COMPLIANCE & RIGHT · TREATY
This self-check helps management and managers to identify open organisational issues. Answer any question with Yes, Partial, Yes or Not relevant"Yes" should be supported by an existing evidence and a comprehensible process. "Not relevant" requires a short justification.
The check does not provide any certification or mathematical proof of legality. What matters is what gaps exist and what consequences they can have. No answers will be requested on this page or sent to the firm. For your notes, there is a fillable PDF working version Ready.
1. Are responsibilities, decision-making powers and representations established for essential compliance tasks?
Check the organization chart and actual task distribution. In the event of a gap, management should clarify responsibility, powers and reporting channels.
2. Are the legal risks of the actual transaction assessed regularly and in case of important changes?
A list of general laws is not enough. New products, countries, distribution partners and acquisitions are occasions for reclassification.
3. Are the rules in force detectable, understandable and compatible with the workflows?
Let yourself be shown by a typical process when a release is needed and who decides. Inconsistencies between manual and practice are included as a task.
On the topic of compliance consulting: order, process and results
4. Are new and existing counterparties audited according to the actual risk?
Determine the scope of the examination and how to deal with abnormalities. Additional statutory audits, such as on sanctions or money laundering, remain to be determined separately.
5. Are contractual deviations, unusual fees and payments to third parties controlled?
Check for examples of whether performance certification, receiver and approval match. A signature without knowledge of the process is not a substantive control.
6. Is it clear which reporting and complaint obligations apply and who processes detailed information?
HinSchG, AGG and other channels of appeal must be distinguished. Check confidentiality, representation, deadlines and handling conflicts of interest.
On the subject of whistleblowing protection and internal reporting points
7. Are data processing, access, security incidents and, where appropriate, legal reports organized?
Add data protection and IT managers. An incident may trigger several reporting procedures that need to be assessed and coordinated separately.
8. Is it checked which product, license and safety requirements apply to your own offer?
Not every company is a manufacturer. However, the own role, product groups and delivery models must be clearly classified.
On the topic of product compliance, CE and recall management
9. Are particularly valuable confidential information determined and protected by appropriate measures?
Compare contracts, access rights and handling at the end of the project. Flat confidentiality clauses do not replace a lived protection organisation.
10. Do employees receive the guidance required for their tasks and can they ask questions?
Content should address typical decisions of the target group. Document participation and essential content; repeat training courses for relevant change needs.
11. Is it checked whether rules are applied and agreed measures implemented?
Use suitable samples and the evaluation of incidents. Hold open points, those responsible and appointments.
12. Are contacts and procedures known for suspected cases, government visits and other urgent events?
Check accessibility and representation. In the event of an already ongoing incident, concrete safeguards and legal deadlines take precedence over this self-check.
Evaluate the responses
Start with the points where there is a concrete suspicion, a legal deadline or an immediate risk for persons, data or products. These issues should be resolved without delay with the competent experts. A large number of positive responses do not compensate for such an open point.
In "Partially" or "No", record what is missing: a jurisdiction, a legal classification, an actual work step or proof. Then set a responsible person and a reasonable date. For "Yes, check randomly whether the rule described is actually applied.
Make a job out of open points
The three most important open questions and a description of your company are sufficient for a legal inventory. Personal case documents do not need to be sent in an orderly manner. We will coordinate the scope of the examination and the required documents with you. Contact to the firm.
Further reading: Compliance consulting: order, process and results · Checklists · Compliance for SMEs
Four practical examples
The following fictitious cases illustrate typical examination questions. The concrete solution depends on the circumstances of the individual case.
01 · Undocumented acceptance
One area is considered uncritical because nothing has happened so far. Actual processes and external changes will be reviewed before this assessment is taken over.
02 · Double jurisdiction
Sales and legal departments each consider the other to be responsible. A clear division of tasks is called decision, participation and control.
03 · Control without supporting documents
A form is checked regularly, documents are missing. A sample checks the actual test step and leads to a concrete adjustment.
04 · No notifications as a key figure
A low number of clues is considered a success. The company also checks trust, accessibility and quality of processing rather than comparing silence with risk-freeness.
Your next step
Do you want to transfer the requirements to your company or have a specific process checked? A brief description and a reference to existing deadlines are sufficient for the first contact. We shall vote on the scope of examination and compensation prior to commissioning.