If the offense is committed by top management, it is a defense under Decree 231 of 2001 for the company to demonstrate that, before the offense was committed, (i) it had adopted and effectively implemented adequate compliance policies and procedures (so-called “Organizational Model”) suitable to prevent an offense of the kind that occurred; (ii) it had appointed a body (Organismo di Vigilanza) specifically vested with autonomous initiative and control powers to supervise the implementation of the Organizational Model (the “Supervisory Body”); (iii) the individuals who committed the offense did so by dishonestly eluding the Organizational Model; and (iv) there was no failure to supervise or insufficient supervision on the part of the Organismo di Vigilanza.

If the offense is committed by other employees or agents of the company, the company is not liable if, before the offense was committed, the company had adopted and effectively implemented an adequate Organizational Model to prevent offenses of the kind actually committed.

In any event, a company is not liable for offenses committed by its top management or subordinates if those individuals acted entirely in their own personal interest or in the interest of third parties.

Under the applicable Confindustria guidelines, an adequate Organizational Model is a model that:

• identifies the activities in the context of which offenses can be committed (risk assessment);
• establishes appropriate procedures for taking and implementing decisions relating to the prevention of those offenses;
• sets out adequate rules for managing financial resources in order to prevent the commission of such offenses;
• imposes obligations to inform and report suspicious activities to the Supervisory Body;
• provides for training sessions on the topics relevant to the Organizational Model and the prevention of crimes; and
• introduces a disciplinary system to sanction cases of non-compliance with the provisions of the Organizational Model.