Italian corporate criminal liability: the model that defends you

Decisions for the company in the opening days

When proceedings open against a company, a handful of choices are made in a short time, and they shape the whole matter. The initial question is who speaks for the company. The managers closest to the facts are the people the company will be tempted to use, yet they are often the individuals with the most personal exposure. A manager under investigation should not direct the company's response, because his interests and the company's may diverge as soon as the evidence is examined. The price of this separation is awkwardness: a trusted person steps back at the moment when he wants to help. The price of ignoring it is a defence that is compromised from the start.

A further choice is whether to look inward immediately. A company may decide to examine its own conduct, interview staff and review documents, and doing so promptly can reveal facts that change the strategy. It can also create material that is not protected, if the work is not organised through counsel. Staff interviews done informally by headquarters can generate statements that investigators later obtain. Decide who leads the review, in what form, and who may see the results.

Another choice concerns the model itself. If a model exists, the company must be able to show that it addressed this specific risk and was working in practice. If it does not, adopting a model now will not cure the past, but it may matter for how the case is viewed and for what follows. What it must never do is create documents that look old. Backdated policies, minutes and training records are the quickest way to destroy credibility. Finally, the company must decide how to deal with contracts, banks and public bodies, who may ask about the case. A consistent, brief message agreed with counsel is far safer than ad hoc replies from many offices.

Foreign groups, local branches and a notice from the prosecutor

A group headquartered abroad has an Italian subsidiary whose sales director has been arrested. Headquarters learns of it from the press, and the question is whether the group itself is exposed. Another company has no Italian entity at all but sends staff and goods into the country, and a branch manager has been questioned. Another is an Italian business owned by foreign investors, which has received a notice that it too is a party to the proceedings alongside several employees.

Others are individuals. A general counsel at a foreign parent is trying to understand why an Italian procedure treats the company as a defendant, when at home the company would only be a witness or a civil party. A finance director wonders whether a decision signed years ago can now bring liability for the firm. An owner of a small export business asks whether a driver's offence on a delivery could reach the company. A board member abroad is told that a report to the authorities has been made and that the company's name is in the file.

What these readers share is surprise that a legal person can be the object of criminal proceedings, and that the defence is not mainly about the facts of the offence. It is about whether the company had, before the events, a system that could reasonably have prevented offences of this kind, and whether that system actually operated. Many companies discover that they have policies on paper and nothing in practice. This page helps them understand what counts, what to gather, and how to avoid making the position worse.

What it does to contracts, banks and the people who run the business

Proceedings against a company affect business long before any court decides. Contracts with public bodies are sensitive: tenders may require disclosure of pending proceedings, and a counterparty may suspend or terminate a relationship. Private customers, particularly large customers with their own compliance functions, ask questions and may add conditions. Banks and insurers react to a notice, sometimes reducing credit lines or raising premiums.

Internally, the effects are personal. Managers named in the case may be suspended, and the company must decide how to protect the business without prejudging individuals. Staff who are potential witnesses are anxious, and rumours move quickly. A whistleblowing channel, if the company has such a channel, may be flooded with reports. Human resources need a script for questions, and employees need to know that they may seek their own advice.

Directors based abroad must consider travel. Executives who visit Italy and have a role in the matter may be summoned, and those who are named individually may face restrictions on leaving the country. Group reporting duties can be triggered, and the parent may have to disclose the proceedings to auditors, lenders or regulators in its home state. Timing is delicate: disclosure that is too early may prejudice the defence, and disclosure that is too late may breach a duty at home.

Finally, the matter has a long tail. Findings about the model lead to reforms, which cost money and management time. Reputation suffers where the press picks up the story. Companies should prepare a communication plan, with a named spokesperson and a short statement that says nothing about the facts.

Things a company should not do when it is under investigation

• Do not destroy or reorganise records. Routine deletion schedules should be paused, and nobody should tidy files or devices.
• Do not backdate a policy. A model adopted now must be dated now. Documents that pretend to be older damage the credibility of everything else.
• Do not discipline or dismiss staff in haste. Dismissals can look like scapegoating, remove witnesses from your control and prompt cooperation with investigators on unfavourable terms.
• Do not let the implicated manager run the response. Keep that person informed in a controlled way, but separate from decisions about the company's defence.
• Do not interview witnesses informally from headquarters. Notes of such interviews may not be protected and may be requested.
• Do not circulate legal advice widely. The more people see it, the weaker the claim that it is confidential.
• Do not speak to the press without a prepared statement. Remarks about responsibility can be quoted back.
• Do not assume the group policy is enough. A global code that does not address Italian operations may not answer the specific risk.

The common aim of these rules is to keep the company's position separate from that of its individuals, and to keep the record clean. A company that behaves calmly and consistently in the opening days is in a far better position to explain, later, that its controls were real and that it took the matter seriously from the start.

What to assemble to show a model that works

The central question is whether the model existed before the events, addressed the right risk and operated in practice. Documents are the evidence.

• The model itself. The written model, its parts, and the date and minutes of its adoption, with all versions.
• The risk assessment. Any analysis that identified the activities at risk and led to specific controls.
• The supervisory body. Its appointment, composition, powers, meeting minutes and reports, which show whether oversight happened.
• Organisation charts and delegations. Who held authority, who could sign, and which powers were delegated in writing.
• Training records. Dates, attendees, content and materials, with proof that the people concerned took part.
• Audit and control evidence. Reports, test results, exceptions found and the actions taken in response.
• Reporting channels. The whistleblowing system, reports received and how they were handled.
• Disciplinary records. Evidence that breaches of the model led to consequences.

Preserve metadata, and do not edit documents.

Where a document does not exist, say so plainly in a note to counsel rather than creating it now. Gaps are better explained than disguised, and a candid account of what was and was not in place tells counsel what can be argued and what must be repaired. Keep a list of who holds each item, in case investigators ask for it, and make sure the people who hold the originals know not to alter or discard them.

A foreign group and an Italian procedure

A group with its centre abroad faces particular difficulties. Its internal policies are usually written in the language and legal culture of the parent, and they may not map onto what an Italian court expects. A code of conduct is not a model that addresses Italian risks, and a translated global manual is rarely accepted as a substitute. The key question is whether controls were adapted to the Italian operations and whether they were actually applied there.

Protection of communications is another difference. Rules about which exchanges with lawyers are confidential vary from country to country, and in-house counsel abroad may be treated differently from external counsel. Assume that an internal email may be read by investigators, and route sensitive discussion through outside counsel. Document transfers between countries should be planned, since data protection duties at home may limit what can be sent, and Italian authorities may request material held abroad.

Coordination is also practical. Headquarters and the Italian subsidiary may have different lawyers, and the interests of the parent, the subsidiary and individual managers may not coincide. Decide who instructs whom and how information flows. Board decisions at the parent may need local formalities, and signatures from abroad can take time. Documents must be translated, sometimes certified. Time zones affect the pace of decisions when deadlines are short. Local management should know whom to call, and executives who travel should be briefed before entering Italy. A consulate has no role in a corporate matter, although it may help individuals with documents.

How the firm approaches a corporate liability case

The firm treats a corporate case as a matter of structure before it becomes a matter of fact. The opening conversation, usually with in-house counsel or a director, establishes who is named, what the company is accused of, and whether individual managers have separate representation. If an individual and the company have different interests, the firm explains why they should not share a lawyer, and it does not act for both.

Instruction is by email or telephone in English or Italian. The firm asks for the notice or order, the corporate structure and the model, if it exists. It then explains what it will examine: whether the offence is among those that can engage the company, who committed it and in what position, whether it served the company's interest, and what the model looked like on the date of the events. It agrees with the client how the internal review will be organised so that its results are protected as far as possible.

The firm works with technical advisers where needed, for instance on controls and audit evidence, and coordinates with counsel in the parent's country. It is reachable for urgent matters such as a search at the company's premises or a request for documents, and it meets clients in Rome, Milan and Naples. It promises no result and says clearly when documents are weak. What it provides is a disciplined approach: separation of interests, preservation of evidence and a clear account of what a model must show.

Questions for counsel when the company is a defendant

• Can this offence engage the company, and in what capacity did the person act? The burden differs depending on whether the person was a senior figure or under direction.
• Did the offence serve the company's interest or bring it advantage? Ask what the file says about this.
• Was there a model on the date of the events, and does it address this risk?
• Was it applied in practice, and how do we prove that?
• Should the company and the manager have separate lawyers? Ask for a clear answer on conflicts.
• What can the company do now to repair the situation, and what effect would it have?
• What must we disclose to auditors, lenders and regulators at home?
• How do we protect internal communications?
• What are the risks for our public contracts?

Put these questions in writing before the meeting and ask counsel to answer in the same form. Directors abroad often assume that the questions are about the facts of the offence, when most of the useful questions concern the company's own structure, the date of its model and the paper trail of its controls. Ask also who will pay for separate counsel for individuals, and how that decision will be recorded by the board.

Terms in a corporate liability file

Italian papers about corporate liability use specific words. These are the main terms.

• Ente is the entity, the term used for the company or other organisation that is held liable in its own right.
• Modello organizzativo is the organisational model: the set of rules, controls and procedures designed to prevent the offences the statute lists. It must exist before the offence and work in practice.
• Organismo di vigilanza is the supervisory body that monitors how the model operates and proposes updates.
• Interesse o vantaggio means interest or advantage: the link between the offence and the company. An act done purely for private ends does not engage the company.
• Soggetti apicali are senior figures, such as directors and managers with authority.
• Reati presupposto are the listed offences from which the company's liability can arise. The list has grown over time.
• Sanzioni interdittive are restrictions such as bans on contracting with public bodies, in addition to fines.

Ask counsel to explain any other term on your documents before the company responds.

Terms of this kind are often translated differently in different countries. Ask counsel to agree with the group's lawyers abroad on a consistent English rendering of each, and use it in board papers and in reports to auditors, so that nobody can later argue that separate documents describe different things. Keep the Italian word beside the translation whenever a paper might be shown to an Italian authority.