In brief. The 231 organisational model — modello di organizzazione, gestione e controllo (MOG) — is the compliance framework introduced by Legislative Decree no. 231 of 8 June 2001 (D.Lgs 231/2001), which created the administrative liability of entities for crimes committed in their interest or to their advantage. An entity that has adopted and effectively implemented an adequate MOG before the offence, and that has entrusted oversight to an independent supervisory body — the organismo di vigilanza (OdV) — can be exempt from liability even where one of its people commits a predicate offence. The model is therefore not a formality but the entity’s principal line of defence.

What D.Lgs 231/2001 introduced

Before 2001 Italian law followed the principle societas delinquere non potest — an entity could not itself commit a crime. D.Lgs 231/2001 broke with that tradition by establishing the administrative liability of entities (companies, associations and certain other bodies) arising from offences committed in their interest or to their advantage by:

  • persons in a senior position (soggetti apicali) — directors, managers, those who represent, administer or direct the entity or one of its autonomous units; or
  • persons subject to the direction or supervision of those in a senior position (soggetti sottoposti).

Liability is “administrative” in name but is established in criminal proceedings, before the criminal court, with sanctions that can be severe: pecuniary sanctions calculated in quote (units), disqualification measures (sanzioni interdittive) such as a ban on contracting with the public administration or suspension of licences, confiscation of profit, and publication of the judgment. For some entities, disqualification measures can be more damaging than any fine.

The organisational model (MOG)

The MOG is the set of protocols, procedures and controls by which the entity seeks to prevent the commission of the predicate offences relevant to its activity. An effective model is built from a structured process:

  1. Risk assessment (risk mapping). Identification of the areas of activity exposed to the risk of predicate offences and of the ways in which those offences could be committed.
  2. Gap analysis. Comparison of existing controls against the identified risks.
  3. Design of protocols. Adoption of specific procedures governing the formation and implementation of decisions, the management of financial resources, and segregation of duties in sensitive processes.
  4. Code of ethics and disciplinary system. A code of conduct binding on all addressees and a disciplinary system capable of sanctioning breaches — an indispensable component, since a model that cannot be enforced is not “effective.”
  5. Whistleblowing channels. Confidential internal reporting channels, a prohibition of retaliation and related disciplinary rules, now required by art. 6(2-bis) of the decree following the implementation of the EU Whistleblowing Directive (D.Lgs 24/2023).
  6. Training and periodic updating. The model must be kept current as the business, the organisation and the catalogue of predicate offences evolve.

A model copied from a template without genuine adaptation to the entity’s real activity is routinely held inadequate by the courts.

The supervisory body (organismo di vigilanza)

A distinctive requirement of D.Lgs 231/2001 is that oversight of the model be entrusted to an organismo di vigilanza (OdV) — a body endowed with autonomous powers of initiative and control. Its function is to supervise the operation of, and compliance with, the model and to ensure its updating.

The OdV must meet three core requirements established by law and case law:

  • Autonomy and independence — it must not be subject to the operational hierarchy it supervises;
  • Professionalism — it must possess the legal, accounting and organisational competence appropriate to the task;
  • Continuity of action — it must monitor on an ongoing basis, not occasionally.

The OdV may be collegiate or, for smaller entities, monocratic; in defined cases the supervisory function can be assigned to existing bodies. Crucially, the OdV must have effective resources and information flows: a body that exists on paper but receives no information and conducts no checks will not support exemption.

Exemption from liability

The decisive practical question is when an effective MOG exempts the entity from liability. D.Lgs 231/2001 distinguishes by reference to who committed the offence.

Offences by senior persons (apicali). The entity is exempt if it proves that:

  • the management body adopted and effectively implemented, before the offence, an organisational model suitable to prevent offences of the kind that occurred;
  • it entrusted the task of supervising the model to an OdV with autonomous powers;
  • the OdV did not omit or insufficiently perform its supervisory duties; and
  • the offender committed the offence by fraudulently circumventing the model.

Here the burden of proof is on the entity — a reversal that makes the quality of the model and the diligence of the OdV decisive.

Offences by subordinate persons (sottoposti). The entity is liable only if the offence was made possible by a failure to comply with management or supervision obligations; an adequately adopted and implemented model is presumed to satisfy those obligations, and the burden of proof rests on the prosecution.

In both scenarios, the court conducts a substantive assessment of whether the model was genuinely adequate and effectively implemented — not a box-ticking review.

How ILA supports clients

ILA assists Italian and foreign entities across the full 231 lifecycle: designing and updating the MOG, mapping predicate-offence risk for the specific business, advising on the composition and operation of the OdV, integrating whistleblowing channels, and — when an investigation arises — defending the entity in criminal proceedings, including in opposing disqualification measures at the precautionary stage.

For the wider framework, see our pillar on corporate liability under D.Lgs 231/2001.

FAQ

Is adopting a 231 model compulsory? The decree does not impose a general legal obligation to adopt a MOG. In practice, however, it is essential: only an adequate and effectively implemented model can exempt the entity from liability, and a model is often required to qualify for public contracts, certifications and similar opportunities.

What is the organismo di vigilanza and who can sit on it? The OdV is the body charged with supervising the model. It must have autonomy, professionalism and continuity of action, and must be independent of the functions it oversees. It can be collegiate or, for smaller entities, a single member, and may include external professionals.

Does having a 231 model guarantee the company avoids liability? No. The model must be genuinely adequate to the entity’s real risks and effectively implemented, and the OdV must have actually performed its duties. For offences by senior persons the entity bears the burden of proving these conditions and that the offender fraudulently circumvented the model.

If your company operates in Italy and needs to design, review or defend a 231 model, contact ILA. See our corporate liability 231 pillar, reach us via the Contact page, or read more about the firm.