost intolerable. The term ‘greenwashing‘ has even established itself in legal language. Viability increasingly hinges on data and artificial intelligence compliance. Cyberattacks or data breaches pose significant threats to a company’s survival. States now demand higher security standards as terrorist attacks, espionage, and hacking create intolerable risks. In this context, the interests of states and the survival interests of companies have become closely aligned. The evolution of compliance creates a need for change management within internal organizations. Governing bodies must address how the future legitimacy, resourcing, and enforcement of compliance should be shaped. This is particularly critical in global companies or matrix organizations, where numerous governance questions must be clarified.12 Top management is becoming increasingly aware of the rising accountability and liability risks.13 Fines and prison sentences are escalating and being enforced more rigorously. In various jurisdictions, including China, new sanctions such as professional bans, market exclusions, or profit disgorgements are emerging. Caselaw from recent months and years highlight that there are no longer safe zones, with board members increasingly becoming targets of state authorities. Compliance obligations are not delegable. Board members, the chief compliance officer, and compliance officers cannot transfer their accountability and liability. In German law, the criminal liability of guarantors is well established.14 If a compliance officer holds such a guarantor position, criminal liability can arise solely from their failure to act. This guarantor position imposes a duty to prevent specific risks or harm, and any omission to fulfill this duty - whether intentional or through negligence - can lead to criminal consequences. In the context of compliance, this includes failing to implement, monitor, or enforce measures that could have prevented unlawful acts within the organization. Therefore, compliance officers must fanticipate risks and fulfill the respectiveduties to avoid liability, emphasizing the importance of a well-structured and functioning compliance management system. Retrospective actions may mitigate compliance incidents, but this may be to late for the business. Like other managerial duties, compliance is an integral part of the duties of every executive. Only operational responsibilities for task execution can be delegated. Accountability and liability remains with governing bodies, chief compliance and compliance officers.

• Details
• Contents