Whistleblowing: the consequences on entities that have adopted Organization, Management and Control Model, pursuant to Legislative Decree 231/2001

24 ott 2023

Dr. Alessandro Baudino Bessone and Dr. Lorenzo Baudino Bessone

The new Italian law on whistleblowing, which came into force with Legislative Decree No. 24/2023 (hereinafter, also "Whistleblowing Decree") implementing EU Directive 2019/1937, extends the scope of application of its rules to all entities in the private sector that have adopted an Organization, Management and Control Model (“MOG”) provided for by Legislative Decree No. 231/2001 on criminal liability of corporations (hereinafter, also "Decree 231"). 
The Whistleblowing Decree has resolved some of the problems arising from the overlapping between the two disciplines, with special regard to the establishment of an internal reporting channel enabling the entity's workers and stakeholders to report on breaches. The amendments made to Art. 6, par. 2-bis of the Decree 231, now make it mandatory for companies that resolved to abide by the provision of Decree 231, to regulate and establish internal reporting channels compliant to the new Whistleblowing Decree. 
However, some doubts still remain regarding the adjustments to the MOG that must be made, by 17 December 2023, for companies that have employed up to 249 employees on average in the last year, to avoid the sanctions provided for by the Whistleblowing decree. 
To the various open points, the National Council of Chartered Accountants (hereinafter, also “CNDCEC”) has tried to provide an answer with a research paper entitled "New discipline of Whistleblowing and impact on Legislative Decree 231/2001" which we will attempt to summarize below in bullet points. 
 

  • Is there an obligation to establish a dual internal reporting channel for whistleblowing?

Doubt arises from the wording of Art. 4, par. 1, of the Whistleblowing Decree, according to which: "The organization and management models, referred to in Article 6, par. 1, letter a), Decree 231, provide for the internal reporting channels referred to in this decree". This provision seems to suggest the need to establish a double internal channel, one for whistleblowing reports and one for those provided for in Decree 231. 
Interpreting this provision with the aim to simplify the organizational structure, CNDCEC believes that private sector entities that have adopted a MOG must establish, after consulting with trade unions representatives, a single reporting channel that is appropriate, however, to the more protective measures set up in the Whistleblowing Decree. 
In light of this, as also specified in the Italian National Anti-Corruption Authority’s Guidelines on Whistleblowing (hereinafter, also “ANAC guidelines”, approved by Resolution No. 311 of July 12, 2023), the MOG must identify the appropriate reporting channel and define the procedures for handling reports in compliance with the Whistleblowing Decree. 
 

  • Which adaptations are needed to the internal reporting channel?

Before the aforementioned amendments, Decree 231 merely established that internal reporting channels had to guarantee the confidentiality of the identity of the reporter. 
The new Whistleblowing Decree requires an important adaptation of the reporting channel, which must in particular provide for the possibility of reporting in written and oral form, ensuring in both cases a high level of security and guarantee of confidentiality of the reporter's identity, including through the use of encryption tools. These requirements are not met, for example, according to ANAC, by ordinary e-mail or PEC. 
 

  • What is the role of the Supervisory Board under the Whistleblowing Decree?

Prior to the enactment of the Whistleblowing Decree, any corporate crime and/or violation of the MOG had to be reported to the Supervisory Board (Organismo di Vigilanza) provided for by Decree 231. After the enactment of the Whistleblowing Decree, it was questioned whether the supervisory board could be entrusted with the management of the whistleblowing reporting channel pursuant to Art. 4, par. 2, of the Whistleblowing Decree; given that the Italian legislator has expressly established to assign this task to an independent dedicated office with specifically trained personnel. 
The ANAC Guidelines do not exclude that the Supervisory Board (under 231 Decree) may be appointed as the manager of the whistleblowing reporting channel, if this choice is consistent with the size of the company, the nature of the activity performed and its organizational structure. 
However, the CNDCEC research paper points out that the handling of the whistleblowing reporting channel is a managing task, and therefore it is disputable that this task might be lawfully assigned to a body entrusted with merely supervisory powers.  
Alternatively, it seems compatible (and also preferable if the organizational structure of the entity allows it) to set up a specific Committee, with a mixed composition. Members of the Committee could be the heads of internal audit, legal affairs, human resources and compliance, and also one member of the Supervisory Board, so to achieve the necessary coordination between the body in charge of managing the whistleblowing channel and the Supervisory Board, in charge of assessing the suitability of the 231 Model to prevent corporate crimes.
Torna alle news

News correlate