Criminal Compliance Certification UNE 19601 Accredited by ENAC 

No. EQA is a verification and certification body and does not provide advisory or consultancy services in its areas of activity. Our work consists of auditing and, where appropriate, certifying that your compliance management system has been designed in accordance with the reference standard, is implemented in your organisation and is being executed correctly. 

In order to undertake a certification process with guarantees of success, it is advisable that this crime prevention plan/model acquires the structure of the standard. To do this, you may need to plan a transition project prior to starting the certification process. In any case, at EQA we can audit your crime prevention plan/model, even if it is not designed in accordance with UNE 19601, although this audit will not result in a certificate of conformity but in a verification report issued by an independent third party.

These verification reports are requested in some areas, although the expectation is that organisations will gradually replace the request for verification reports with the request for compliance certificates; an example of this is, for example, the football league, although there are many other business areas in this same transitional situation. 

Undergoing a management system audit and certification process is – in principle – a voluntary matter. However, one of the natural objectives of implementing a system in accordance with a certifiable standard is precisely to undergo the audit process and obtain a certificate of compliance. The certificate is the reliable way to expose to third parties that the organisation really has a compliance management system in place. 

Although certification is a voluntary matter, there are certain markets where having a certificate can make the difference between being able to compete and being left out. On the other hand, auditing and certifying your system allows you to ensure that your system is alive in your organisation and can help you to detect deviations and non-compliances, thus supporting the internal control work of the organisation. 

Obtaining a certificate of conformity of the compliance management system can be a valuable tool and a solid indication in favour of the organisation in the event that a corporate crime has taken place. Thus, the Presidency of the National Court of Justice has pointed out that ‘It is a recognised and prestigious certificate; it gives a pre-trial seal of approval that it has been complied with’. 

On his part, Supreme Court Justice Magistrate Vicente Magro has pointed out that ‘having a compliance system based on reference standards, audited, certified and comparable with third parties, will be an extremely valuable and consistent support when it comes to invoking a possible exemption from liability for a crime attributable to the legal person’. It is important to note, however, that it is the courts that will make the final decision, and that a certificate will not replace this assessment in court, although it may substantially reinforce it. 

In most cases it will be possible in the same audit process for the organisation to undergo a certification process according to UNE 19601 for its criminal compliance management system and a certification process according to ISO 37001, the international standard for preventing, detecting and, where appropriate, responding to bribery.

This is possible insofar as both standards share an almost identical structure, so that a robust UNE 19601 system should have integrated most of the requirements that an ISO 37001 system should integrate. In any case, this is an option that will depend on the organisation concerned, and in no case is it compulsory to undergo both certification processes at the same time. 

In these cases, it is possible that, in the same audit process, the organisation undergoes a certification process in accordance with UNE 19601 for its criminal compliance management system and a certification process in accordance with UNE 19602 for its tax compliance management system.

This is possible insofar as both standards share a practically identical structure, although the organisation must have designed a truly integrated management system for both standards. In any case, this is an option that will depend on the organisation concerned, and in no case is it compulsory to undergo both certification processes at the same time. 

In principle, certification bodies are the subjects called upon to carry out these auditing and certification processes, as they are organisations that have been providing this type of services for decades, experts in working under the premises of independence, impartiality and technical competence. Moreover, those that have made a firm commitment to compliance – as is the case of EQA – will tend to have solid structures and their own staff with exclusive dedication to undertake these projects. 

In principle, using accredited certification bodies can be an indication that the entity meets the appropriate levels of independence, impartiality and competence. Our compliance division manager published an article in Cinco Días giving more details on this issue.