Compliance

A company answers for what its people do

Having a compliance programme is not only about avoiding penalties. In Mexico, the existence of a real programme, one that is implemented rather than printed, is a factor weighed when a company is held responsible for conduct carried out by those acting on its behalf. A policy nobody has read does not help; a programme that demonstrably operates does.

Proportionate to the company

Most compliance material is written for corporations with a department for it. A company of thirty people does not need that, and will not sustain it. It needs a small number of controls, in the areas where its actual risk sits, that someone is genuinely responsible for.

We would rather build five controls that operate than forty that exist on paper.

The usual components

• A risk assessment specific to the sector, the counterparties and the geography.
• A code of conduct written in language the staff will actually read.
• Policies on gifts, hospitality, conflicts of interest and dealings with public officials.
• Due diligence on suppliers, distributors and intermediaries, proportionate to their exposure.
• A reporting channel with real protection against retaliation, and a process for what happens after a report.
• Training that is recorded, because an unrecorded training did not happen.
• Clear allocation of who is responsible, and periodic review.

What we do

We design and implement the programme, write the documents, run the training, and review what exists where a programme is already in place but has not been looked at in years. We also handle the moment a report comes in, which is when the quality of the design becomes apparent.