Compliance for SMEs

Compliance must match the company. A medium-sized company needs understandable rules, reliable responsibilities and controls for its actual risks. An extensive manual alone helps little if no one knows what to do in purchasing, selling or processing clues. We assist companies in establishing an appropriate compliance organization and in reviewing existing processes.

When a review makes sense

• Your company is growing, opening up new markets or working with foreign intermediaries for the first time.
• Customers require a code of conduct, supply chain evidence or information about the whistleblower system.
• Responsibilities have grown historically; Approvals and control steps are handled differently.
• A notice, a data protection incident or a request from the authorities indicates possible gaps.
• When purchasing a company, risks should be identified and processed after the acquisition.

What are the obligations for smaller companies?

Small businesses must also comply with the laws that apply to them. However, there is no uniform obligation to set up an identical, certified compliance management system regardless of industry and risk. The requirements result from the legal form, the tasks of the management and special regulations for the respective activity.

§ 130 OWiG concerns necessary supervisory measures to prevent operational offences and irregularities. For GmbH managing director in particular § 43 GmbHG is relevant. In addition, for example, the whistleblower protection law, the money laundering law or regulations on IT security can trigger own organizational obligations. Number of employees and turnover are only relevant for the respective statutory thresholds; they do not replace any examination of the activity.

A practical setup in five steps

1. Understanding business and risks

We record business models, locations, products, customers, sales channels and important service providers. Selected discussions and existing documents show where legal risks occur and which controls already work. Urgent risks are given priority.

2. Establishing Responsibility

Tasks, decision-making powers, representations and reporting channels are assigned in a comprehensible way. An additional department is not required in every company. Sufficient expertise, time, resources and access to management are crucial.

3. Translate rules into workflows

A short code of conduct can be supplemented by specific regulations for gifts, business partners, data protection or approvals. We ensure that employees recognize when they can decide for themselves and when a legal review is necessary.

Involve employees

Training courses are based on the tasks of the participants. A purchasing team needs other case studies than management or personnel department. Notes and queries must have a reliable processing route.

5. Review effectiveness

Samples, comprehensible releases, the evaluation of incidents and regular reports show whether measures are effective in everyday life. Changes in the business or legal situation are taken over into the organization.

Our support and possible work results

• Legal stocktaking with a prioritized overview of the need for action and responsibilities.
• Review of a code of conduct and selected company directives.
• Development of release, testing and escalation processes.
• Legal monitoring of the introduction of a hotline and the involvement of service providers.
• Training, case meetings and ongoing monitoring agreed upon by mandate.

An organizational chart, a brief description of the business model, existing guidelines and typical customer or supplier requirements are helpful for getting started. From this we agree the scope of examination and the remuneration with you.

Common questions

Is a sample manual enough?

A pattern can be a starting point. However, it must reflect the concrete risks, responsibilities and actual processes. Inapplicable or unfulfilled requirements can make work more difficult and give a wrong picture of the organization.

Do we have to hire a Compliance Officer?

Not every company needs an independent body with this name. Special mandates must be examined separately. Tasks can be adequately distributed internally or partly externally supported; this does not eliminate the responsibility of the management.

Is there only one area to be checked at first?

Yeah. For example, the order can be limited to sales, a whistleblower system or business partner verification. We name interfaces at which further risks can be identified.

Does a CMS prevent any liability?

Nope. A carefully established system also does not guarantee violations. An effectively implemented, appropriate organisation can reduce risks and be relevant to the legal assessment. Their effect depends on the individual case.

Legal basis and further official information

• § 130 OWiG – Obligation to supervise
• § 43 GmbHG – Management Board
• § 12 HinSchG – Internal Reporting Points

Legal status: 1 November 2026. The classification of concrete facts requires an examination of the applicable regulations and circumstances.

Related topics and next steps

• Compliance management systems
• Whistleblower protection and internal reporting channels
• Liability of managing directors and executive board members
• Training and workshops

Request advice on the contact page. Briefly describe your request and, if necessary, specify existing deadlines. Scope and remuneration will be agreed prior to commissioning.