Corporate compliance programme in Brazil for companies that must prove what they do
A code of ethics signed and forgotten carries no weight in an inspection. What counts is evidence that the rules are applied every day.
A compliance programme is the set of policies, controls, training and reporting channels that prevent and detect wrongdoing and regulatory breaches. Brazil's Clean Company Act (Law 12,846/2013) takes its existence and application into account when setting penalties. Talk to a lawyer when entering a regulated sector, contracting with the government, receiving investment or after an incident.
A corporate compliance programme in Brazil organises, in a verifiable way, how the company complies with the law and the rules of its sector. On the anti-corruption side, Law 12,846/2013 (the Clean Company Act) holds companies strictly liable for harmful acts against the public administration, and Decree 11,129/2022, which regulates that law, sets the criteria authorities use to assess an integrity programme.
The subject is no longer exclusive to large groups. Law 14,133/2021 (the Public Procurement Act) requires the winning bidder in very large contracts to have an integrity programme and takes it into account in tie-breaks, in setting penalties and in bidder rehabilitation. Partners, banks and investors ask for evidence in due diligence. And regulatory agencies demand routines specific to each sector.
We build programmes proportional to each company's size and risk. No copied manuals: we start from the real operation, prioritise what exposes the company most and design controls that leave a record within the normal workflow, without extra effort from front-line staff.
When to call a lawyer
Public contract on the horizon
The company bids for public tenders or is about to sign a very large contract and must demonstrate an integrity programme within the required deadline.
Investor or partner due diligence
A fund, bank or business partner has sent an integrity questionnaire and the company cannot support many of its answers.
Entry into a regulated sector
The operation now depends on authorisation from an agency or ministry, with control, reporting and prevention obligations that did not exist before.
Whistleblower report or internal incident
A report of misconduct involving an employee, supplier or intermediary has surfaced, and the company has no channel or procedure to investigate it.
What happens when you leave it for later
- Without an effective programme, the company gives up a factor that the Clean Company Act requires authorities to consider when applying penalties, which include fines calculated on gross revenue.
- Lack of proven integrity keeps the company out of very large public contracts and puts it at a disadvantage in procurement tie-breaks.
- Due diligence stalls or ends with indemnity clauses, price holdbacks or the deal being called off.
- Misconduct by third parties and intermediaries reaches the company, which is strictly liable for acts committed in its interest or for its benefit.
How we work
Risk assessment
We interview leadership, analyse contracts, workflows and interactions with the public sector, and rank risks by likelihood and impact.
Programme design
We define the code of conduct, policies and controls in proportion to the company's size, aligned with the criteria in Article 57 of Decree 11,129/2022 and the sector's rules.
Implementation
We support leadership communication, training, third-party due diligence and the set-up of a whistleblowing channel with protection against retaliation.
Evidence and monitoring
We create a routine of records, indicators and periodic reviews so the programme holds up in audits, due diligence or inspections.
Incident response
When a suspicion arises, we conduct or guide the internal investigation and assess the duty to report to authorities and the options provided by law, such as a leniency agreement.
What you receive
- Integrity and regulatory risk matrix
- Code of conduct and essential internal policies
- Third-party and supplier due diligence procedure
- Whistleblowing channel structure and investigation workflow
- Training plan and programme evidence records
Why the firm
Sized to the operation
Decree 11,129/2022 requires authorities to consider the company's size and specific features. We design the programme to fit, without red tape that nobody will follow.
Integrity and regulation together
We combine anti-corruption with sector obligations, such as responsible gambling and anti-money laundering in betting or health rules in healthcare, in a single control system.
Built to be defended
The team that structures the programme also handles administrative defences. That experience guides what to record today to have evidence tomorrow.
Illustrative scenario
Hypothetical scenario, for illustration only. A regional construction company wins a tender for a very large contract, and the tender notice requires an integrity programme within the legal deadline. The company has an old code of ethics, no whistleblowing channel and no controls over intermediaries who deal with city governments. The firm assesses risks with the board, redesigns policies, sets up the channel with whistleblower protection, and creates third-party due diligence rules and a training calendar with records. In the end, the company has a documented programme it can present to the contracting authority and use in future bids.
A hypothetical scenario, shown only to illustrate our method. Every case depends on its own facts.Frequently asked questions
What should a corporate compliance programme in Brazil include?
A corporate compliance programme in Brazil needs, at a minimum, leadership commitment, a code of conduct, risk assessment, training, a whistleblowing channel, third-party due diligence and monitoring. These items are among the criteria in Article 57 of Decree 11,129/2022 (the regulation of the Clean Company Act), applied in proportion to the company's size.
Is compliance mandatory in Brazil?
There is no general obligation for all companies, but there are specific requirements. Law 14,133/2021 requires an integrity programme in very large public contracts, and regulated sectors such as betting and financial institutions have their own control duties. Otherwise the programme is voluntary, but it weighs when penalties are set and in negotiations.
What is the difference between compliance and an integrity programme?
Integrity programme is the term Law 12,846/2013 and Decree 11,129/2022 use for anti-corruption compliance. Compliance is broader and also covers regulatory, labour, data protection and sector-specific obligations. In practice, both should work within the same control system.
How long does it take to implement a compliance programme?
It depends on the company's size, number of sites and risk level. For very large public contracts, Law 14,133/2021 allows six months from contract signature, which is a useful reference for pace. The timeline is set after the risk assessment.
Does a compliance programme reduce fines under the Clean Company Act?
It can count in the company's favour, because the existence and application of an integrity programme are among the factors authorities consider when setting penalties. The programme must be real and proven: documents with no practical application tend to carry little weight.
Do small and mid-sized companies need compliance?
They need a programme proportional to their size. Decree 11,129/2022 reduces the formalities required of micro and small businesses, but they are also subject to Law 12,846/2013 and are asked for evidence by larger customers in their supply chains.
Related matters
Other matters in this area
Does your company need to prove its integrity?
Tell us why: a tender, due diligence, entry into a regulated sector or an incident. We will show you where to start and what can be delivered first.