The Role of the Supervisory Board in Risk Oversight and Compliance Following the Reform of the Commercial Companies Code

For many years, the role of the supervisory board in Polish corporations was viewed primarily as the formal approval of financial statements. The reform of the Commercial Companies Code, effective as of October 13, 2022, combined with rising expectations from investors and regulators, has significantly expanded the scope of these responsibilities. Currently, the supervisory board bears documented responsibility for overseeing internal control, risk management, and compliance systems—not merely for the company’s financial performance.

Legal Basis for Supervision

Pursuant to Article 382 of the Commercial Companies Code, the supervisory board exercises ongoing oversight over the company’s activities in all areas of its operations. The phrase “in all areas” is crucial because it indicates that oversight of risk and compliance is an integral part of the supervisory board’s statutory mandate, rather than an optional extension of its powers.

What Has Changed as a Result of the 2022 Commercial Code Reform

Following the amendment, the supervisory board of a joint-stock company is required to prepare an annual written report, which must include, at a minimum, an assessment of the company’s situation, taking into account the adequacy and effectiveness of its internal control systems, risk management, compliance with standards or applicable practices, and internal audit. This marks a shift from passive oversight to active, documented assessment. The supervisory board cannot simply accept information from management; it must evaluate it and formally report on its findings.

In addition, the head of the compliance function should have direct access to the supervisory board and participate in board meetings when issues related to compliance or risk management are discussed. This requirement is of fundamental practical importance, as it prevents situations in which information regarding compliance risks reaches the board solely through the management board.

Division of Responsibilities Between the Management Board and the Supervisory Board

The implementation and maintenance of a compliance system remain the responsibility of the management board, which is accountable for the company’s day-to-day operations. However, oversight of this system is the responsibility of the supervisory board, which—following the reform of the Commercial Companies Code—has been significantly strengthened by new reporting requirements. It is important to note that the mere appointment of a person responsible for the compliance system—regardless of that person’s qualifications—does not relieve the supervisory board of its supervisory responsibility. The board cannot delegate its duty to the compliance officer and consider the matter closed.

Liability of Supervisory Board Members

A member of the supervisory board is required to exercise the due diligence expected of a professional and to act in good faith toward the company. This obligation is not breached if, while acting loyally, a supervisory board member remains within the bounds of reasonable business risk, relying on information, analyses, and opinions that, under the given circumstances, should be taken into account in a diligent assessment. It is important to note that the law does not require board members to be infallible, but rather to conduct a documented and thorough analysis before making a supervisory decision.

In practice, this means that a supervisory board that neither requests nor analyzes data on the effectiveness of the compliance system is significantly more vulnerable to liability than a board that has conducted such an analysis, even if a violation still occurred within the company. A documented, independent assessment provides significant support in demonstrating the proper performance of supervisory duties and is often a key element of the documentation confirming due diligence in the event of a liability dispute.

Practical questions the supervisory board should ask on a regular basis

• Does the chief compliance officer have direct access to the board, or does he or she communicate exclusively through the executive committee?
• What information does the board receive about whistleblower reports and compliance incidents—and how often?
• Is the budget for compliance and internal audit protected regardless of the company's current financial situation?
• Is the assessment of the adequacy of internal control systems based on an independent review, or solely on assurances from management?

Practical Recommendations

1. A regular, recurring agenda item on risk assessment and compliance should be included in the supervisory board’s meeting agenda, without limiting it solely to the annual report.
2. The Chief Compliance Officer should have a direct line of communication with the supervisory board, independent of the management board.
3. It is worth considering conducting an external, independent assessment of the adequacy of internal control and risk management systems, especially before preparing the mandatory annual report of the supervisory board.
4. The supervisory board’s decision-making process regarding risk oversight should be thoroughly documented, because it is the documentation—not the decision itself—that protects board members in the event of a dispute over liability.

FAQ

Does appointing a compliance officer relieve the supervisory board of its responsibility?No. Implementing a compliance system is the responsibility of the management board, while oversight of that system remains the responsibility of the supervisory board, regardless of who manages the system on an operational basis.

Does the supervisory board’s reporting obligation also apply to limited liability companies (sp. z o.o.)?The new, detailed reporting requirements introduced by the reform of the Commercial Companies Code (KSH) apply directly to joint-stock companies. In limited liability companies (sp. z o.o.), there is no analogous provision; however, members of the management board are required to act with due diligence, which in practice—especially in larger organizations or corporate groups—leads to similar expectations.

How can a supervisory board protect itself from liability for undetected compliance violations?First and foremost, through a documented, active, and regular assessment of the adequacy of control systems, because it is this assessment—and not the mere absence of violations—that constitutes evidence of due diligence.

Sources

1. Grant Thornton,The Role of the Supervisory Board: Assessing Internal Control, Risk, and Compliance –grantthornton.pl
2. Infor.pl,Compliance – The Role and Responsibilities of Supervisory Board Members–samorzad.infor.pl
3. Langas Group,New Compliance Responsibilities for the Supervisory Board Following the Reform of the Commercial Companies Code–langas.pl
4. LexLege,Section 2. Supervision – Commercial Companies Code–lexlege.pl
5. Lawbox Firm,Supervisory Boards in Joint-Stock Companies – Changes to the Commercial Companies Code–lawboxfirm.com

← All Analyses