Successful Compliance

Imprint

ISBN 978-3-85402-308-1

Also available as printed version:

ISBN 978-3-85402-307-4

Also available in German language:

ISBN 978-3-85402-305-0

e-Pub ISBN 978-3-85402-306-7

First edition 2015

This work is protected by copyright.

All rights reserved.

Reprint, duplication, photographing or recording on any other media or data medium, even if only used in extracts shall be permissible only based upon explicit written consent on the part of Austrian Standards plus GmbH. Despite of thorough editing no responsibility can be taken for the correctness of the data given in the book. Publisher and author cannot be held liable.

© Austrian Standards plus GmbH, Vienna 2015

Austrian Standards plus GmbH is an enterprise of Austrian Standards Institute.

AUSTRIAN STANDARDS PLUS GMBH

1020 Vienna, Heinestraße 38

T [phone]

F [phone]

E [e-mail]

www.austrian-standards.at

PROJECT COORDINATION

Gertraud Reznicek

COVERPHOTO

©iStock.com/Alexander Bedrin

GRAPHICAL DESIGN

Martin Aschauer

PRINTING

Morawa Lesezirkel GesmbH, 1140 Wien

Inhalt

Foreword

Abbreviations

1 Basic principles and general framework

1.1 Definition of the term ‘compliance’

1.2 Legal framework for compliance in organsations

1.2.1 Responsibility of organisations in the international arena

1.2.2 Responsibility of organisations at the national level

1.2.3 Responsibility for compliance in Austria

1.3 Compliance as a tool of strategic management

1.3.1 Definition of management systems

1.3.2 Compliance Management Systems

1.4 Distinction between corporate governance – ICS – RMS – CMS

1.4.1 Corporate governance

1.4.2 Internal control system (ICS)

1.4.3 Risk management system (RMS)

1.4.4 Compliance management system (CMS)

1.5 Standardisation of management systems in accordance with ISO

1.6 Certification

1.6.1 Importance of the certification of a CMS

1.6.2 Certification under ISO

2 A CMS in accordance with ISO 19600 at a glance

2.1 Positioning of ISO 19600 as a best-practise approach

2.1.1 Positioning of ISO 19600 compared to legal requirements

2.1.2 ISO 19600 in comparison with selected management tools

2.2 Approach for the implementation of a CMS in accordance with ISO 19600

2.2.1 PLAN – Preparation

2.2.2 DO – Implementation

2.2.3 CHECK – Verification

2.2.4 ACT – Improvement

3 Elements of ISO 19600 – compliance management systems

3.1 Introduction

3.2 Area of application of the ISO 19600 standard

3.3 Definitions in accordance with ISO 19600

3.4 Context of the organisation

3.4.1 Understanding the organisation and its context

3.4.2 Understanding the needs and expectations of interested parties

3.4.3 Determining the scope of the compliance management systems

3.4.4 CMS and principles of good governance

3.4.5 Compliance obligations

3.4.6 Identification, analysis and evaluation of compliance risks

3.5 Leadership

3.5.1 Leadership and commitment

3.5.2 Compliance policy

3.5.3 Organisational roles, responsibilities and authorities

3.5.4 Management responsibility

3.5.5 Employee responsibility

3.6 Planning

3.6.1 Actions to address compliance risks

3.6.2 Compliance objectives and planning to achieving them

3.7 Support

3.7.1 Resources

3.7.2 Competence and training

3.7.3 Awareness

3.7.4 Communication

3.7.5 Documented information

3.8 Operation

3.8.1 Operational planning and control

3.8.2 Establishing controls and procedures

3.8.3 Outsourced processes

3.9 Performance evaluation

3.9.1 Monitoring, measurement, analysis and evaluation

3.9.2 Audits

3.9.3 Management review

3.10 Improvement

3.10.1 Nonconformity, non-compliance and corrective measures

3.10.2 Escalation

3.10.3 Continual improvement

4 Guide for small and ­medium-sized enterprises (SMEs)

4.1 Compliance-relevant characteristics of SMEs

4.2 Implementation and configuration of compliance management in the SME sector

4.3 Conclusion

5 Advanced concepts

5.1 Change management as a management tool

5.1.1 Definition of change management

5.1.2 Reasons/drivers for change management processes

5.1.3 Factors influencing change management processes

5.1.4 Three-phase approach to changes according to Lewin

5.1.5 Leading Change – The 8-Step Model by John Kotter

5.1.6 Change management and a CMS in accordance with ISO 19600

5.2 Organisational culture as a management tool

5.2.1 Influences on organisational cultures

5.2.2 Characteristics of organisational cultures

5.2.3 The cultural model according to Schein

5.2.4 Effect and function of organisational cultures

5.2.5 Measurement of organisational cultures – the model by Denison

5.2.6 Organisational culture and a CMS in accordance with ISO 19600

5.3 Risk management

5.3.1 A brief history of risk management

5.3.2 Risk management systems at a glance

5.3.3 ERM – a holistic, organisation-wide risk management system

5.3.4 ISO 31000 Risk Management

5.3.5 Risk management and a CMS in accordance with ISO 19600

6 Summary and forecast

Bibliography

The author

List of figures

Figure 1 COSO Internal Control – Integrated Framework

Figure 2 Audit process in accordance with ISO/IEC 17021

Figure 3 ISO 19600 in the Deming cycle of continuous improvement

Figure 4 PESTLE analysis of the external environment

Figure 5 Internal determinants of an organisation according Huczynski/Buchanan

Figure 6 Stakeholders/interested parties

Figure 7 Risk Matrix

Figure 8 Level and characteristics of a code of conduct

Figure 9 Compliance in support of organisational goals

Figure 10 Means of implementing compliance policy

Figure 11 Components of the capacity to act

Figure 12 The Fraud Triangle and approaches to prevention according to Grüninger

Figure 13 Indicators for CMS objectives according to Johnson/Søreide

Figure 14 Value orientation of CMS according to Grüninger

Figure 15 Overview of communication according to Mast/Maletzke

Figure 16 Sequence of a monitoring procedure

Figure 17 DMAIC cycle of continuous improvement

Figure 18 EU definition of SME

Figure 19 Approaches to compliance management according to Saitz/Tempel/Brühl

Figure 20 Change management as a method/operating principle

Figure 21 Reasons/drivers for change management processes according to Kotter

Figure 22 7-S Model according to Pascal / Athos

Figure 23 Promotors and destructors according to Ladwig/Domsch

Figure 24 The complexity of relations according to Neuburger

Figure 25 Common symptoms of resistance according to Doppler/Lauterburg

Figure 26 Selected areas of action for resistance according to Reiss

Figure 27 Acceptance-promoting aspects of change processes according to Reiss

Figure 28 Phase diagram of changes according to Lewin

Figure 29 8-step model for changes according to Kotter

Figure 30 Factors of organisational culture according to Sackmann

Figure 31 Cultural box model according to Thomas

Figure 32 Cultural levels according to Schein

Figure 33 Framework organisational culture/effectiveness according to Denison

Figure 34 Organisational cultures according to Denison

Figure 35 Corporate culture and effectiveness

Figure 36 Building-blocks of a risk management system

Figure 37 COSO ERM Framework

Figure 38 Risk matrix

Figure 39 Connecting elements of risk framework according ISO 3100:2009

Figure 40 Risk management process ISO 31000:2009

List of tables

Table 1 Types of system audits

Table 2 Guideline UK Bribery Act vs. ISO 19600

Table 3 US Sentencing Guideline Manual Chapter 8(B) vs. ISO 19600

Table 4 ICC Anti-Corruption Policy vs. ISO 19600

Table 5 Kotter Change Management Model vs. ISO 19600

Table 6 Denison effectiveness model vs. ISO 19600

Table 7 COSO ERM vs. ISO 19600

Table 8 Probability scale

Table 9 Specimen risk map

Table 10 Information and communication needs according to Bruhn

Table 11 Classification of means of communication according to Vahs/Weiand

Table 12 Structure of key risk indicators (KRI)

Foreword

Compliance is not, in itself, a new thing – it should, after all, be self-evident that organisations will observe laws and obligations that they have freely entered into. What is new, however, is the structured approach taken to the subject. Compliance management involves the standardised identification of obligations and their systematic translation to the organisation’s everyday operations. The development of structures and activities and their integration into existing procedures and processes reduces the risk of noncompliant behaviour in the conduct of business. However, a compliance management system (CMS) must offer more. The frequently used argument that the costs of such a system are less than the costs of non-compliance cannot stand up. In order to be accepted, compliance measures must be closely linked to effectiveness and efficiency and must not be perceived as bureaucratic obstacles. Compliance is therefore not a mere duty to be performed in order to avert negative consequences for an organisation, but rather contributes to the improvement of business operations. This book is intended to make a contribution and support organisations of all kinds in applying compliance measures to enhance the effectiveness and efficiency of the organisation’s management as a whole.

ISO 19600:2014-12-15 “Compliance management systems – Guidelines” was developed by users for users and claims to be a best-practise approach for a globally unified policy for the development, implementation, maintenance and continuous improvement of a CMS. The extent to which individual elements are implemented must, in accordance with the principle of appropriateness, be matched to the particular characteristics of the organisation. The standard is therefore applicable to all types of organisations – irrespective of their size, sector, and type of business or legal form.

This commentary explains all elements of ISO 19600 and provides numerous practical tips for a phased implementation approach. When a holistic approach is taken, a CMS in accordance with ISO 19600 becomes a key tool in strategic management. This book aims to provide a scientific basis for practical implementation, coupled with decades of experience in building and managing complex systems.

I would like to express my sincere gratitude to the many people who have provided me with support and motivation in the writing of this practical commentary. I would like to express my particular gratitude to Dr. Peter Jonas and DDr. Alexander Petsche for their stimulating discussions and cooperation in the development of this standard as representatives of Austria in ISO Project Committee 271. I would especially like to thank Mag. Gertraud Reznicek of Austrian Standards plus Publishing for her effective and professional cooperation and valuable support.

To all readers I wish that they will obtain many useful ideas and benefits that are relevant to their work in practise. I look forward to receiving any comments, feedback and suggestions at [e-mail]!

Vienna, August 2015 Barbara Neiger

Abbreviations

ACCG Austrian Code of Corporate Governance

AG Joint Stock Company (Aktiengesellschaft)

AktG Stock corporation law (Aktiengesetz)

AQAP Allied Quality Assurance Publications

ArbVG Labour Constitution Act (Arbeitsverfassungsgesetz)

AS Australia

BGBl Austrian Federal Law Gazette (Bundesgesetzblatt)

BWG Banking Law (Bankwesengesetz)

BSI British Standards Institution

CMS Compliance Management System

COSO Committee of Sponsoring Organizations of the Treadway Commission

DOJ United States Department of Justice

DMAIC Define-Measure-Analyse-Improve-Control

DSG Data Protection Law (Datenschutzgesetz)

DSK Data Protection Commission (Datenschutzkommission)

e.g. for example

etc. et cetera

EU European Union

ERM Enterprise Risk Management

ERP Enterprise Resource Planning

EUR Euro

FATF Financial Action Task Force

FCPA United States Foreign Corrupt Practices Act

FMA Financial Market Authorisation (Finanzmarktaufsicht)

FSGM Federal Sentencing Guidelines Manual

GARP Global Association of Risk Professionals

GenG Act on Cooperatives (Genossenschaftsgesetz)

GmbHG Law on Limited Liability Company (Gesetz über die Gesellschaft mit beschränkter Haftung)

HLS High Level Structure

ICC International Chamber of Commerce

IEC International Electrotechnical Commission

ICS Internal Control System

ILO International Labour Organization

ISO International Organization for Standardization

IT Information Technology

JTC Joint Technical Committee

JTCG Joint Technical Coordinating Group

KPI Key Performance Indicator

KRI Key Risk Indicator

MS Management System

MMS Management System Standard

NATO North Atlantic Treaty Organization

NZS New Zealand

OECD Organisation for Economic Cooperation and Development

OGH Supreme Court (Oberster Gerichtshof)

OWiG Administrative Offenses Act (Gesetz über Ordnungswidrigkeiten)

PACI Partnering Against Corruption Initiative

PDCA Plan-Do-Check-Act

RM Risk Management

RMS Risk Management System

SAI Social Accountability International

SCGM Sentencing Guidelines Manual

SEC United States Securities and Exchange Commission

SME Small and Medium Sized Company

SOX Sarbanes-Oxley Act

TMB Technical Management Board

VAG Insurance Supervision Act (Versicherungsaufsichtsgesetz)

VbVG Corporate Liability Law (Verbandsverantwortlichkeitsgesetz)

UN United Nations (Vereinte Nationen)

UNODC United Nations Office on Drugs and Crime

UK United Kingdom

US, USA United States

vs. versus

WAG Securities Supervision Act (Wertpapieraufsichtsgesetz)

1BASIC PRINCIPLES AND GENERAL FRAMEWORK

The basic principles and general framework for a compliance management system (CMS) in accordance with ISO 19600 are presented in six chapters. First of all, the meaning of the term ‘compliance’ in the context of this practical commentary must be clarified: the fulfilment of obligations which are binding to an organisation due to mandatory regulations and obligations that have been voluntarily entered into by the organisation. Chapter 1.2 describes the legal framework for compliance in organisations based on national and international regulations on the (criminal) responsibility of organisations for non-compliant actions on the part of their employees. The obligation of management to set up a CMS that is tailored to the organisation’s individual situation is based on its general duty to perform due diligence as a responsible business man. As outlined in chapter 1.3, a CMS, as a strategic management tool, should utilise a planned approach to ensure that obligations relevant to the organisation are complied with in the conduct of activities. The avoidance of compliance violations or mitigation of their negative impact supports the achievement of an organisation’s objectives. The definition of CMS in respect of corporate governance and other management tools such as internal control systems (ICS) and risk management systems (RMS) is then discussed in chapter 1.4. Chapter 1.5 provides an overview of the historical roots of management systems and their development in the context of the International Organisation for Standardisation (ISO). Finally, chapter 1.6 discusses the importance of external ratings in general and the certification of a CMS in particular. To conclude, a brief description is given of requirements for the certification of management systems.

1.1DEFINITION OF THE TERM ‘COMPLIANCE’

The term ‘compliance’ is derived[1] from the verb ‘to comply with something’, and in the context of this manual means the observance of rules by an organisation – that is, those rules that are binding for the organisation due to statutory provisions, as well as those to whose compliance the organisation has voluntarily submitted.

Under this definition, compliance requires first of all only that all obligations are met. This is nothing new and is a self-evident principle in states governed by the rule of law.[2] However, compliance also includes the issue of how organisations ensure that their statutory bodies and employees comply with rules. It is the responsibility of the competent managers to ensure, as part of their supervisory duty and due diligence, that people who work for organisations comply with statutory requirements, industry regulations and corporate policies in everyday business transactions.

The obligation to comply with legal regulations applies to all organisations. Also compliance with industry regulations and internal policies is not an end in itself, but is in the interest of the organisation. All organisations, irrespective of their legal form, size or field of activity, have only limited resources at their disposal. These must be deployed as efficiently and effectively as possible. It is not correct to argue that the requirement for such economic actions applies only to for-profit organisations. Non-profit organisations, too, have limited resources at their disposal, which must be deployed to achieve the best possible result. Negative financial consequences of non-compliance, in the form of penalties and fines, certainly do not fall within the definition of the ‘best possible result’.

1.2LEGAL FRAMEWORK FOR COMPLIANCE IN ORGANSATIONS

Societas delinquere non potest – corporations cannot be held criminally responsible – so describes the principle that only natural persons can commit criminal acts, while legal entities are incapable of committing offences.[3] While Anglo-Saxon law (common law in the UK, USA and other countries) has long made no distinction between natural persons and legal entities, only developments within the last 20 years have led to the establishment of liability for legal entities in continental European states too.[4] Numerous intergovernmental legislative acts both inside and outside the EU obligate member states and treaty states to provide for the liability of legal entities for certain crimes.

The first legislative act within the EU to provide for such an obligation is the Second Protocol to the Convention on the Protection of the European Communities’ Financial Interests,[5] which requires the criminal liability of organisations if fraud, corruption or money-laundering has been committed for their benefit by persons acting either alone or as part of the legal entity’s organisation. Organisations must in particular be made responsible if a lack of supervision or control has made the act possible. In addition to the Second Protocol, there are numerous other legislative acts providing for the liability of legal entities for approximately one hundred criminal offences (e.g. property-related offences such as fraud, embezzlement, misappropriation of subsidies or collusion in procurement procedures; corruption and environmental offences; offences in copyright law, stock exchange law, financial criminal law or the law on unfair competition).[6]

Among legislative acts outside the EU, the OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions of 1997 is to be mentioned. The responsibility of legal entities is further governed by three conventions of the European Council (Protection of the Environment, 1998; Prevention of Cyber Crime, 2001; Counterterrorism, 2005). In order to combat money laundering, FATF recommendations require effective, proportionate and deterrent sanctions against legal entities.[7] Finally, the UN Conventions for the Suppression of the Financing of Terrorism (2000) and against Corruption (2005) contain further requirements for the criminal or the administrative liability of legal entities.[8]

1.2.1Responsibility of organisations in the international arena

The majority of European countries have implemented the responsibility of legal entities in their legal systems. In continental Europe, a distinction is made between purely criminal, purely administrative or mixed models,[9] while Anglo-Saxon countries such as the UK, Ireland or Cyprus know no administrative criminal law. In some countries (e.g. France, Italy, Switzerland, Hungary, and Poland), the state and its regional authorities are entirely exempt from liability. In some countries (France, Netherlands, Croatia, UK), such a restriction applies only to official activities. The liability of publicly-owned companies is not limited in principle. In most countries, the liability of legal entities covers all, and in some countries, only a few offences restricted to those governed by international agreements (e.g. in Spain, Italy and Malta).[10] In some countries, the accountability of liability requires that the act was carried out to the benefit of, on behalf of, in the name of or in the interests of the legal entity (e.g. Germany, France, Italy, Poland and Slovenia). In some countries (e.g. Switzerland, the UK), a mere connection with the business activity of the legal entity is sufficient for the establishment of corporate liability. In most states (e.g. Germany, France, Netherlands, Italy, Poland and Hungary), a legal entity may be held accountable for offences committed by a subordinate employee only in connection with a lack of control or supervision by a person in a leading position. In some countries (Belgium, Switzerland, Romania), an act committed by any person working for a legal entity is sufficient to trigger corporate liability.[11] Almost all jurisdictions make provision for the punishment of the legal entity in addition to that of the natural person. In Belgium, insofar as a natural person did not act knowingly or wilfully that entity (natural person or legal entity) that bears the greatest guilt is the one liable for punishment.