This underscores the critical supervisory duties of the directors of a company and emphasizes the significance of an effective internal control system, including the adoption of an adequate organizational model pursuant to Legislative Decree 231/2001.
Background
On November 6, 2024, the Italian Supreme Court (ruling no. 40682) upheld the conviction of all the members of the board of directors of a joint-stock company operating in the construction industry for the manslaughter of a worker, committed in violation of the regulations on health and safety in the workplace.
The defense’s appeal challenged the previous judgment, claiming that the conviction was based mostly on the attribution of liability due to the position held in the company by the Chair and the other members of the board of directors, rather than on substantial factual evidence.
The defense’s arguments also highlighted the presence of multiple delegations granted by some resolutions of the Board, both in terms of management (Article 2381 of the Italian Civil Code) and function (Article 16 of Legislative Decree No. 81 of 2008, Consolidated Act on Health and Safety in the Workplace). The defense argued that this should have mitigated the responsibility of those individuals who were not granted delegations.
The Court’s ruling
The Court found the defense’s arguments lacking and upheld the conviction of all members of the board of directors of the company. The Court recognized the criminal liability of the Board members due to severe organizational deficiencies directly attributable to them, regardless of any delegations. These deficiencies included a lack of planning and proceduralizing of activities throughout the entire production process. Additionally, the controls and the adopted Operational Safety Plan was inadequate. According to the Court, these shortcomings stemmed from a corporate policy that prioritized delivery times over product quality, subordinating safety requirements to profit as a result.
The Italian Supreme Court has emphasized that the board of directors holds ultimate responsibility for risk management, regardless of any specific delegations in place. This responsibility arises from their overarching authority over the systems of power that can influence these risks.
The Court has clarified the distinctions between management delegations and functional delegations, noting that each type of delegation has a different impact on the residual duties that remain with the delegating party.
In particular:
- When a management delegation is granted by the Board to one or more members (so-called ‘management delegation’ granted under Article 2381 of the Italian Civil Code), the responsibility for implementing and ensuring compliance with safety measures is transferred to the delegate. However, the board of directors retains the duty to oversee and verify overall management performance and the adequacy of the corporate structure. They also retain the authority to issue directives and intervene if they become aware of situations of risk that are managed inadequately. Consequently, if a violation of these safety obligations is verified, the entire board of directors may be held accountable for any related accidents. This accountability arises from their overarching duty to monitor and ensure the proper management of safety measures within the organization.
- Regarding the so-called ‘delegation of functions’ (Article 16 of the Consolidated Act on Health and Safety in the Workplace), i.e. the transfer of certain preventive powers and duties related to the protection of workers’ health and safety to another party, the delegating employer must oversee the proper execution of the transferred functions. The delegating party can be held accountable for negligence in the selection of the delegate (culpa in eligendo) or supervision (culpa in vigilando) of the activities performed by the delegate if these played a causal role in any incidents.
Even with delegations in place, the board of directors retains significant responsibilities:
- Vigilance: the Board must continuously oversee management’s performance and ensure the proper execution of delegated functions.
- Intervention: the Board holds a substitutive power, allowing and requiring them to intervene and exercise their authority when necessary.
- Accountability: when a functions delegation has been disposed, the delegating party’s criminal liability does not cease if incidents are caused by structural defects in the company’s production process. In such cases, the responsibility of the board of directors’ members remains.
Conclusions
The principles established by the Italian Supreme Court in this case pertain to circumstances where liability arises from serious deficiencies related to workplace health and safety standards.
Nonetheless, there are many further scenarios in which criminal liability is attributed to the entire board of directors and/or individual directors, regardless of any delegations.
For non-executive board members, criminal liability can arise in two forms: active participation, where a member contributes (through moral or material contributions) to an offense being committed, and passive participation, where a board member fails to prevent crimes within the business operations. Passive participation presents challenges such as defining oversight obligations, the existence of preventive powers, and proving the subjective element of the crime.
The principle of passive criminal liability is constructed upon the combined provisions of Article 40, paragraph 2 of the Italian Criminal Code and an incriminating provision that typically prescribes a commission-based offense. The core of this liability type is the existence of a specific duty for the guarantor to act to prevent criminal acts.
Article 2392 of the Italian Civil Code outlines the protective obligations of board members, emphasizing “collegial responsibility.” This means all board members are liable for unlawful acts unless they can prove that they were unaware of the criminal activity, or actively opposed it. As clarified by certain criminal case law, when specific matters are delegated, only the responsible directors are liable. However, non-delegated directors can still be held liable for failing to fulfill their duty of information, as per Article 2381 of the Civil Code. This duty requires directors to stay informed about the company’s management and to seek additional information if there are warning signs, doing everything possible to prevent or mitigate harmful acts.
In conclusion, a non-executive director has two main duties:
- To request and acquire information about company management during board meetings.
- To express dissent and take action to prevent illegal acts if they acquire knowledge of such acts.
Overall, as the Italian Supreme Court has emphasized on various occasions, the adoption and implementation of robust control measures in all areas that are potentially at risk, including health and safety matters, is crucial, particularly for companies with complex and intricate organizational structures.
Takeaways
To mitigate the risk of potentially incurring criminal liability, directors must conduct a thorough evaluation of their internal control systems, ensuring they are duly informed of any relevant risk in order to guarantee prompt intervention.
Key actions include:
- Conducting specific risk assessments: perform detailed risk assessments and implement appropriate measures to mitigate them.
- Structuring a robust delegation system: ensure the delegated parties have the skills and capabilities to handle the role.
- Information flows: ensure regular and comprehensive information flows to the board of directors and request overdue updates.
- Supervision and management: ensure appropriate supervision and management of the delegated activities.
- Intervention: intervene promptly in the presence of potential risks.
- Adopting a proper internal control system and an Organizational Model: implement an appropriate Organizational Model under Legislative Decree 231/2001, which provides a framework for managing and controlling potential risks. Regarding health and safety matters, adopt a Model 231 compliant with the requirements set forth by article 30 of the Consolidated Act on Health and Safety in the Workplace.
- Adopting specific policies and procedures: regulate processes within at-risk areas in order to prevent the specific substantial and legal risks related to such activities.
- Monitoring and auditing: regularly monitor and audit relevant practices to ensure compliance with established policies and procedures.
- Training activities: conduct training activities for employees within the company. Provide specialized training on health and safety matters, tailored to the specific roles within the health and safety organizational structure.
