Corporate Compliance: Integrity Programs

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Compliance and integrity programs are essential tools for preventing legal violations and protecting companies from administrative, civil and criminal penalties in the Brazilian corporate environment.

Legal foundations of compliance in Brazil

Corporate compliance gained prominence in Brazilian law with Law 12.846/2013 (the Anti-Corruption Law), which established strict liability for legal entities that commit acts harmful to the public administration. The law provides that internal integrity mechanisms and procedures can count as a mitigating factor when penalties are imposed, which encourages companies to adopt robust compliance programs.

Decree 11.129/2022, which regulates the Anti-Corruption Law, details the parameters used to evaluate integrity programs. The criteria include commitment from senior management, risk analysis, a code of ethics, internal policies and procedures, periodic training, reporting channels, disciplinary measures, third-party due diligence and ongoing monitoring of the program.

Beyond the Anti-Corruption Law, other statutes impose compliance obligations in specific sectors. Law 9.613/1998 (the Anti-Money Laundering Law) requires financial institutions and other sectors to adopt policies to prevent money laundering. The General Data Protection Law (Law 13.709/2018) requires privacy governance programs. Law 14.133/2021 (the New Public Procurement Law) treats integrity programs as a tiebreaker in public bidding.

At the state level, several Brazilian states already require compliance programs as a condition for contracting with the government. The State of Rio de Janeiro was a pioneer with Law 7.753/2017, which requires companies contracted by the state to implement an integrity program for contracts above a certain value.

Structure of an effective integrity program

Commitment from senior management is the cornerstone of any compliance program. Without genuine engagement from owners, directors and managers, integrity policies become mere formal documents with no practical effect. Senior management must set the organization’s ethical tone (the “tone at the top”), allocate adequate resources to the program and take an active part in compliance initiatives.

A risk assessment identifies the areas of the company most vulnerable to irregular practices. It considers factors such as the industry, geographic location, dealings with the government, the complexity of operations and the history of incidents. The risks identified guide how resources are prioritized and how specific policies are drafted for each critical area. Learn more about corporate bankruptcy

A code of ethics and conduct turns the company’s values into clear guidelines for the behavior expected of every employee, regardless of rank. It should address topics such as conflicts of interest, gifts and hospitality, dealings with public officials, donations and sponsorships, use of company resources, protection of confidential information, and a stand against all forms of discrimination and harassment. Learn more about commercial arbitration

At the state level, several Brazilian states already require compliance programs as a condition for contracting with the government.

Reporting channels allow employees, suppliers and third parties to report suspected wrongdoing safely and, preferably, anonymously. Law 13.608/2018, as amended by Law 13.964/2019, protects good-faith whistleblowers by prohibiting retaliation and guaranteeing confidentiality. A channel works only if users trust that reports will be investigated impartially and that the person reporting will not face reprisals. Learn more about starting a business

Third-party due diligence and the supply chain

Integrity due diligence is the advance evaluation of business partners, suppliers, service providers and other third parties the company deals with. The goal is to identify reputational and legal risks before the relationship is formalized, so the company does not become associated with entities involved in unlawful practices.

The review should include checking national and international restricted lists, searching court and administrative proceedings, running adverse media searches, analyzing ownership structure and identifying politically exposed persons (PEPs) among owners and executives. The depth of the due diligence should be proportional to the risk of the transaction and the value of the contract.

Anti-corruption clauses in contracts with suppliers and business partners are essential compliance tools. These clauses should require the third party to comply with all applicable anti-corruption laws, allow the contracting company to conduct audits, provide for penalties in case of breach and require the third party to keep accurate and transparent accounting records.

Monitoring, training and a culture of integrity

A compliance program is not static: it requires ongoing monitoring and periodic updates. Key performance indicators (KPIs) should be set to measure the program’s effectiveness, such as the number of reports received and investigated, the percentage of employees trained, incident response time and the results of internal audits.

Periodic training is indispensable for spreading a culture of integrity at every level of the organization. It should be tailored to the audience (executives, managers, operational staff, third parties) and cover topics relevant to each area. Documenting the training sessions held, with attendance lists and the content taught, serves as evidence that the program is effective.

How a company responds to incidents is a crucial indicator of its compliance program’s maturity. When wrongdoing is identified, the company should conduct an impartial internal investigation, apply proportionate disciplinary measures, remedy the harm caused and improve its controls to prevent it from happening again. Failing to act on known wrongdoing undermines the entire program.

To implement or improve your company’s compliance program, we recommend specialized legal advice that assesses the specific risks of your business. See our practice areas to learn how we can help.

Frequently Asked Questions

Do small businesses also need a compliance program?

Although the law does not require small businesses to adopt integrity programs, adopting compliance practices is highly advisable for any company. The program can be scaled to the size and complexity of the business, starting with simple measures such as a code of ethics, basic training and communication channels. Companies that contract with the government or operate in regulated sectors should pay special attention to compliance.

Does a compliance program guarantee that the company will not be punished for a violation?

A compliance program does not guarantee immunity, but Law 12.846/2013 provides that effective integrity mechanisms will be treated as a mitigating factor when penalties are calculated. Decree 11.129/2022 can reduce the fine by up to 4% of gross revenue when the program meets the legal parameters. For the reduction to be recognized, the program must be genuinely effective, not merely formal.

How does the reporting channel work, and who can use it?

A reporting channel is a means of communication that allows anyone (employees, suppliers, customers, partners) to report suspected wrongdoing confidentially or anonymously. It can be run in-house or by a specialized outside company, which offers greater impartiality. Reports received must be screened, investigated and answered within a reasonable time, with the whistleblower protected from retaliation under Law 13.608/2018.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.