Internal Compliance Programme and Model 231, how to allocate responsibilities within exporting companies

The growing complexity of European export control legislation has progressively made international trade compliance an increasingly important function within corporate organisations. Verifying the nature of exported products, their destinations, end-users and any applicable restrictions can no longer be regarded as a purely administrative activity associated with the shipment of goods. Instead, it requires internal procedures capable of identifying and preventing the risk of regulatory violations.

It is within this framework that the Internal Compliance Programme (ICP), known in Italian as the Programma Interno di Conformità (PIC), operates, as governed by EU legislation on dual-use items. Its progressive establishment within the Italian regulatory framework nevertheless raises an organisational issue of particular relevance to companies that have already adopted an Organisation, Management and Control Model pursuant to Legislative Decree No. 231/2001: “what should the relationship between these two instruments be and, above all, to whom should the respective responsibilities be assigned?”

This issue gained further significance during 2026, following the extension of corporate administrative liability to certain violations of European Union restrictive measures. The main changes introduced by Legislative Decree No. 211/2025, including the associated sanctions, have already been examined by Avv. Dario Gorji Varnosfaderani in his article «EU Economic Sanctions: Violations Come at a High Cost», published on 21 January 2026 in Il Sole 24 Ore.

The aspect that now warrants separate examination is the coordination between these control systems, with particular reference to the allocation of responsibilities among the person entrusted with managing the ICP, the internal functions responsible for compliance under Legislative Decree No. 231/2001, and the Supervisory Body (Organismo di Vigilanza, OdV).

The objective is to establish an organisational structure that enables the respective compliance safeguards to be effectively integrated, while maintaining a clear distinction between operational responsibilities and supervisory functions, thereby preserving the independence of the controls and avoiding overlapping responsibilities that could undermine their effectiveness.
 

The ICP within the Italian Legal Framework and the Allocation of Corporate Responsibilities

The principal legal reference is, as is well known, Regulation (EU) 2021/821, which governs the control of exports, brokering, technical assistance, transit and transfer of dual-use items.

Article 2(21) defines the ICP as a “set of effective, appropriate and proportionate policies and procedures adopted by exporters to ensure compliance with EU provisions and the conditions of authorisations, including due diligence measures aimed at assessing risks associated with the end-users and end-uses of exported items”.

It constitutes a comprehensive system of controls that must be effectively implemented within corporate processes. Its application is particularly relevant in the context of global export authorisations, for which Article 12(4) of the aforementioned Regulation provides for the implementation of an Internal Compliance Programme (ICP).

At the national level, UAMA, the competeneq2q21qt authority within the Italian Ministry of Foreign Affairs and International Cooperation, has provided specific implementing guidance through its Communication of 15 July 2022, requiring the submission of the ICP and the corresponding summary document as part of applications for global export authorisations.
Of particular significance from an organisational perspective is Commission Recommendation (EU) 2019/1318, which identifies the essential elements of Internal Compliance Programmes. The European Commission requires companies to clearly define the functions responsible for export control, assign specific responsibilities and ensure the availability of qualified personnel and adequate resources.

It follows that the ICP must be supported by clearly defined responsibilities, while the structure of the function entrusted with its management will depend on the size of the company, the complexity of its operations and its actual exposure to export control risks.

ICP Manager and Supervisory Body: The Distinction Between Management and Oversight

The issue becomes more complex when a company has already adopted an Organisation, Management and Control Model pursuant to Legislative Decree No. 231/2001.

Article 6 of Legislative Decree No. 231/2001 entrusts the Supervisory Body (OdV) with the task of overseeing the functioning of and compliance with the Model, as well as ensuring that it is kept up to date, requiring the Body to have autonomous powers of initiative and control.

The ICP Manager, for their part, is involved in organising and implementing controls over commercial transactions. Their responsibilities may include, for example, verifying product classifications, determining whether authorisations are required, checking the identity of counterparties, reviewing the destinations of goods and identifying any applicable restrictions. These activities directly affect the company's decision-making and operational processes.

The Supervisory Body, by contrast, is not legally responsible for authorising exports or taking over the responsibilities of the relevant corporate functions. Its role is to oversee the adequacy of and effective compliance with the Model 231, including by reviewing preventive protocols and information flows.

Indeed, the legislation currently in force neither requires the ICP Manager and the Supervisory Body to be the same person nor establishes a general prohibition on combining these roles. However, any overlap between them must be assessed in light of the autonomy required under Article 6 of Legislative Decree No. 231/2001.

Assigning operational responsibilities and supervisory duties over the same activities to a single individual could, in the author's view, give rise to a situation of self-monitoring, in which the person responsible for assessing the effectiveness of procedures is also directly involved in their implementation. This does not constitute an incompatibility expressly established in absolute terms by the legislator, but rather an organisational concern that may affect the effectiveness of the supervisory system.

A different situation arises where the ICP Manager also performs an internal compliance function under Legislative Decree No. 231/2001 that is separate from the Supervisory Body. In such circumstances, combining the roles may be compatible with the applicable legal framework, provided that the individual concerned possesses the necessary expertise and resources and that the respective responsibilities are clearly defined.

This distinction must also be considered in light of the specific provisions of Article 6 itself, which allows supervisory duties to be performed directly by the governing body in smaller entities and, in the case of companies limited by shares or other limited liability companies, permits the functions of the Supervisory Body to be assigned to certain corporate control bodies. For this reason as well, it would be incorrect to suggest that the law imposes an absolute prohibition on overlapping functions.

Integrating the ICP into the Model 231 Without Duplicating Controls

The distinction between responsibilities does not mean that the ICP and the Model 231 must operate as separate systems without any connection between them.

Article 6(2) of Legislative Decree No. 231/2001 requires the Model to identify activities exposed to the risk of commission of predicate offences, establish specific preventive protocols and provide for reporting obligations towards the Supervisory Body.

The procedures adopted under the ICP may help meet these requirements insofar as they provide safeguards for activities that are also relevant to corporate liability. Examples include screening commercial counterparties, identifying the end-user (End User), verifying the necessary authorisations and managing transactions that present unusual or potentially suspicious features.

However, integration should not be automatic. The legislation governing dual-use items and that concerning European Union restrictive measures have different scopes of application, although they may affect the same transactions. An Internal Compliance Programme designed exclusively to ensure compliance with Regulation (EU) 2021/821 may therefore be insufficient to address all the risks relevant to the Model 231, particularly those associated with financial restrictions or restrictions targeting specific persons or entities under EU sanctions regimes.

Coordination should therefore begin with a mapping of corporate risks, identifying which ICP procedures can be incorporated by reference into the Model 231 and which additional controls may be necessary.

In this respect, the arrangements governing information flows play a central role. Any issues identified during export control checks, violations detected and corrective measures adopted should be reported to the Supervisory Body in accordance with predefined criteria and procedures, where relevant to the risks addressed by the Model.

In this way, the OdV can perform its supervisory functions on the basis of information provided by those with operational responsibilities, without becoming directly involved in managing individual commercial transactions.

An Integrated Organisational Structure, but with Clearly Defined Responsibilities

The evolution of European export control legislation and its progressive coordination with the Italian system of corporate liability present companies with a specific organisational challenge: ensuring that the proliferation of compliance instruments does not lead to overlapping responsibilities, duplication of procedures or, conversely, areas of risk for which no clearly identified person is responsible.

The solution does not necessarily lie in establishing new corporate bodies or indiscriminately assigning all compliance functions to a single individual. Rather, it requires the development of an organisational structure proportionate to the characteristics of the company, in which operational responsibilities are clearly defined and supervisory controls retain their independence.

The ICP can therefore be integrated into the broader corporate prevention framework, contributing to the effectiveness of the protocols established under the Model 231. Its management, however, must remain entrusted to functions possessing the necessary expertise in export control, while the Supervisory Body is responsible for verifying, within the scope of its duties, the effectiveness of the safeguards relevant to corporate liability.

The issue is therefore not whether the ICP Manager should also be responsible for compliance under Legislative Decree No. 231/2001, but rather ensuring that the two regulatory frameworks are coordinated without blurring the distinction between those responsible for managing risks and those entrusted with overseeing the effectiveness of controls.
For exporting companies, this distinction is one of the fundamental elements of a compliance system capable of combining operational efficiency with the prevention of corporate liability.

Enrico Ruggeri
de Capoa Law Firm