{"id":21841,"date":"2015-10-19T09:40:19","date_gmt":"2015-10-19T07:40:19","guid":{"rendered":"https:\/\/www.in-diem.com\/support-for-implemented-or-implementing-regulatory-compliance-systems\/"},"modified":"2026-08-13T13:51:39","modified_gmt":"2026-08-13T11:51:39","slug":"support-for-implemented-or-implementing-regulatory-compliance-systems","status":"publish","type":"post","link":"https:\/\/www.in-diem.com\/en\/support-for-implemented-or-implementing-regulatory-compliance-systems\/","title":{"rendered":"Support for Implemented or Implementing REGULATORY COMPLIANCE Systems"},"content":{"rendered":"
\n
\n

Important:<\/strong> This article is a reprint of a 2015<\/strong> publication on compliance systems<\/strong>, criminal liability of legal entities<\/strong>, and external support for prevention models following the reform enacted by Organic Law 1\/2015<\/strong><\/a>.<\/p>\n\n

Since then, the interpretation of criminal liability models has been shaped by subsequent guidelines<\/strong>, including the Circular 1\/2016 issued by the State Attorney General\u2019s Office<\/strong><\/a>.<\/p>\n\n

Therefore, this post should be read as a historical reference on the initial phase of implementing and strengthening criminal compliance<\/strong> systems in Spain.<\/p>\n<\/div>\n\n

The implementation of compliance<\/strong> systems took on particular importance following the reform of the Penal Code enacted by Organic Law 1\/2015<\/strong><\/a>. In this context, companies began to pay increasing attention to prevention, oversight, and internal control models aimed at reducing criminal risks and demonstrating a genuine commitment to compliance. <\/p>\n\n

This article analyzes support for regulatory compliance<\/strong> systems that are already in place or in the process of being implemented, with a particular focus on the outsourcing<\/strong> of functions related to continuous improvement, auditing, process adaptation, and support for the Compliance Officer<\/strong>.<\/p>\n\n

Support for regulatory compliance systems that are already in place or being implemented<\/h2>\n\n

As you are aware, effective as of the Organic Law 1\/2015<\/strong><\/a>, the Penal Code<\/a><\/strong> requires a prevention or compliance system that meets the specific requirements and conditions set forth in the current Article 31 bis.2, paragraphs 1 through 4<\/strong>, of the Criminal Code, in order to achieve full exemption from criminal liability for both the company and the members of its governing bodies or executives who might potentially be affected.<\/p>\n\n

The reform introduced a significant change in how criminal prevention is understood within organizations.<\/strong> It was no longer simply a matter of reacting to a criminal act after it had occurred, but rather of having pre-established structures for monitoring, control, and prevention that would reduce the risk of crimes being committed within the company.<\/p>\n\n

From this perspective, compliance systems should not be viewed as static documents, but rather as legal and organizational management tools tailored to each company\u2019s specific activities, its internal structure, and the risks inherent to its industry.<\/p>\n\n

Continuous Improvement of the Compliance System<\/h2>\n\n

The goal of full exemption requires the implementation of a continuous improvement<\/strong> process based on risks as they are identified or on changes that affect the organization.<\/p>\n\n

This concept of continuous improvement is particularly important because a compliance system can only be effective if it is reviewed, updated, and adapted to the company\u2019s current situation. Business risks can vary due to changes in operations, organizational growth, the addition of new departments, geographic expansion, contracts with third parties, or changes to internal procedures. <\/p>\n\n

For this reason, the compliance system must be reviewed periodically. The identification of new risks, the occurrence of incidents, questions regarding interpretation, or changes in the company\u2019s structure may require adjustments to protocols, manuals, internal controls, or corrective measures. <\/p>\n\n

Outsourcing of Compliance System Support<\/h2>\n\n

The outsourcing of continuous improvement services can take place in various areas; for example, from general or specific audits<\/strong> to proposing corrective measures<\/strong>, adapting processes or manuals, resolving inquiries or issues that require specialized knowledge or dedicated attention, as well as providing support to the Compliance Officer<\/strong> or even performing that role as an external consultant.<\/p>\n\n

Outsourcing can be particularly useful when a company needs an independent technical perspective, a specialized review, or ongoing support to strengthen the model\u2019s performance. It may also be relevant when an organization already has a system in place but needs to verify whether that system continues to adequately address the identified risks. <\/p>\n\n

External support can take various forms: document review, model audit, risk analysis, proposals for improvements, updating of manuals, assistance to the supervisory body, resolution of internal inquiries, or guidance on adapting the system to new organizational needs.<\/p>\n\n

External Compliance Officer and Independence of Oversight<\/h2>\n\n

With regard to the external Compliance Officer<\/strong>, it is worth highlighting the provisions of Article 31 bis.2.2(a)<\/strong>, which establishes that oversight of the operation and compliance with the implemented prevention model must be entrusted to a body within the legal entity that has autonomous powers of initiative and control or that is legally entrusted with the function of supervising the effectiveness of the legal entity\u2019s internal controls.<\/p>\n\n

The reference to autonomy in initiative and oversight was particularly relevant, because the compliance system could not depend exclusively on a formal structure lacking any real oversight capacity. For the model to fulfill its purpose, the body or individual responsible for oversight needed to have sufficient authority to review, issue warnings, propose measures, and take action in response to detected noncompliance or risks. <\/p>\n\n

Based on the text itself, it is recognized that this entity may initially be separate from the legal entity itself but, after becoming part of the company, may be legally entrusted with the function of overseeing the compliance system or may collaborate with the legal entity\u2019s body responsible for that function, since it is clear that the party entrusted with the function of overseeing the effectiveness of the legal entity\u2019s internal controls must be external to the entity.<\/p>\n\n

External involvement could also provide greater technical expertise in criminal, commercial, organizational, and regulatory matters. In companies with complex structures or significant risks, support from external professionals helped strengthen the independence, objectivity, and analytical capacity of the compliance system. <\/p>\n\n

Independence, Transparency, and Self-Regulatory Systems<\/h2>\n\n

In fact, as a general rule, international self-regulatory systems recognize that a higher degree of outsourcing of the functions or services that make up supervision provides greater assurance of independence<\/strong> and transparency<\/strong>.<\/p>\n\n

The independence of the compliance system is essential to prevent the model from being subject to internal interests that could hinder effective oversight. The oversight function must be able to operate objectively, especially when risks are identified that affect the board of directors, senior management, middle management, or sensitive areas of the organization. <\/p>\n\n

Transparency, for its part, makes it possible to demonstrate that the company does not merely declare a formal commitment to compliance, but rather takes concrete measures to prevent risks, review its internal operations, and address potential violations.<\/p>\n\n

The End of the Regulatory Compliance System<\/h2>\n\n

Let\u2019s keep in mind that the purpose of the compliance system<\/strong> is not only to secure exemption from criminal liability for the company but also to demonstrate a clear and unequivocal commitment to compliance with the rules.<\/p>\n\n

This statement is one of the central ideas of the article. Criminal compliance should not be viewed solely as a defensive tool against a potential indictment of the legal entity, but rather as an expression of corporate culture, business diligence, and a commitment to the law. <\/p>\n\n

An effective compliance system makes it possible to organize the company\u2019s operations internally, identify risks, establish controls, document decisions, train the relevant personnel, and create a preventive framework. All of this helps strengthen the organization\u2019s legal certainty and reduce its exposure to criminal, reputational, and operational risks. <\/p>\n\n

Up-to-date Information on Criminal Compliance and Corporate Liability<\/h2>\n\n

For more up-to-date information<\/strong> on regulatory compliance<\/strong>, criminal compliance<\/strong>, and the criminal liability of legal entities, please see other content from IN DIEM Abogados<\/strong> on Corporate Compliance<\/strong><\/a>, criminal liability of companies and organizations<\/strong><\/a>, corporate commitment and corporate compliance<\/strong><\/a>, economic criminal law and criminal defense for companies<\/strong><\/a> and corporate criminal liability in money laundering cases<\/strong><\/a>.<\/p>\n\n

\n\n

Legal Support for Regulatory Compliance Processes<\/h2>\n\n

IN DIEM<\/strong> provides the necessary resources to adapt previous, existing, or newly implemented regulatory compliance processes<\/strong> to robust systems that are aligned with current and international regulations and offer greater assurance of achieving the exemption objective, as well as to provide the external support services required by your regulatory compliance system.<\/p>\n\n

Legal advice in this area may be relevant for companies that need to implement a prevention system, review an existing model, update their internal processes, strengthen the role of the Compliance Officer<\/strong>, or obtain specialized external support for monitoring the system.<\/p>\n\n

It may also be necessary when the company is undergoing a phase of growth, internal reorganization, international expansion, contracting with third parties, taking on new risks, or reviewing its control procedures.<\/p>\n\n

Up-to-date Information on Criminal Compliance and Corporate Liability<\/h2>\n\n

For more up-to-date information on regulatory compliance<\/strong>, criminal compliance<\/strong>, and the criminal liability of legal entities, please see other content from IN DIEM Abogados<\/strong> on Corporate Compliance<\/strong><\/a>, criminal liability of companies and organizations<\/strong><\/a>, corporate commitment and corporate compliance<\/strong><\/a>, economic criminal law and criminal defense for companies<\/strong><\/a> and corporate criminal liability for money laundering offenses<\/strong><\/a>.<\/p>\n\n

\n\n\n