Important changes in the area of compliance
Is your compliance system prepared for the upcoming changes?
The EU Whistleblower Directive significantly expands entrepreneurs’ obligations with regard to their compliance system. In addition, the Corporate Sanctions Act (VerSanG) is to be adopted.
Below is an overview of the most important changes:
A. “EU Whistleblower Directive”
I. Objectives of the Directive
The EU Whistleblower Directive aims to uncover and prevent violations of EU law, particularly with regard to tax fraud, money laundering or offenses related to public procurement, product and traffic safety, environmental protection, public health, and consumer and data protection. In addition, effective, confidential and secure reporting channels are to be established and whistleblowers better protected.
II. Implementation of the directive in your company
1. General requirements
Does your company employ more than 250 people? Then you have been obliged since December 17, 2021 – otherwise within two years at the latest – to set up channels through which violations of national and EU law can be reported. These channels must allow reports to be made in writing, orally or in person. It is important that all information submitted is documented in writing or recorded as an audio recording in a durable and retrievable form. The whistleblower must be given the opportunity to check the note or minutes and correct them if necessary. They must also confirm it with their signature. Moreover, it must be possible to make a report at any time. Companies are free to decide whether to set up an internal organizational unit or to entrust an external reporting office.
In addition, it must be ensured that unauthorized employees are denied access. The confidentiality of the whistleblower’s identity must be guaranteed at all times. Furthermore, receipt of the report must be acknowledged within seven days at the latest. Within three months, the whistleblower must also receive feedback on how their report is being followed up.
2. Implementation options
In practice, there are two options:
Firstly, setting up a toll-free external telephone number (problem: round-the-clock availability and overcoming language barriers may incur high costs); otherwise, setting up an IT-secured whistleblower system.
III. Is your company affected by the directive?
It is still unclear whether the German legislature will make use of the option to postpone this obligation by two years for legal entities with between 50 and 249 employees. Even then, however, prompt implementation is advisable, as these companies will also be obliged to introduce a reporting channel within two years at the latest!
B. Introduction of ISO 37301
I. Changes compared to ISO 19600
With regard to the compliance systems to be introduced, ISO 37301 must be taken into account. In terms of content, ISO 37301 differs only slightly from the previous ISO 19600.
However, unlike ISO 19600, ISO 37301 is a Level A standard. ISO 19600 has a Level B status and is not binding; therefore, it does not serve as a benchmark for certification.
Instead, ISO 37301 contains “should” and “shall” provisions. This is intended to give you the opportunity to have the structure, implementation and effectiveness of your compliance management system reviewed from your own perspective and to demonstrate this through certification.
Certification allows you to prove that you took measures in advance to prevent violations. This becomes particularly relevant under the VerSanG described above.
II. Practical significance for your company
If you have aligned your compliance system with ISO 19600, you need not fear any significant changes.
ISO 37301 is very similar to ISO 19600 in its approach. However, the compliance system should be reviewed against ISO 37301. If you do not yet have a compliance system in place, we recommend using ISO 37301 as a guide. Do you need support? We at Eigenstetter Helmreich und Partner will be happy to advise and help you.
Although the ISO 37301 standards are not legally binding, non-compliance creates a risk that your compliance system will not be certified and that, in the event of a corporate offense, you may be accused of not having done enough in advance to prevent corporate criminal offenses. In view of the high sanctions, it is advisable to align your system with ISO 37301.
D. How we can help you
Our team at clience.legal is your point of contact for all legal issues in your company. In particular, we support you in implementing the changes described in your company, as well as with all questions relating to compliance.
