Who Must Prove Compliance Works: The Supreme Court vs the Public Prosecutor

Ever since the 2010 reform opened the door to corporate criminal liability, one question has hovered over every case: if a company can be exempted for having an effective prevention programme, who must prove that the programme was working? The company, which invokes it to clear itself, or the prosecution, which argues the organisation failed? This is no procedural technicality: it determines who bears the risk of doubt and, in practice, shapes the defence strategy of any company under investigation. Since 2016 the Supreme Court has leaned in a particular direction, different from that of the Public Prosecutor's Office, and it is worth understanding what that means for companies with and without a programme.

The Debate: Burden of Proof and Art. 31 bis CP

Article 31 bis of the Criminal Code (CP) builds corporate liability around the idea of an organisational defect: the legal entity is liable, in essence, because it failed to put in place suitable supervision and control measures to prevent the offence. The same provision states that the company will be exempted if, before the offence was committed, it had adopted and effectively implemented a suitable organisation and management model (and, where the offender was a manager, the other conditions of Art. 31 bis 2 are met).

The debate flows from that structure. Two readings are possible:

• Reading A — compliance as an exculpatory defence the company must prove: the offence is treated as established by the conduct of the natural person acting for the company's benefit, and it falls to the company, if it wishes to exculpate itself, to demonstrate that its programme was effective. On this logic, doubt works against the company.
• Reading B — the organisational defect as an element of the offence the prosecution must prove: the ineffectiveness or absence of the prevention model is part of what defines the legal entity's offence. If it is an element of the offence, the party making the accusation must prove it, and doubt benefits the company.

The difference is enormous. On the first reading, a company without clear proof of its programme starts at a disadvantage. On the second, the weight falls on the prosecution, which must establish the organisational failure beyond reasonable doubt, like any other element of the offence.

The Position of the Supreme Court and of the Public Prosecutor

The State Prosecutor's Office, in its Circular 1/2016, adopted the first reading: it is for the legal person to prove that its model meets the statutory requirements, and for the prosecution to prove that the offence was committed in the circumstances of Art. 31 bis 1. The Supreme Court, in a judgment of March 2016, leaned towards the second reading: the organisational defect is an element of the legal entity's offence, and proving it is for the prosecution.

In practical terms, this translates into several points the defence can rely on:

• There is no presumption of guilt against the company merely because a director or employee committed an offence for its benefit.
• The prosecution must positively prove that the prevention model did not exist or that, where it did, it was ineffective at preventing offences of that nature.
• The presumption of innocence fully protects the legal entity: reasonable doubt as to the suitability of the programme must be resolved in its favour.

The Key Distinction: Formal and Material Burden

It is important not to confuse two planes. One thing is who formally bears the burden of proof — and the Supreme Court places it on the prosecution — and another is who is best placed to produce the evidence. The evidence that a programme works (minutes, records, training, whistleblowing-channel metrics) is, by its very nature, in the company's hands.

Hence a conclusion that qualifies the scope of that case law: the company that folds its arms trusting that "the prosecution has to prove everything" is making a mistake. If the prosecution puts forward signs of an organisational defect — a whistleblowing channel that never received or handled anything despite evidence of irregularities, non-existent training, an oversight body with no resources — and the company does not counter with its own evidence of effective implementation, the outcome may be just as adverse. That case law rebalances the starting point; it does not remove the need to defend actively.

What It Means for Companies Without a Prevention Programme

For an organisation that has no compliance, the Supreme Court's position offers relief that is more theoretical than real. True, the prosecution must establish the organisational defect; but the very absence of a prevention model is the most direct way to prove that defect. With no programme there is nothing to counter, no evidence to generate, no exemption to claim.

The result is that these companies remain the most vulnerable target. The defence will have to rely on other fronts — disputing that the offence was really committed for the entity's benefit, challenging the attribution of the conduct, or seeking mitigation through cooperation and repair of the harm after the events — but it loses the system's most powerful tool: the exemption under Article 31 bis CP.

What It Means for Companies With a Programme

For a company that does have a programme, the Supreme Court's position reinforces a favourable starting position, provided the compliance is not cosmetic. The keys to making the most of it:

1. Evidence, not documents. The law requires the model to have been effectively implemented, so purely formal compliance does not exempt. What matters is not the manual but the trail of its application: minutes of the oversight body, training actually delivered, reports handled, internal sanctions imposed, risk-map reviews.
2. Time traceability. The model must be shown to have been in force and operating before the events. Improvements adopted afterwards help to mitigate if in place before the trial begins (Art. 31 quater d), but do not establish the prior exemption.
3. Autonomy of the oversight body. Effectiveness is also measured by the real independence and resources of the Compliance Officer or the body charged with monitoring the programme.
4. The individual deviation. The strongest defence is to show that the offence was conduct committed against the programme, circumventing controls that worked, rather than sheltered by a non-existent system.

What To Do Now

That case law is an opportunity for companies that take it seriously and a warning for those that do not. We recommend:

• Audit the actual implementation of the programme: it is not enough for it to exist; it must be possible to show that it operates.
• Organise and keep the evidence that proves it works, so it can be produced quickly if an investigation arrives.
• Review the risk map and update it when the activity, the organisation or the regulations change.
• Strengthen the autonomy and resources of the oversight body, a feature required by Art. 31 bis 2 CP and examined in detail.

As criminal lawyers specialising in compliance and corporate liability, we help design programmes that withstand judicial scrutiny and prepare the legal entity's defence once an investigation is already under way.