What preventive compliance means
Compliance concerns organising fulfilment of obligations. Applied to OSH, it helps identify decisions that could depart from preventive requirements and how deviations can be detected, corrected and avoided. It is not simply a new label for storing risk assessments or a specialism that replaces the prevention service.
A code of conduct is one part of the system, communicating expectations about safety, respect, information and action. To be useful, it must connect with procurement, production, maintenance and contracting. A commitment not to accept uncontrolled risk needs a process allowing work to stop, the problem to be resolved and activity to resume under verified conditions, including when delivery pressure exists.
Mapping duties and critical decisions
The map starts with activities, sites, exposed people and applicable rules. Legal duties, contractual commitments and voluntary internal rules should be distinguished because their origins and consequences differ. A legislative list disconnected from operational decisions neither demonstrates compliance nor helps prioritise controls.
A practical structure connects each duty to an accountable person, expected evidence, a check and a response to non-compliance. Buying machinery, introducing a contractor and changing shifts may require different verification. Review responds to significant changes in activity or regulation, without inventing a universal expiry date for risk assessments. Updating a date alone does not update the assessment’s substance. Information gaps needing technical or legal judgment should remain visible before decisions are authorised.
Useful content in a conduct code
A preventive code should explain understandable behaviours: reporting hazards, avoiding manipulated records, respecting protective measures and taking reports seriously. It should also specify expectations for those assigning resources and targets, rather than placing all apparent responsibility on the person performing the task.
Everyday examples help: an urgent delivery does not justify omitting a check; an accident indicator does not authorise hiding an incident. Examples should suit the site and its languages. The code cannot reduce statutory rights or automatically make every error a disciplinary offence. Consequences require examination of facts, applicable rules and safeguards. Training should enable people to decide what to do in practice rather than merely collect acknowledgement signatures.
Responsibilities, independence and participation
Management should assign responsibilities and resources consistent with the actual organisation. Compliance personnel may coordinate monitoring and escalation while prevention professionals perform functions within their competence. External advice does not remove employer obligations or make the adviser automatically liable for every outcome.
Worker consultation and representation retain their own role. A compliance committee does not replace prevention representatives or the health and safety committee where required. Arrangements should explain how a significant risk reaches someone able to resolve it, how conflicts of interest are managed and who verifies that a measure marked complete actually works. Accountability requires access to information and decision-making capacity, not simply a name entered in an organisational chart.
Reporting channels and protection scope
Organisations need accessible routes for reporting hazards, incidents and irregularities, with understandable responses. In Spain, Law 2/2023 regulates internal information systems and whistleblower protection within its material, personal and entity scope. Every preventive suggestion or interpersonal disagreement does not automatically fall within that regime, even where another procedure must address it.
Design should distinguish urgent operational warnings, alleged breaches and other requests without using classification to leave a hazard unattended. An internal channel does not prevent recourse to competent external routes, including the Spanish labour inspectorate. A situation requiring immediate protection must not wait for a compliance investigation to finish. Those receiving reports need to understand this distinction and act on the safety issue promptly.
Confidentiality and information handling
Reports may contain identities, allegations, health information and third-party documents. Purpose, legal basis, necessary access and retention must be defined under the applicable framework. A shared platform does not justify every manager reading complete case files or copying clinical information into a general dashboard.
An internal information system governed by Spain’s Law 2/2023 must follow the specific rules in Article 32.2, including immediate deletion of received special-category data without recording or processing it in that system. The channel must not become a clinical archive. Health documentation needed for a different lawful purpose requires its own authorised route and restricted access.
Confidentiality does not mean promising absolute secrecy against every lawful proceeding. Limits and routes should be explained without disclosing unnecessary information. Data needed to correct working conditions can be separated from personal investigation details. Retention periods need justification rather than keeping everything indefinitely “just in case”. Access permissions should reflect actual roles, and aggregate learning should not reveal information that allows an individual to be identified unnecessarily.
Ombudsperson or internal listening role
A company may voluntarily create a listening, mediation or guidance role, sometimes called an ombudsperson or worker advocate. Its usefulness depends on mandate, independence, accessibility and trust. There is no universal duty described here requiring every company to establish such a role, and public powers or legal representation of workers cannot be presumed.
Design should clarify what it receives, what it refers elsewhere and the limits of confidentiality. It does not replace a legally required internal-system officer, preventive representation or occupational health services. Nor should it impose mediation in every situation or make access to authorities conditional on using the role first. Results concern issues properly directed and resolved, not consultation counts alone.
Investigation, response and verifiable correction
Receiving a report requires considering immediate protection and assigning review without conflicts of interest. Investigation distinguishes verified facts, statements, documents and hypotheses. Affected people retain applicable safeguards: an allegation is not a conclusion, and insufficient evidence does not itself demonstrate bad faith by the reporting person.
Measures may address technical causes, organisation, training or supervision, with accountable owners and subsequent checks. Administrative case closure should be distinguished from effective risk closure. Sending a response does not prove a protective guard has been repaired. Lessons may be shared in aggregate without unnecessary identities or details. Outstanding actions should remain visible until effectiveness has been verified rather than disappearing when the case management record is closed.
Procurement, contractors and performance pressure
Preventive compliance needs to appear in decisions that create exposure. Procurement requires equipment and service criteria; production must understand operational restrictions; contracting must anticipate coordination with concurrent businesses. A clause requiring “compliance with all legislation” does not demonstrate that a particular interface has been checked.
Urgent changes can follow a proportionate review process identifying outstanding conditions before execution. Incentives also need review: rewarding only an absence of accident reports may encourage underreporting. People should be able to report problems involving suppliers or supervisors without depending exclusively on the person whose decision is questioned. Clear correction and escalation routes help ensure that commercial commitments reflect preventive information before unsafe delivery conditions are imposed.
Voluntary standards and legal liability
ISO 37301 provides a compliance-management framework; adoption or certification is not an administrative or judicial determination of OSH compliance. An audit should explain scope, evidence and limitations. Legal duties not established by the applicable legal system should not be attributed to a voluntary standard.
Under Spanish criminal law, attribution requirements and consequences depend on the offence and facts. Automatic criminal liability of every legal entity for any preventive breach cannot be assumed, nor automatic exemption through a code or organisational model. Corporate, individual, administrative, civil and social-security responsibilities require distinct analysis. This article does not determine a particular case or replace professional assessment of established circumstances. Actual control performance matters more than the label attached to the programme.
Hypothetical example of a bypassed guard report
A worker reports being instructed to use a machine with a bypassed guard to recover a delay. The organisation first addresses the dangerous condition through preventive procedures rather than waiting for the investigation to close before protecting people. In parallel, a team without a conflict of interest examines the instruction, context and evidence.
Correction may include repair, target review and changes to the authorisation process, followed by verification. Information is provided through appropriate routes without unnecessary personal disclosure. This hypothetical example shows how compliance connects reporting to material decisions. It does not presume a criminal offence, sanction or the reporting person’s exact legal protection in advance; controlling the risk need not await a liability conclusion.
Indicators of effectiveness and their limits
Suggested indicators include risks corrected with verification, critical decisions reviewed before execution, response to urgent situations and recurring causes. These are proposed measures, not certification requirements or legal thresholds. Counting signed codes measures distribution rather than understanding or application in difficult decisions.
More reports may indicate greater trust, while fewer may reflect silence or lack of awareness. Sites should not be judged only by complaint volume. Management review needs examples of functioning controls, detected failures and outstanding actions, with proportionate and anonymised information where appropriate. The objective is to change conditions and decisions while preserving rights, not create a flawless-looking file. Responses must also reach the people responsible for applying the resulting changes.
Frequently asked questions
Does a conduct code replace the prevention plan?
No. It connects with preventive organisation and measures without replacing assessment, planning, training or statutory participation.
Is every OSH report protected by Spain’s Law 2/2023?
Not automatically. Scope and conditions must be checked, even where the hazard or request must be addressed through another route.
Is an internal worker advocate mandatory?
There is no universal obligation under that title. It may be a voluntary role with clear functions and limits, without replacing legally required bodies or officers.
Does compliance certification prevent criminal liability?
Not automatically. The applicable regime, actual control performance and facts matter; a certificate or code does not decide the legal outcome.
