Compliance management systems

COMPLIANCE & RIGHT · TREATY

The four practical examples · Send request

A Compliance Management System (CMS) bundles the responsibilities, rules and processes that prevent a company from violating legal violations, processing information and improving its organisation. It's supposed to work in everyday work. We support the establishment of a new system and the legal review of existing measures.

A system by size, activity and risk

There is no identical model for all companies. Sector, legal form, business processes, country receipts and concrete risks determine which measures are necessary and appropriate. Special legal organisational obligations must be taken into account. A CMS is not only effective because a manual is extensive or a specific name is used.

Supervision obligations may arise in particular from § 130 OWiG. Company due diligence and organisational obligations as well as sector-specific regulations are added. The requirements for a small owner-managed company and an internationally active group may differ considerably.

From the actual state to the resilient organization

Inventory and risk analysis

We record business processes, existing rules, responsibilities and known incidents. The legal risk analysis should take into account both potential impacts and likelihood and existing controls. It shall be updated in the event of substantial changes and at appropriate intervals.

Objectives and responsibility

Management shall define the framework and provide appropriate resources. Responsible persons need clear tasks, powers and reporting channels. Representations, conflicts of interest and escalation cases shall be taken into account. Outsourced tasks remain integrated into your own organization.

Rules and controls

Guidelines translate requirements into concrete actions: Who checks a business partner? Who approves an invitation? Which data may be entered into an AI system? When will a delivery be stopped? Controls should address risks in a targeted manner and be documented in the workflow.

Information, training and advice

Employees need understandable information and training tailored to their activities. Questions and advice must reach appropriate contact persons. The special requirements of the whistleblower protection law must be observed in the case of legally prescribed notification points.

Monitoring and improvement

The organisation shall be checked by sampling, evaluation and audit. Determined weaknesses receive a responsible person and an appointment for processing. The management is informed about significant risks, incidents and the status of the measures. An incident should be followed by a verifiable improvement.

Existing basics and elements

The following subpages explain the individual elements and topics of compliance management:

Combining technical priorities in a meaningful way

An overarching CMS can coordinate procedures for reporting agencies, internal investigations, antitrust law, corruption prevention, money laundering, sanctions, supply chains, data protection and AI. Uniform reporting channels can facilitate the work. The specific legal requirements of the individual areas remain to be observed.

The Overview of our consulting topics leads to the in-depth specialist pages. For smaller enterprises we explain below: Compliance for SMEshow the measures can be adequately limited and prioritized.

Our services and possible work results

Stocktaking with documented definition of the scope of the examination.
Overview of the main legal risks and prioritized action plan.
Concepts of responsibility, release and escalation.
Code of conduct and task-related guidelines.
Training plan and appropriate documentation for the target groups.
Examination of selected controls and report on identified improvements.
Ongoing legal supervision to a separately agreed extent.

Common questions

Does each company need a certified CMS?

There is no general certification requirement applicable to all companies. Special statutory or contractual requirements must be examined separately. An organisation that is appropriate and effectively implemented for the company is crucial.

Does a CMS prevent fines and damages safely?

Nope. It is designed to reduce risks and enable an appropriate response. Whether and how measures are taken into account in a sanction or liability issue depends on the legal requirements and the individual case.

Can we continue to use our previous guidelines?

Yes, as far as they fit in terms of content and are actually applied. We check existing documents for gaps, contradictions and unnecessary complexity. Proven processes can be integrated into an overarching concept.

What distinguishes a legal examination from a certification?

A legal examination evaluates legal requirements within the agreed order. A formal certification or business examination according to a specific standard is a separate order with its own requirements. The scope and significance of the result must be clearly identified.

How do we start?

With a description of your activity and the occasion for the examination. Existing guidelines, an organizational chart, important customer requirements and known incidents help to determine the first scope of examination.

Legal basis and further official information

Legal status: 1 November 2026. The classification of concrete facts requires an examination of the applicable regulations and circumstances.

Four practical examples

The following fictitious cases illustrate typical examination questions. The concrete solution depends on the circumstances of the individual case.

01 · New business segment

A manufacturer starts direct sales. The risk analysis will be supplemented by customer groups, advertising statements and new contracts; existing controls will be tested for their suitability.

02 · Manual without application

There are rules, but nobody knows them in purchasing. Short release rules, training and samples fill the gap between documentation and practice.

03 · Repeated rule violation

Despite an earlier warning, similar mistakes occur. Causes, incentives and actual controls will be investigated before further measures are adopted.

04 · Annual management report

The management receives a list of completed training courses. In addition, open risks, overdue measures and evidence of effectiveness are reported.

Your next step

Do you want to transfer the requirements to your company or have a specific process checked? A brief description and a reference to existing deadlines are sufficient for the first contact. We shall vote on the scope of examination and compensation prior to commissioning.

Send request without mandatory fields →