The practice
Prevention that holds up in court
A company answers criminally for offences committed in its benefit — unless it can show a real prevention model was in place. That word, real, is the whole practice: a binder nobody has read protects nobody. Judges look for a living system — risks mapped, rules trained, evidence kept — and that is the standard we build to, scaled to the company we are building it for.
The law keeps raising the bar: since Ley 2/2023, any company with fifty or more employees must run a whistleblower channel that meets strict requirements. We set up the whole system — map, protocols, channel, training, audits — and we keep it alive, because a programme that stopped updating is a programme that stopped existing.
The system
What a programme that works contains
Six pieces, working together, sized to the company. A twelve-person firm does not need a bank's manual — it needs its own risks covered, its people aware of them, and proof that both are true. That proportionality is not a shortcut; it is what the law itself asks for.
Built this way, the programme pays for itself twice: as a legal shield on the worst day, and as the answer to the client, bank or tender that now asks — routinely — whether you have one.
The risk map
Your real operations, mapped against the offences that could actually occur in them — not a generic catalogue.
The protocols
Short, written, followed: decision rules for the exact moments where the risk lives.
The channel
A reporting channel that meets Ley 2/2023 — mandatory from fifty employees, sensible well before.
The training
Teams that recognise the risk moment when it arrives — with the attendance sheet filed.
The audit
Reviewed on schedule, updated when the business changes. A stale programme is no programme.
The evidence
Everything documented so that, on the worst day, the company can prove it did things right.
The route
From zero to defensible
The diagnosis
Where your risk actually lives — activity, sector, clients, money flows. Honest scope, honest budget.
The design
Risk map, protocols and the reporting channel, drafted for your company — readable by the people who must follow them.
The rollout
Training sessions, the channel live, responsibilities assigned. The programme leaves the binder and enters the routine.
The upkeep
Periodic audits, updates when the business moves, the evidence file always current. Alive — which is what counts.
Corporate Compliance questions
Before you ask
Is a compliance programme mandatory?
The whistleblower channel is, from fifty employees. The programme itself is what the Criminal Code rewards: with a real one, the company can escape or reduce criminal liability — and clients, banks and public tenders increasingly ask for it regardless.
We are a small company. Does this really apply to us?
Scaled to your size, yes. The law expects proportionality, not a corporate manual — an SME programme covers the handful of risks that genuinely touch your activity, at a cost that makes sense for an SME.
What exactly does the whistleblower law require?
An internal channel with confidentiality guaranteed, response deadlines, protection against retaliation and a designated responsible person — with sanctions for companies that should have one and do not. We set it up and can help run it.
Does a programme really protect the company and its directors?
A real one does: for the company, it is the legal route out of criminal liability; for directors, it is the documented proof that control was exercised. A decorative one protects no one — courts have become very good at telling them apart.
How long does implementation take?
For an SME, the diagnosis and design are a matter of weeks, and the rollout follows the company's own calendar. The channel can be live quickly — which matters if the fifty-employee line already applies to you.
Fifty employees? The channel stopped being optional.
Tell us your size and your sector — we tell you what the law expects of you, what covering it costs, and where to start.
Prefer to call?
Ask about your obligations
Company size, sector, what you already have — a lawyer replies within one business day.
Appointment request
Pick the office, day and time that suit you — the diagnosis conversation is the natural first step.