As November 5 fast approaches, pursuant to Article 31 of Law No. 44-26, Articles 8 through 11 of Organic Law No. 74-25 – which establishes the Criminal Code of the Dominican Republic – will come into force with respect to the criminal liability of legal entities. This has prompted a wave of publications, conferences, events, and self-proclaimed Compliance “experts,” whose messages range from warnings that anyone could face prison to reassurances that there is nothing to worry about. In most cases, the discussion has been framed around two opposing and equally misguided extremes.
On the one hand, we have the minimalist approach “touting” a general compliance program tailored to your sector but not to your company. Generalized texts, regulations that fail to consider the reality of a business and do not seek a balance between control, supervision, and the operation of the business. Within this minimalist approach, there is also a strand that has limited itself to addressing Compliance from the criminal prism, ignoring the existence of reputational and operational risks and general control and supervision systems that are not limited to covering criminal offences.
At the other extreme we find the alarmists that speak about huge risks, that a company should foresee each and every possible scenario, even the most remote and improbable ones. This focus suggests an excessively extensive compliance program which, albeit the content might appear to be “complete”, ignores that the most important thing is its practicality and, therefore, its traceability.
This is precisely the danger of approaching Compliance from either extreme. An effective compliance program cannot be the same document for two companies with different realities, employees, internal processes, and particular characteristics. Nor can it be reduced to a manual that is simply filed away until the Public Prosecutor’s Office asks to see it, especially because, as noted, Compliance is not limited to criminal matters, and other authorities or stakeholders may also become involved.
Likewise, an extensive program serves little purpose if no one reads or understands it. What is the use of a 100-page manual if employees do not read it in full, cannot remember its contents, or cannot easily find the guidance they need when a situation arises? It is no coincidence that Article 8, paragraph VI, section 1 of the Code requires the policy or code of conduct to set out the duties of bodies, representatives, and employees “in a clear and simple manner.”
This is directly related to traceability, since this is not only about demonstrating the existence of manuals or internal programs, but also about their effectiveness and awareness by the staff beyond an acknowledgment of receipt. In many cases, the employee receives a copy of the code of conduct on his first day, signs off on it, and it is never mentioned again. A program that employees do not understand or do not know about is ineffective, indeed a failure.
A company that adopts a minimalist program may believe it is protected, but when a risk materializes, that program will neither have prevented it nor help mitigate its effects. Moreover, once the company realizes that the program does not reflect its actual circumstances, minor adjustments will not be enough; it will likely need to rebuild the program almost from scratch.
For its part, the alarmist program does not solve the problem either. With so many controls, protocols, and preventions, the operation of the company becomes slower and more sluggish, whereas an effective compliance program should not hinder the business it is intended to protect.
Designing and implementing a compliance program involves synthesizing potential risks and scenarios. It is not about “leaving things out”. It is about knowing how to group together, prevent and mitigate the company’s real risks. In this case, less is more; the important thing is that the “less” is adequate and fair.
So, what is appropriate and proportional? Paragraph VI of article 8 of the Penal Code states that a compliance program must be adopted according to the nature, size, activity, and risks of each legal entity. This is exactly what is addressed when carrying out a personalized survey for each company. It is essential to understand the business, its procedures and personnel in order to properly identify every type of risk, classify those risks, identify the personnel exposed to each one, assign preventive or mitigating measures, and designate the person or department responsible within the company.
In addition, our country has a deep-rooted culture of informality, where it is still common to hear that “that’s not going to happen to me”. Many companies, even some long-standing solid enterprises, take it for granted that a complaint, an investigation or a sanction is something that happens to others. It is precisely this belief that leads them to seeing Compliance as an expense or a simple procedure, and to look for it when the problem has already arisen. This view generally comes from top management itself, who ends up marking the importance that the rest of the company gives to the program. However, Compliance is preventive, not reactive. A compliance program must exist before the infraction can, because implementing it afterwards does not prevent the damage or protect the company from its consequences.
That said, the approach should not be from fear of the Penal Code. Criminal risk exists, but it is just one of the problems that a company that is not prepared, that is not in compliance, can face. A company that knows its risks and is clear about how to act when faced with them is better prepared for any situation that arises, including an investigation by the Public Prosecutor’s Office. A compliance program that is designed from fear ends up focused on avoiding a sanction, and not on the well-being of the company.
Source:
