Compliance Policy

The Compliance Policy describes how BOKU intends to ensure that laws, internal regulations and the Code of Conduct are complied with. It primarily governs responsibilities, advisory services and processes.

It is neither a new set of employment regulationsnor a set of disciplinary rules.

No.

The Compliance Policy expressly clarifies that it does not create any new obligations under employment law or service law.

The obligations continue to arise, in particular, from

• laws,
• the Austrian Universities Act,
• the collective agreement,
• employment agreements,
• guidelines and
• your employment contract.

The policy itself does not create any additional obligations.

No.

The Compliance Policy itself does not contain any provisions regarding sanctions.

Whether a particular incident has consequences under employment law depends exclusively on the applicable statutory, internal organizational, or collective agreement provisions. The policy expressly makes no statements regarding fault or sanctions.

No.

On the contrary.

The policy explicitly states:

Measures may not be used for control, performance or monitoring purposes.

Compliance is intended to have a preventive and supportive effect.

Yes.

The policy explicitly mentions academic freedom as a decisive principle.

Compliance must not unduly restrict research and teaching. 

For example:

• corruption prevention
• conflicts of interest
• secondary activities
• data protection
• information security
• research integrity
• publication integrity
• public procurement law
• subsidies
• discrimination
• Harassment
• abuse of power

The list is not exhaustive. 

The following, for example, are not included

• routine work organizational matters,
• performance evaluations,
• disputes under civil service law,
• personal conflicts that are not related to compliance.

The applicable procedures continue to apply to these matters.

No.

The policy does not establish a general reporting obligation.

If you wish to report concerns, you may do so through the existing reporting-system in accordance with the BOKU employment agreement on the implementation of a reporting-system.

The Compliance Officer

• advises,
• supports,
• coordinates,
• documents concerns,
• forwards to the competent authorities,
• organizes training courses.

He*she expressly has no powers of instruction, control, investigation or sanctions.

It

• accepts the request,
• assigns it to a risk area,
• documents the receipt,
• make a rough initial assessment,
• makes a recommendation on how to proceed,
• coordinates and forwards the request to the competent authority,
• interviews employees as needed as part of preliminary investigations to establish the facts.

It does not decide whether someone is "guilty" or what consequences follow. 

This classification serves exclusively for organizational processing.

It is

• no blame,
• no disciplinary evaluation,
• no legal assessment.

It only helps to select the appropriate procedure. 

Not the Compliance-Contact-Point.

The relevant authoritites (e.g. the rectorate or other competent bodies) act in accordance with the applicable legal procedures or internal organizational regulations. The Compliance- Contact-Point expressly does not replace these procedures. 

Yes.

The policy expressly requires

• confidentiality,
• compliance with data protection regulations,
• respect for procedural rights,
• proportionate documentation.

The policy stipulates that the Compliance-Contact-Point must have access to the information required for its tasks. This access serves exclusively to fulfil its legal and organisational tasks and must be carried out in compliance with data protection requirements. 

Note from the works council: This point is particularly sensitive. The concrete implementation must be based on the GDPR, the Data Protection Act and the participation rights of the works council.

Yes.

The policy stipulates that employees participate in the planned awareness-raising and training measures. The aim of these training courses is to provide support and prevention, not to assess performance.

The policy stipulates that the Compliance Officer must prepare regular reports on his*her activities to the rectorate and the Chairman of the Works Council, if necessary anonymised. In addition, the legal co-determination of the works council remains unaffected by the policy.

Assessment of the works council

From the works council's point of view, the new Compliance Policy contains several important clarifications for the benefit of employees:

• It does not create any new obligations under employment law.
• It is not an instrument of control or monitoring.
• It does not create any reporting obligations.
• It does not contain any investigative or sanctioning powers for the Compliance- Contact-Point.
• It respects academic freedom, existing procedures and the rights of participation of the works council.

These points create legal clarity and deliberately distinguish the compliance function from disciplinary proceedings under employment law. At the same time, it will be crucial that the following guidelines, processes and procedures consistently adhere to these principles and, where applicable, measures subject to co-determination are coordinated with the works councils in a timely manner.

That depends on exactly what the issue is. Not every issue at the university is automatically a compliance matter.

You can first contact the Compliance-Contact-Point if you are unsure whether a matter is related to compliance. The tasks of the Compliance-Contact-Point expressly include advising, initial classification and forwarding to the relevant authority.

Table: Exemplary list of concerns and responsible authorities 

 

 

 

Yes. 

The works council is an independent representation of the interests of employees. If you are unsure whether a matter is a compliance issue at all, what rights you have or which authority is responsible, you can contact the works council confidentially. The works council can advise you and support you in choosing the appropriate way forward. However, this does not replace the reporting-system if a formal report is to be made.

Universities enjoy a high degree of trust in society. Research, teaching and administration must be carried out in accordance with the law, transparently and with integrity. Good compliance rules help to prevent misconduct, identify risks at an early stage and provide employees with guidance when making difficult decisions.

At the same time, it is important for the works council to emphasise that compliance must not be confused with mistrust or excessive bureaucracy.

A good compliance culture does not mean that every decision becomes more complicated or that every activity must be documented. Rather, it means:

• clear responsibilities instead of uncertainty,
• advice instead of sanctions,
• prevention instead of subsequent error correction,
• transparency instead of rumours,
• and support instead of control.

The new Compliance Policy expressly takes this idea into account. It makes it clear that it

• does not create any new obligations under employment law,
• does not introduce any monitoring or control instruments,
• does not create any new reporting obligations,
• respects existing responsibilities and procedures, and
• expressly upholds the freedom of research and teaching.