Criminal risk map: where your company could get into criminal trouble

Contents

• What is the criminal risk map?
• Why is it the first piece of compliance?
• How is it done?
• What happens if you don't have it?
• How Tranquilia generates it
• Frequently asked questions
• Official sources

What is the criminal risk map?

It is an analysis, area by area, of where your company is most exposed to an offence being committed. Not every offence affects every company: a construction firm has different risks (the environment, safety on site, corruption in public tenders) from a consultancy or a shop. The map puts that in writing and assesses which risk is high and which is low.

Think of it as the plan of the slippery areas: before laying down mats (the controls), you need to know where the danger is.

Why is it the first piece of compliance?

Because art. 31 bis of the Código Penal, when it describes what requirements an effective crime prevention model has to meet, starts precisely there: the model has to identify the activities in whose scope the offences it seeks to prevent may be committed.

Without that identification, the controls you put in afterwards will be placed at random: you can watch closely where there is no risk and not at all where there is. The map is what gives the whole model its sense.

How is it done?

A useful criminal risk map goes through these steps:

1. Know your activity: what you do, who you deal with (the public administration, suppliers, customers) and how the money moves.
2. List the possible offences that the Código Penal attributes to legal persons and that fit your activity.
3. Locate where each one could happen (purchasing, invoicing, contracting, waste...).
4. Assess the likelihood and the seriousness of each risk.
5. Prioritise: where controls are needed first.

What happens if you don't have it?

The risk map is not a document the authorities penalise you for not having. The problem is a different one: without it, your compliance model does not meet the first requirement of art. 31 bis, and therefore it is no use as a shield. If an offence is one day committed in your company, a model with no risk map will hardly convince a judge that it was suitable and effective.

To put it plainly: not having the map does not cost you a direct fine, but it cancels out the defence that justifies doing everything else.

How Tranquilia generates it

Tranquilia starts from the criminal risks that are typical of your sector and proposes the map with the areas of exposure already identified, for you to review and adjust to your company. It stays connected to the rest of the model (code of ethics, disciplinary rules), so that the controls rest on real risks.

Frequently asked questions

Does a small company have criminal risks?

Yes, though different ones and often fewer. Tax offences, money laundering through cash payments, or corruption in dealings with the public administration can affect an SME too. The map is there precisely to see which ones really apply to you and which do not.

Is the risk map the same as the occupational risk assessment?

No. The occupational risk assessment (Ley 31/1995) is about the safety and health of workers. The criminal risk map is about offences that could be committed in the company's name. They are different documents, from different sets of rules.

How often is it updated?

When your activity changes, you enter new markets or new risks appear. An out-of-date map stops reflecting your real exposure and weakens the whole model.

Official sources

• BOE — Código Penal (LO 10/1995), article 31 bis.
• Fiscalía General del Estado.
• UNE 19601, a technical standard on criminal compliance management systems (guidance reference, not obligatory).

---

General information about the rules. It does not replace a lawyer's advice or an analysis of your specific case. If you have any doubts, check with a criminal law or compliance professional.