The company and the individual do not have the same defense
An investigation may target employees, executives or representatives while also exposing the legal entity to consequences. Even when the facts are connected, interests do not always coincide: conduct attributed to an individual may be presented as the product of incentives, tolerance or deficient organizational controls.
The first task is therefore to separate people, authority, processes, benefits, reporting lines and conflicts of interest. Using a single defense narrative for everyone without that analysis may harm the company or its executives.
Organizational failure is proved through facts
The formal existence of policies does not show that a control worked. The relevant questions include who approved payments, how suppliers were vetted, what alerts were ignored, whether functions were segregated, what training was provided and what happened when anomalies were detected.
Proportionality also matters. A small company is not expected to have the same architecture as a complex group, but each must show consistency between its risks and the controls it claims to operate.
- Approval matrices and evidence of their actual use.
- Due diligence on third parties and beneficial owners.
- Verifiable reporting, investigation and disciplinary channels.
- Information retention, traceability and oversight by the governing body.
What to do once an investigation exists
The response must not consist of fabricating retroactive documents or deleting information. The company should implement an orderly data hold, define who coordinates the response, identify legally protected privilege and secrets, and decide whether an independent internal investigation is appropriate.
Internal interviews require particular care: their purpose, documentation, warnings and custody may affect criminal, employment and corporate proceedings. Controls should be corrected without contaminating evidence or inducing coordinated accounts.
Criminal compliance that actually works
A useful program reduces risk, enables detection and leaves evidence of a control culture. It needs accountable persons, resources, proof of operation and periodic review. The goal is not to produce a decorative file after the problem occurs.
This text provides general information. The applicable law, offenses that permit corporate consequences and attribution model must be verified for each matter and date.
Official sources
The linked sources are official and generally published in Spanish. Always verify the current version and its application to the specific matter.