Italian Legislative Decree n. 231 of 8 June 2001 introduced the concept of company liability, it states that legal entities may be held criminally or financially liable in relation to certain predicate offences which are committed or attempted by senior managers or subordinates in the interest or for benefit of the company.
Ratio legis and scope of the legislation
The “ratio legis” is that the company or other legal entity is considered directly responsible for certain crimes, which are understood to occur due to a lack of organisation and supervision: it is an act of omission and negligence that allows the crimes to take place as a result of a non-existent or inefficient management control system.
The scope of application of the legislation is to be found in the “predicate offences”, which include business crimes (false or misleading company statements), workplace accidents, unlawful processing of personal data, environmental offences, money laundering (misuse of privileged information).
An organisational model from the perspective of risk assessment
A tool for combating illegality within a company is the effective – and not just formal – adoption of an organisational model, consisting of procedures and rules of conduct which are specific to the company and which can be implemented successfully. To do this, it is necessary to adopt a policy of risk assessment and gap analysis within the risk management model:
- Process analysis: breaking down the business activity into individual processes, checking each process on the basis of its function and the achievement of the desired result, checking whether the process complies with applicable legislation;
- Risk assessment: identification of the points within the process that are at greatest risk, risk assessment and specification of prevention and protection measures
- Control: implementation of a control mechanism.
This is done through the Supervisory Board, which is independent, has financial strength and is responsible for verifying full compliance with the procedures set out in the organisational model.
The optional nature of the model: a distinctive feature of Legislative Decree 231
While in other fields – such as workplace safety – the provisions regarding risk limitation are mandatory legal requirements, the management organisational model that counteracts the commission of predicate offences is optional. The relative legislation therefore leaves the application of an organisational model to the discretion of decision-makers within the company.
The “231” Organisational Model: manage the processes, protect the company
While the law states that the adoption of an organisational model is optional, what the company must watch out for is precisely the absence or ineffectiveness of a 231 organisational model, or the absence or inaction of the supervisory board.
This is because not putting an adequate organisational structure into place automatically renders the company liable for the crimes committed, unless the company proves (Article 6 of Legislative Decree 231/2001) that it had adopted effective organisational and control models before the offence took place. This principle is referred to in a key judgment of 2007 – the first following publication of Legislative Decree 231 – in which the Court of Milan acquitted a public limited company of the crime of market manipulation as a direct result of its organisational model.
Adopting an organisational model therefore becomes a cornerstone of how a company manages its processes while, at the same time, protecting itself from unlawful actions committed by its staff.