Everything to do with compliance in the company

Abstract

Today, compliance means more than just adhering to rules: It's about fulfilling laws, observing internal guidelines and acting responsibly. Good compliance reduces risks, strengthens trust and can create a real competitive advantage.

The most important topics are anti-corruption, data protection, money laundering prevention, antitrust law, whistleblower systems, supply chain and sustainability. An effective compliance management system (CMS) is based on a solid risk analysis and combines clear guidelines, controls, training and secure reporting channels.

Clear responsibilities, a credible attitude at management level and an active compliance culture are crucial for success. Key figures such as training rates, audit results and the processing of reports show whether the system really works.

Digital tools and AI make processes more efficient, but do not replace responsibility. ESG requirements are increasingly becoming part of modern compliance programs and require clear responsibilities and reliable data.

Definition, objectives and benefits

What does compliance mean?

Compliance basically means "adherence to rules": A company consistently adheres to specifications on three levels: Laws, internal rules (e.g. guidelines, processes, code of conduct) and ethical standards. It is crucial that employees and managers know on a day-to-day basis what is permitted, what is not and how to make safe decisions in gray areas.

Why compliance is a success factor today

The topic of compliance has become much more important in recent years. Not because companies need more bureaucracy, but because violations are now noticed more quickly and often become expensive. Legal requirements are becoming more complex, reporting obligations are increasing and topics such as data protection, the supply chain, discrimination and corruption are coming under greater scrutiny. This is being observed not only by the authorities, but also by customers, business partners and employees.

What companies gain from good compliance:

• Risk reduction: fewer fines, fewer proceedings, fewer operational disruptions
• Protecting reputation and brand: scandals cost trust, often in the long term
• Reliability towards partners and customers: Compliance is increasingly becoming an entry ticket in supply chains and tenders
• Better control within the company: clear processes, clear responsibilities, fewer "gray area decisions"
• Attractiveness as an employer: those who work fairly and cleanly are more likely to attract talent and retain employees

The bottom line is that compliance is not only a safeguard against risks, but also a competitive factor: companies that visibly practise compliance and integrity appear more stable, professional and trustworthy, both internally and externally.

Compliance vs. ethics vs. governance: what belongs where?

The terms are often used together and are closely related. Nevertheless, it is worth making a clear distinction because each topic has a different focus:

Compliance focuses on: Adhering to legal regulations (laws, internal guidelines, standards) and controlling risks. Examples: Anti-corruption rules, data protection processes, whistleblower system, training certificates, controls.

Ethics focuses on: Values and attitude, i.e. what is "right" even if there is no clear rule. Examples: fair treatment, respectful leadership, responsible decisions in gray areas.

Governance focuses on: structures and responsibilities that control and monitor how the company is managed. Examples: Roles, responsibilities, reporting lines, supervision/advisory board, risk and control systems.

When these three areas work well together, the result is a company that is not only "formally correct", but also reliable, responsible and stable in the long term.

What is compliance? The most important topics

Compliance is not a single set of rules, but a bundle of topics that are weighted differently depending on the industry, size and business model. Some areas affect almost every company, others are industry-specific. The decisive factor is always a risk-based approach: which topics are particularly relevant for my company and where is the potential for damage greatest? In the following, we have listed the central topics that are almost always part of a structured compliance organization in practice.

Legal framework & requirements

Compliance never operates in a vacuum. It is based on legal principles that are made up of national laws, European requirements, international standards and industry-specific regulations. For companies, this means that they do not need to know every detail by heart, but they do need a structured overview of which requirements are actually relevant to their business model.

Relevant laws & standards

Different sets of rules apply depending on the size, legal form and international nature of the company. The following levels typically play a role:

National requirements (Germany):

• Administrative Offenses Act (§ 130 OWiG - supervisory duties)
• General Data Protection Regulation(GDPR) and Federal Data Protection Act
• Money Laundering Act(GwG)
• German Stock Corporation Act (Section 91 (2) AktG - risk management obligation)
• Whistleblower Protection Act(HinSchG)
• Supply Chain Due Diligence Act(LkSG)

European regulations:

• EU money laundering directives
• EU Whistleblower Directive
• Corporate Sustainability Reporting Directive(CSRD)
• EU AI Act (for AI-related compliance issues)

International requirements (relevant for foreign transactions):

• Foreign Corrupt Practices Act (USA)
• UK Bribery Act (Great Britain)
• Sanctions and export control regulations

In addition, there are standards that are not legally binding but are relevant in practice, for example:

• German Corporate Governance Code (DCGK)
• ISO 37301 (compliance management systems)
• ISO 37001 (anti-corruption)

Sector specifics: Finance, Health, Industry, Trade

The legal framework differs significantly depending on the sector. While basic obligations apply to everyone, certain sectors are particularly heavily regulated.

Finance and insurance industry

• Commitment to internal control systems with compliance function
• Strict money laundering and sanctions regulations
• Reporting obligations to supervisory authorities
• Requirements for risk management and documentation

Healthcare

• Preventing corruption in the healthcare sector
• Data protection of sensitive health data
• Transparency and documentation obligations
• Dealing with donations and sponsoring

Industry & manufacturing companies

• Product safety and product liability
• Environmental and occupational safety regulations
• Export controls for technical goods
• Supply chain and sustainability obligations

Trade & international supply chains

• Due diligence obligations along the value chain
• Customs and foreign trade law
• Consumer and competition law
• ESG and reporting obligations

What "appropriate" means: risk-based approach & proportionality

A central concept in the compliance context is "appropriateness". As a rule, laws do not require a perfect system, but an appropriate and effective one. What does this mean in concrete terms?

A compliance system must:

• be tailored to the size of the company
• take into account the actual risk areas
• be organizationally viable
• are regularly reviewed and adjusted

A medium-sized company does not need the same system as a global corporation. The decisive factor is that the measures are comprehensible, documented and proportionate. The principle of proportionality helps small and medium-sized companies in particular: They do not have to set up an oversized compliance system. Nevertheless, they should carefully examine their risks and introduce appropriate measures.

The legal framework provides guidelines. How a company actually fills these out depends on its industry, size, internationality and risk profile. A systematic approach and documentation of the risk-based approach creates a solid foundation for effective compliance management.

Establishing a compliance management system (CMS)

A compliance management system (CMS) is the organizational foundation of your compliance work. It ensures that rules are not observed haphazardly, but are structured, comprehensible and permanent. A good CMS is not an end in itself. It helps to systematically manage risks, clarify responsibilities and, in an emergency, to be able to prove that the company has taken its obligations seriously.

The 8 core building blocks of an effective CMS

In practice and standards (e.g. ISO models, governance recommendations), similar core elements appear again and again. An effective CMS typically comprises the following components:

1. Compliance culture: The attitude of management ("tone from the top") and clear expectations of integrity.
2. Compliance targets: Clear, measurable objectives, e.g. reduction of certain risk areas, training rate, audit results.
3. Risk analysis: Systematic identification and assessment of relevant risks.
4. Guidelines & Code of Conduct: Practical rules that provide orientation in everyday life.
5. Organization & responsibilities: Clear roles (e.g. compliance officer), escalation channels and reporting lines.
6. Training & communication: Regular, target group-specific training and comprehensible information formats.
7. Controls & monitoring: inspection mechanisms, approval processes, spot checks, internal audits.
8. Response & improvement: Investigation of violations, sanctions, lessons learned and continuous adaptation.

These building blocks interlock. If one is missing, the system is incomplete. Would you like to find out more about lawcode's Compliance Management System? The CMS makes it easy to manage guidelines, policies and training in a single system. You can access the CSM here.

Risk analysis: How to identify and prioritize risks

Risk analysis forms the foundation of any effective compliance management system. The aim is to recognize at an early stage where the company is particularly vulnerable. This is not about theoretical dangers, but about specific business practices: which industry, which markets, which third parties are affected? Internal aspects such as payment flows, approval processes or the handling of sensitive data are also included.

In the next step, the risks are assessed and prioritized. Two questions are crucial: how likely is a breach and how great would the damage be, financially, legally or reputationally? Critical risks are prioritized, while others can be addressed with less costly measures. This risk-based approach ensures that resources are deployed in a targeted manner.

Suitable measures are then defined on this basis: Adapt guidelines, introduce controls, carry out training or technically safeguard processes. Equally important is the proper documentation of the risk analysis, which protects against liability in the event of an emergency and shows auditors and authorities that the company has its risks under control in a structured manner.

Guidelines & Code of Conduct: from "paper" to practice

Many listed and unlisted companies have policies, but not every policy works.

A Code of Conduct serves as an overarching orientation framework. It bundles the basic values and most important rules of conduct and makes expectations transparent, both internally and externally.

What counts in the end is not whether rules are written somewhere, but whether they are actually applied in everyday life. This requires managers who clearly communicate what is expected and set a good example themselves. Training should also be practical: it should address typical everyday situations and provide concrete help so that employees can make decisions and act with confidence.

It is helpful to think about compliance right from the start, for example during onboarding. In this way, new employees understand early on which standards apply and what they mean in everyday life. It is also effective if compliance is also incorporated into targets and assessments, making it clear that compliant behavior is not an "extra". Only when employees see the practical relevance to their own work does paper compliance become lived practice.

Controls, approvals & processes

A compliance management system only works reliably if rules are backed up by appropriate processes. In practice, this means that important decisions are based on the principle of dual control, sensitive topics such as gifts or sponsorship are subject to clear approval processes and new business partners are checked in a structured manner. Technical measures such as regulated access rights, spot checks and internal audits complement the system.

The right balance is crucial: too many control steps make processes cumbersome, too few create gaps. Digital solutions, such as automated approval workflows or standardized documentation, help to reduce effort and ensure traceability at the same time.

Documentation & evidence: What you really need

A functioning CMS must be verifiable. Particularly in the event of liability or audits by the authorities, it is not just what has been done that counts, but whether it can be proven.

Essential proofs are:

• Documented risk analysis
• Current guidelines & versioning
• Training certificates
• Protocols of controls & audits
• Documentation of information and investigations
• Action and improvement protocols

A compliance management system is not a project with an end date, but is ongoing. Those who regularly review risks, define clear rules, introduce effective controls and document everything properly create a stable basis for legally compliant and responsible action.

Training courses: Compliance in everyday life

A set of rules alone does not make compliance. It is crucial that employees understand why rules exist and what they actually mean in their day-to-day work. This is precisely where training and awareness measures come in.

In principle, many violations are not caused by malicious intent. For example, ignorance, uncertainty or time pressure can be cited as the reason for a breach. Good training is particularly important to create clarity, provide orientation and strengthen confidence in action. They also serve as important proof that the company is fulfilling its organizational and supervisory duties. 

Compulsory training vs. risk-based training

Many companies have traditional mandatory training courses, for example on data protection, corruption prevention or occupational health and safety. This basis is important, but is often not enough.

A modern training concept combines two levels:

Basic training for all employees

• Introduction to the Code of Conduct and corporate values
• Overview of key compliance risks
• Reporting channels and whistleblower system
• Basic rules on data protection and IT security

Risk-based, role-related training

• Distribution: gifts, invitations, antitrust law, third parties
• Purchasing: supply chain, due diligence obligations, sanctions
• HR: Discrimination, labor law, whistleblower protection
• Finance: money laundering, internal controls, approvals
• Managers: role model function, escalation, decision-making dilemmas

Making training effective

Compliance training is often perceived as a chore. Especially when the content remains abstract and has no connection to everyday life. Training is only effective if it is practical and interactive.

Proven elements:

• Case studies from practice: Concrete case studies (e.g. accepting gifts, data leaks, conflicts of interest) help to make gray areas tangible.
• Dilemma situations: Instead of "right or wrong": decision questions with several justifiable options promote reflection.
• Microlearning: Short, compact learning units of 5-10 minutes increase absorption capacity and are easier to integrate into everyday working life.
• Nudges in everyday life: Small reminders, checklists or digital notifications before critical processes (e.g. approval of invitations) support compliant behavior at exactly the right moment.
• Managers as multipliers: When managers actively take up content and discuss it in the team, the relevance increases significantly.

Verifiability: documentation, tests, participation rates

In addition to the quality of the content, verifiability plays a key role. In the event of an emergency, such as an official audit or internal investigation, a company must be able to demonstrate that it has trained its employees appropriately.

Important elements of the documentation:

• Participation rates and reminder mechanisms
• Timing and content of the training courses
• Test results or knowledge queries
• Repetition training at defined intervals
• Special training for high-risk areas

Digital learning platforms make documentation much easier. They send automatic reminders, assign training courses according to role and create comprehensible, audit-proof reports. Nevertheless, a high participation rate alone does not mean that the training is really effective.

Ultimately, good compliance training is not a one-off project, but a continuous process. They create orientation, strengthen a sense of responsibility and help to ensure that compliance is not perceived as an instrument of control, but as a natural part of professional conduct.

Risks, violations and consequences

Compliance is not a theoretical topic. Violations happen every day, in large corporations as well as in SMEs. It is often small decisions in everyday working life that can have major consequences. It is therefore important to be familiar with typical risk constellations, to realistically assess the possible consequences and to draw the right conclusions from known cases.

It is striking that many of these violations occur where processes are unclear or managers do not act consistently.

Consequences: financial, legal, reputational, organizational

The consequences of non-compliance rarely end with a single fine. Violations often result in further problems that keep the company busy for a long time. In addition to penalties, such as for data protection violations, there may also be claims for damages, costs for lawyers and internal investigations as well as lost sales due to lost orders.

Depending on the case, there may be legal investigations and proceedings. In serious cases, the personal liability of management or executives can also play a role. Companies also run the risk of being excluded from public tenders.

The consequences for reputation are particularly sensitive. Negative headlines, less trust from customers, partners or investors and a declining attractiveness as an employer often have a faster and longer-lasting effect than any fine. There is also usually a lot of organizational effort involved: processes are tightened up, controls are tightened, responsibilities are redistributed or external bodies take a closer look. The problem is that trust that has grown over the years can be lost in a short space of time.

Lessons learned and what companies should derive from them

Well-known corporate scandals, whether accounting fraud, corruption cases or data protection breaches, show similar patterns time and again.

What companies should learn from this:

1. Culture beats rules: Paper doesn't help if managers don't set an example.
2. Take early indications seriously: Small irregularities can indicate structural problems.
3. Prioritize based on risk: Not every risk is equally critical - resources must be deployed in a targeted manner.
4. Documentation is protection: verifiable preventive measures can mitigate penalties in an emergency.
5. Transparency reduces damage: Open and structured handling of incidents can limit reputational damage.

Ultimately, compliance is not just a control function, but a protective mechanism for the company. Those who recognize risks early on, consistently address violations and learn from mistakes strengthen stability, trust and competitiveness in the long term.

Corporate culture & ethics

Compliance does not stand or fall with guidelines, but with the culture. Processes can be set up, policies can be sent out. But whether they are actually put into practice on a day-to-day basis is decided on a completely different level: in terms of attitude, leadership and behavior in daily interactions. A strong compliance culture is therefore not a "soft issue", but a real effectiveness factor.

Why culture determines effectiveness

Many compliance violations do not occur because rules are missing, but because they are ignored, relativized or circumvented. This is precisely where corporate culture comes into play.

influenced by culture:

• how openly risks are discussed
• whether employees ask about uncertainties
• How managers deal with conflicting goals
• whether rule violations are tolerated or consistently addressed

If sales targets seem more important than integrity, even the best rules are of little help. If, on the other hand, managers make it clear that compliance has priority, even if this is inconvenient in the short term, this has a noticeable impact on day-to-day decisions.

Speak-up culture: creating trust, lowering inhibitions

A key element of a functioning compliance culture is the willingness to speak up about grievances. Technical whistleblowing systems alone are not enough. The decisive factor is whether people dare to use them.

Many are hesitant because they fear disadvantages, reprisals, social exclusion or career problems. Companies should actively reduce these concerns. This can be achieved with clear protection rules, credible communication and consistent action in the event of violations. At the same time, employees should know that not only serious violations are reportable. Uncertainties or "gray areas" can also be addressed. This is exactly where prevention comes in.

Ultimately, a compliance culture is not a document, but a behavior. If integrity, transparency and responsibility are actually practiced, the risk of violations decreases significantly and trust within and outside the company grows sustainably.

Measurement & effectiveness

A compliance management system is only as good as its actual impact. Guidelines, training and processes are important. But without measurable control, it remains unclear whether they are really effective in everyday life. That is why professional compliance always includes systematic monitoring. If you want to manage risks, you need to know where you stand and where you need to tighten up.

It is important to note that a low reference number does not automatically mean that there are no problems. It can also indicate a lack of trust. KPIs must therefore always be interpreted in context. Good compliance management combines quantitative key figures with qualitative assessments, for example from employee surveys or risk workshops.

Audits & reviews: What, how often, how to document?

In addition to ongoing monitoring, a CMS needs regular checks so that weaknesses can be identified early on and measures can be improved. Various formats are suitable for this depending on requirements, for example internal compliance audits, thematic deep dives (e.g. on anti-corruption or data protection), audits by third parties, process reviews or effectiveness checks of individual measures. The frequency of audits should be tailored to the risk: High-risk areas need tighter controls than topics with lower relevance.

The documentation is just as important as the audit itself. It should comprehensibly record what was audited, what findings were made, what measures were derived from them, who is responsible and by when they must be implemented, including proof that implementation has actually taken place. The decisive factor here is not whether there are findings, but whether the company deals with them professionally, learns from them and follows up consistently.

Proof of effectiveness vis-à-vis auditors and stakeholders

External audits, certifications or inquiries from authorities are the latest to show how stable a compliance system really is. Management, supervisors, investors and authorities then expect clear and comprehensible proof that the measures are effective.

An effective compliance system is not a static construct. It is demonstrated by the fact that risks are identified, measures are implemented, results are reviewed and processes are continuously improved. Transparency plays a central role here. Openly documenting how risks are dealt with signals professionalism and a sense of responsibility.

In the end, it is not about proving perfection, but rather the ability to control. A company that is aware of its risks, monitors them in a structured manner and consistently follows up on them has a compliance system that not only exists on paper, but is effective within the company.

Tools & digitalization: What makes compliance more efficient

Digitization is noticeably changing compliance. Instead of Excel lists, email inboxes and paper files, many companies now use integrated systems. This is not about "more control at any price", but about more transparency, more efficient processes and clean documentation, especially for audits, reviews and stakeholder inquiries.

Selection & introduction: cost-benefit and typical stumbling blocks

Not every company needs a fully integrated platform right away. The selection should be based on the actual risk profile, not the range of functions of a tool.

Important questions when choosing:

• What specific risks should be addressed?
• Which processes are particularly error-prone or lack transparency today?
• How well can new tools be integrated into existing systems (e.g. ERP, HR, LMS)?
• Who will manage the tool operationally?
• Is the solution scalable and can it be used internationally?

A common mistake is to see digitalization as a pure IT project. Compliance tools only work well if processes are clearly defined. A tool cannot fix bad processes, it can only make them more visible.

A structured implementation project with clear governance, a training concept and accompanying communication is therefore crucial. If employees understand the added value and the system is easy to use, acceptance will also increase. When used correctly, digital tools are not an end in themselves, but a lever: they make compliance more transparent, efficient and audit-proof and relieve the burden on the specialist departments on a day-to-day basis.

ESG & Compliance: How it is connected

In many companies, ESG and compliance are still considered separately. In practice, however, the two topics are closely linked. Compliance ensures adherence to laws and internal rules, while ESG broadens the view to include environmental, social and good corporate governance. Modern compliance programs are therefore increasingly addressing ESG, not only because of reputation, but also because regulatory requirements are increasing significantly.

ESG as part of modern compliance programs

ESG stands for environmental, social and responsible corporate governance. In terms of content, much of this has long been part of classic compliance, often just under different headings. Environmental regulations and emissions requirements are part of E, topics such as occupational health and safety, anti-discrimination and human rights are part of S. Corruption prevention, transparency and internal controls fall under G.

What is new above all is how strongly these issues are being demanded today. Investors, customers and authorities expect comprehensible evidence of how companies recognize and manage ESG risks.

Interfaces to LkSG/CSRD & supply chain

The link between ESG and compliance is particularly clear in the case of legal requirements such as:

• Supply Chain Due Diligence Act (LkSG)
• Corporate Sustainability Reporting Directive (CSRD)
• international human rights and environmental standards

These regulations oblige companies to systematically identify, assess and address risks in their own business areas and along the supply chain.

The LkSG in particular shows the extent to which compliance and sustainability are intertwined: it is not just about image, but also about specific duties of care with potential fines and reputational risks. The CSRD in turn increases the pressure for transparency. Companies must record, review and publish ESG data in a structured manner. This requires robust processes, clear responsibilities and robust controls - classic compliance tasks.

Practical implementation: data, responsibilities, governance

When it comes to implementation, it quickly becomes clear that ESG is data-intensive. Without clean processes, inconsistencies, duplication of work and liability risks arise.

Conclusion

Today, compliance is much more than just adhering to laws and internal regulations. It is a central component of good corporate governance because it makes risks visible at an early stage, creates clear orientation in everyday life and strengthens trust among customers, employees and business partners. The decisive factor here is not the number of guidelines, but their effectiveness: responsibilities must be clear, processes must work in practice and managers must set a credible example of compliance.

A modern compliance system is risk-based and anchored in everyday life, for example through training and awareness. It is continuously improved through key figures, audits and regular reviews. Digital tools help to make processes more transparent and document evidence properly. At the same time, a look at ESG, supply chains and reporting obligations shows that Compliance today needs to cover more topics and be thought of more strategically. Those who understand compliance as a cultural issue, promote speak-up and create clear governance structures reduce the risk of violations - and make the company more stable and competitive in the long term.