The case, explained

Supreme Court on 231 Liability and Evidence of Organizational Fault

6 min read · Updated September 2026 · Editorial oversight: Avv. Federico Papa

The Supreme Court, in an established line of jurisprudence, has reaffirmed the principle of the autonomy of organizational fault relative to the crime committed by a natural person. According to reports in specialized media such as NT+ Compliance and Il Sole 24 Ore, the decision marks a turning point in the management of organizational models, shielding companies from the risk of automatic liability for the actions of their executives. The case, originating from a complex reconstruction of information flows and safety protocols, clarifies how an entity may be exempt from liability even when a crime is proven, provided it demonstrates an adequate preventive setup. This article analyzes the evaluation criteria for the Organization and Management Model (MOG) and the distribution of the burden of proof between prosecution and defense, aspects that are clearly distinct from recent investigations into news events already covered in this column. Through our usual twin case, we will see how the principle of post-event prognosis and the concept of fraudulent evasion operate concretely in courtrooms to determine corporate guilt or acquittal.

Supreme Court on 231 Liability and Evidence of Organizational Fault

In brief

The article explores the Supreme Court's stance on corporate liability under Decree 231/2001, focusing on the autonomy of organizational fault. It analyzes how the adequacy of the MOG must be evaluated through post-event prognosis and discusses the Prosecutor's burden of proof in demonstrating organizational deficits, moving past the concept of automatic derivative liability for the entity. It includes a twin case featuring the column's characters to illustrate the practical application of these legal principles.

The fact
The case stems from the so-called Impregilo matter, a lengthy judicial process involving the company over alleged market manipulation related to press releases issued between 2003 and 2004. According to reports by outlets such as NT+ Compliance, the case concerned the dissemination of data regarding the subsidiary Fibe deemed untrue. The proceeding reached the Supreme Court, which had to determine whether the establishment of a crime by top executives (Chairman and CEO) automatically implied corporate organizational fault. The Supreme Court annulled previous convictions without remand due to the statute of limitations, while clarifying in its reasoning that 231 liability requires specific proof of organizational deficiency, distinct from the intent or negligence of the natural person. Other aspects related to recent news events are covered in dedicated articles within this column.
The rules at play
The reference legal framework is Legislative Decree June 8, 2001, no. 231.
1. Article 5 establishes the objective imputation criterion: the entity is liable if the offense is committed in its interest or advantage.
2. Article 6 governs crimes committed by top executives, providing an exemption if the entity proves it effectively adopted and implemented an Organization and Management Model (MOG) suitable for preventing offenses of the same type.
3. Article 7 concerns offenses committed by subordinates, where liability arises from non-compliance with direction or supervision obligations. The statutory consequences include heavy fines calculated in quotas and disqualifying sanctions, such as the ban on contracting with the Public Administration.
What the jurisprudence says
Supreme Court jurisprudence has clarified that organizational fault is an autonomous constitutive element of the offense. It is not enough for an executive to commit a crime; it must be shown that the entity failed to adopt the necessary organizational safeguards. Judges have introduced the method of post-event prognosis: the magistrate must mentally place themselves at the time of the offense and verify if the MOG was abstractly suitable. Furthermore, for crimes by top management, the entity must demonstrate the fraudulent evasion of the model, meaning a deliberate circumvention of protocols that makes the crime unpreventable despite the efficiency of controls. Recent legal trends also confirm that the burden of proving organizational fault lies with the Public Prosecutor, in accordance with the presumption of innocence.
The twin case
Meanwhile, in Roccamesta…
Gaio Sventura is the administrator of Sventura Meccanica, a gear manufacturing firm. To secure a major contract with Ditta Sempronio & Figli, Gaio fails to disclose a technical defect in some batches, constituting hypothetical fraud. Basim Casba, the quality control worker, had reported the issue via email, but Gaio deleted the communication without instructing the technicians. Nunzio Gavelio, the Public Prosecutor, launches investigations not only against Gaio but also against the company. Avv. Prudenzia Cavillo defends the entity, arguing that the MOG existed and was updated, but that Gaio acted by intentionally evading internal reporting protocols that should have blocked the sale. Judge Giusto Gavelio must assess whether the lack of cross-checking on Basim's emails is a model deficiency or if Gaio committed an unpredictable violation.
Warning: the practical case is a hypothetical educational reconstruction and does not correspond to the real story nor does it anticipate its outcome; any reference to real persons or entities is purely coincidental; the analysis is based exclusively on the regulations and guidelines cited and constitutes general legal information, not legal advice.
Step-by-step analysis
1. Qualification of the fact: the crime of fraud is among the predicate offenses that trigger entity liability.
2. Identification of interest: the omission allowed Sventura Meccanica to collect payment from Ditta Sempronio & Figli, constituting economic advantage.
3. Assessment of organizational fault: it is verified whether the protocol on the management of information flows between workers and management was suitable.
4. Burden of proof: it is up to Nunzio Gavelio to demonstrate that the email system was inherently fragile and that no effective Supervisory Body existed.
5. Defense of the entity: Avv. Prudenzia Cavillo must prove that Gaio acted with fraudulent evasion, bypassing otherwise valid protocols.
Possible outcomes
1. Conviction: if Judge Giusto Gavelio finds that the MOG was merely paper-based and did not provide an escalation procedure for Basim Casba's reports, the company suffers a pecuniary sanction.
2. Acquittal: if it emerges that the protocols were rigorosi and that Gaio had to consciously violate company rules to hide the email, the entity is acquitted for absence of organizational fault.
3. Exclusion of advantage: if it were proven that Gaio's action damaged the firm's reputation more than it enriched it, the entity's liability could fail due to the lack of the objective criterion.
From the twin case to the real case
Gaio Sventura's case illuminates the legal structure of major events like the Impregilo case: the battle is not just about individual fault, but about the robustness of the preventive system. In reality, the Supreme Court has clarified that there is no presumption of guilt for the company; the organizational defect must be rigorously proven. This principle remains fundamental to ensure that administrative liability does not become a form of hidden strict liability, protecting companies that invest seriously in compliance.
Meet the cast of the columnGaio Sventura and the other inhabitants of Roccamesta return in every practical case.Read their stories
Analysis drafted and verified with edit.legal
To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.
Try edit.legal AI
What it teaches professionals
1. Drafting the MOG must not be a copy-paste exercise, but must map decision-making flows and friction points between employees and managers.
2. The effectiveness of the Supervisory Body (OdV) is the heart of the defense: periodic documentation of controls is the only evidence to demonstrate implementation of supervision.
3. During the trial phase, it is essential to shift the focus from the individual's conduct to the abstract adequacy of protocols through technical expertise on corporate compliance.
4. Personnel training, as in Basim's case, must be tracked and verified to demonstrate that the company provided the tools to detect irregularities.

References: D.Lgs. 231/2001Art. 5 D.Lgs. 231/2001Art. 6 D.Lgs. 231/2001Art. 7 D.Lgs. 231/2001Art. 2637 c.c.

Editorial oversight: Avv. Federico Papa·ICAMUpdated 25 September 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction

Frequently asked questions

Is the entity always liable if the executive is convicted?

No, the entity's liability is autonomous. If the company demonstrates that it adopted a suitable MOG and that the executive acted by fraudulently evading controls, the entity can be acquitted even if the natural person is convicted.

Who must prove that the 231 Model is not working?

According to the most recent Supreme Court trends, it is up to the Public Prosecutor to prove the so-called organizational fault, demonstrating that the crime was made possible by a deficiency in the entity's protocols.

What are the risks for a company without a MOG?

In the absence of an organizational model, the entity cannot benefit from the legal exemption and risks high pecuniary sanctions and disqualifying sanctions, such as exclusion from public tenders.