Compliance in Times of the Coronavirus


More and more companies are reacting to the coronavirus with special measures to, as responsible employers, protect employees from infection and the company itself from the accompanying negative effects of the virus. Nevertheless, the spread of the virus has so far only been contained but not stopped, so that especially in these times of fundamental changes in the way we live together and the associated effects on existing business processes, there are also considerable factors that have an impact on ideally implemented compliance management systems.

Even without the threat of a pandemic, in most cases the simple implementation of a compliance management system is not sufficient to prevent liability risks in the company in the long term. Rather, such a system must be understood as a "living" instrument, which on the one hand must always be individually adapted to the respective company and on the other hand must also be adapted according to the company's development. This also applies to occurring "environmental factors" such as the coronavirus, which makes adaptation measures indispensable.

Thus, topics that are specifically relevant for a company today - such as which preventive measures are to be taken before the first case of infection and which reactions are to be made in case of suspected cases, as well as how the maintaining of business operations can be ensured - become new points of reference that play a significant role in the determination of current compliance risks. The effects of the coronavirus in its current stage on risk management within a stable compliance management system will be discussed below.

I. Corporate Governance 
There is no question that compliance with existing legal obligations must always be the primary objective of the management of responsibly acting companies, if only because of the existing personal liability risk of each individual. At the same time, the legal obligations form the basis of the corresponding control and enforcement obligations, which, in times of the coronavirus, include, on the one hand the maintenance of public life, the interests of the respective company, but especially the duty of care towards the own employees. This also means that a company, in order to take account of the existing duties of care, must include (supposed) knowledge of risks such as the coronavirus in the evaluation of its implemented risk management system. 

In addition, the implementation of principles of conduct by the company management itself ("tone from the top") and the ability to react immediately and promptly to any breaches that may occur is of crucial importance, even without emergency measures in connection with a pandemic. If management does not take prescribed rules and implemented measures seriously, there is almost no chance employees will comply with such rules even without a pandemic.
In the implementation this means, specifically:

II. Risk management
In the current situation, in which the fear of possible infection with the coronavirus is accompanied by an individual and therefore highly variable perception of risk, it is the responsibility of management to take the concerns of employees seriously, also in order to prevent any associated (manpower) losses and to meet the required standard of due diligence. In addition to the fear of contagion, there is also the negative economic impact: For this reason, it is the obligation of the company to create security for the employees and thus for the maintenance of business operations through early and clear communication. A functional risk management, which includes all activities of a company in dealing with risks, their identification, evaluation and monitoring as well as risk management, addresses these current issues. 

But how could such a functional system be structured in this case and which (partial) steps does it contain?

1. Prevention
As long as there is no case of infection, at least precautionary and educational measures should be installed in the company, such as regular exchange of information, cancellation/prohibition/postponement of business trips to regions at risk (travel warnings from the German Foreign Office), dissuasion of private travel to such areas and the request to report contact with (potentially) infected persons. In addition, depending on the degree of risk, stricter hygiene measures should be introduced. As a preventive measure, disinfectants can be dispensed in the company to at least give employees the opportunity to implement decisive hygiene measures under certain circumstances, even if this is naturally difficult to monitor.

2. Suspected cases/infections and possible effects
Due to the high risk of spreading an infection is notifiable: Precise instructions for action and responsibility should therefore be implemented, regulating which employee is responsible for passing on information to the responsible health authority and how further contact persons can be identified. For this purpose, it is advisable to implement a fixed reporting office and fixed contact persons in the company, where all information comes together.
In the event of a confirmed infection in the company, as a consequence and to protect the other employees, continuing to work as before is not an option. So far, it is not certain how long incubation periods or prolonged courses of the disease are and how long a certain scenario will last (previous experience probably assumes 14 to 27 days in the case of a symptomless infection or a mild course of the disease). In any case, a pre-defined plan of action (including possible alternatives for the respective company), including the allocation of areas of responsibility and powers of attorney, should ideally have been prepared in advance. Depending on the industry, company size and design, various alternatives are conceivable, which are not always uncritical or may require increased effort for implementation:

  • plant closures, which are, however, within the operating risk of the company,
  • reduction of overtime and corresponding agreements with employees, whereby understanding of the employees, if necessary of the works council, must be assumed, as well as
  • Home office solutions that require appropriate technical equipment for the respective employees and are only conceivable in certain sectors or sub-sectors of a (e.g. manufacturing) company.

Which of the alternatives listed as examples is to be carried out in each individual case and who is to make the final decision on this must also be regulated on the basis of a relevant instruction for action and responsibility (transparently and bindingly for all employees). 

In addition to these effects - which affect internal processes - there are far-reaching consequences that can also affect the company's external image, such as liability risks vis-á-vis third parties and the threat of loss of sales due to breach of contractual obligations and delivery failures.

In this context we would like to refer to the article "Coronavirus - Is your supply chain infected?" by our colleague Dr. Christian Engelhardt

III. Approaches to solutions
In any case, companies should have developed and implemented a company emergency plan or be able to activate it immediately, such as a defined procedure, e.g. in the event of infectious diseases (epidemic or pandemic plan), which outlines the individual phases for prevention or suspected cases with clear instructions for action and responsibilities.For this purpose, critical functions must be identified and staffed, e.g. by determining the most important employees for the business process. In addition, defined communication plans are indispensable, and employees must be equipped with the necessary equipment, such as laptops, to maintain business operations. These are measures for which one must prepare in advance in a planned manner. Once an employee is infected, it is too late for preparatory measures. Here, the employer must involve as many stake holders as possible - staff, works council, works doctor - in the preparation. 

Even without a pandemic, the mere identification of compliance risks alone is not sufficient; appropriate measures must follow in order to be able to counter such risks appropriately. These measures must then be effective and implementable in the event of a pandemic, so it is not enough to try to counter the risks posed by the coronavirus by establishing regulations, which in an emergency are not effective because they were actually only a "fig leaf".

IV. Outlook
In times of advancing globalization, the current situation will not be an isolated problem, as the past has already shown: 
Epidemics, pandemics and natural disasters are part of development, which makes it all the more important to implement and live medium- and long-term strategies. 
This has the advantage that clearly planned flow charts can become routines that are available at any time. 
Depending on the requirements of the specific situation, the company prepared in this way has a modular system at its disposal which can be tested in advance as required, regularly adjusted and adapted quickly and efficiently as needed. 
The flexibility generated by this can be seen as a plus point and helps the management to be adequately prepared for risk factors in increasingly complex and complicated times and to counter these with suitable means.