Compliance, ESG, and Sustainability

The Norwegian Transparency Act requires companies to carry out due diligence assessments related to fundamental human rights and decent working conditions within their own operations and throughout their supply chains.

Føyen has assisted numerous companies in understanding and implementing the obligations of the Act, including the development and review of policies, contract terms, codes of conduct, and more. We provide support with complex due diligence assessments, the establishment of systems to manage information requests, and guidance related to access to information requirements. Føyen’s experts stay up to date with the Consumer Authority’s enforcement practices and ongoing EU legislative developments concerning due diligence and sustainability reporting.

The ten principles of the UN Global Compact for responsible business set out fundamental requirements for accountability across value chains. These principles largely align with the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct. While the core of these principles is reflected in the Norwegian Transparency Act, the UN and OECD principles have a somewhat broader scope.

Many businesses have encountered customer demands to accept their Code of Conduct or similar documents. These are typically based on the principles of the UN Global Compact and OECD, and they establish minimum standards within value chains. Føyen provides assistance with drafting Codes of Conduct, as well as guidance on how to anchor these within the organization and implement them throughout the value chain. We also offer support with compliance audits.

Føyen’s experts stay continuously up to date on EU sustainability legislation. We can assist with assessing when the reporting obligations apply to different types of companies, explaining specific reporting requirements, and providing guidance on how to implement them in the company’s annual report and the board of directors’ report.

Føyen can also assist with gap analyses to identify discrepancies between a company’s current reporting practices and the CSRD requirements, and advise on how to adapt to the new obligations in a way that also creates strategic advantages.

Føyen can assist with the implementation, review, or enhancement of routines for anti-money laundering (AML) controls and Know Your Customer (KYC) procedures. A key foundation for this work is a thorough understanding of the legal requirements applicable to the business. The Norwegian Anti-Money Laundering Act covers not only money laundering but also the financing of terrorism. We also provide advice on how AML assessments can be conducted responsibly and how they should be documented in accordance with legal requirements. As the risk landscape is constantly evolving, businesses must regularly update their internal general risk assessments related to money laundering. These assessments are influenced by the market in which the company operates, the nature of the business itself, and the extent to which the company offers services that could be used for or contribute to money laundering.

Føyen assists clients with integrity due diligence (IDD) investigations. These assessments are essential to ensure that our clients have the necessary insight into their suppliers and business partners. IDDs can be conducted prior to entering into cooperation with a new supplier or partner and may also be relevant in connection with tender processes.

The scope and depth of an IDD must be tailored to the specific situation. We conduct searches using open sources and summarize the findings. In some cases, this may be sufficient; in others, the findings may warrant further investigation. When necessary, we collaborate with lawyers or advisors in other countries to access local information or better interpret the relevance of the information we have uncovered. Our goal is always to provide our clients with high-quality, relevant information tailored to the needs of each individual case.

Føyen has extensive experience assisting in complex matters involving communication with various public authorities. We place strong emphasis on maintaining a constructive and effective dialogue with supervisory bodies such as the Norwegian Data Protection Authority, the Consumer Authority, and the Labour Inspection Authority. Our approach ensures that our clients’ interests are protected in a professional and effective manner. Drawing on our experience, we provide tailored solutions that ensure compliance with applicable regulations and promote strong, cooperative relationships with public authorities.

Businesses are required to comply with a wide range of legal requirements and regulations across various areas. Føyen assists companies and organizations in developing systematic management systems to ensure that their activities are planned, organized, executed, and monitored in accordance with applicable laws, regulations, standards, or other rule sets. The purpose of internal control is to ensure that the business identifies the regulatory requirements it is subject to, pinpoints areas of risk, and documents that it operates in compliance with the relevant legal framework. Føyen provides support in mapping and establishing routines and policies, including the development of procedures for risk assessments, deviation handling, and continuous improvement.

Regulatory authorities have the power to impose fines for breaches of regulatory requirements. This includes, among others, the Norwegian Data Protection Authority and the Consumer Authority. For larger companies, the fines imposed have been substantial, and the level of fines for typical Norwegian businesses is also on the rise. Føyen has the experience necessary to assess whether there are grounds for reduction or cancellation of a fine and to advise on the most appropriate course of action. It is not uncommon for authorities to adjust the amount of a fine based on input received during the consultation period following a notice of decision. Føyen assists clients in responding to notices of decision and in the follow-up of any final decisions issued by supervisory authorities. We provide legal advice, draft responses, and manage communications with the relevant authorities.

A personal data breach is defined in the GDPR as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.” Such incidents must be handled properly within the organization in accordance with the GDPR and internal policies.

The handling of identified incidents must be documented, and it must be assessed whether the breach should be reported to other organizations, the Norwegian Data Protection Authority, and potentially to the affected data subject(s). Føyen assists organizations when privacy-related, information security, or cybersecurity incidents occur.

Legal rules related to the environment and climate have practical significance across a wide range of legal areas and strongly influence the legal standing of both individuals and legal entities. There is a growing expectation that organizations stay up to date with and comply with regulatory requirements to ensure the sustainable use of resources and the protection of the environment. Many companies are required to report on how their operations impact the environment and what measures they are implementing to limit or reverse negative environmental effects.

Compliance with environmental law also has a significant impact on reputation and market position, and both individuals and companies may be held liable for violations. Environmental law is complex and constantly evolving, with relevant standards varying across industries and countries. Staying informed about fundamental principles, applicable legislation, and legal obligations under environmental law is essential. Common issues include questions of liability and risk related to pollution and compensation for environmental damage, especially in connection with property or business transactions.

Føyen provides the necessary environmental law expertise to help identify potential environmental risks and ensure that both individuals and companies remain compliant in their operations.

The Construction Client Regulations (Byggherreforskriften) outline the obligations of a construction client in building or civil engineering projects. The purpose of the regulations is to ensure the safeguarding of safety, health, and the working environment (HSE) at construction sites. The scope of the regulations is fairly broad, and the HSE requirements apply not only to new construction and civil engineering projects but also to major maintenance work.

The regulations require the client to carry out thorough planning of the construction or engineering project and to ensure that HSE efforts are documented throughout the project’s duration. Føyen has extensive experience with the Construction Client Regulations and assists stakeholders in interpreting their specific obligations under the law. We help develop tailored procedures for clients, aimed at enabling forward-looking work on HSE and ensuring compliance with all legal requirements.

The Taxonomy is a regulatory framework that classifies whether investments can be considered sustainable and is part of the EU’s initiative for global sustainable development. Now implemented in Norwegian law, the framework defines criteria for investments’ contributions to, among other things, greenhouse gas reduction, circular economy, and biodiversity preservation. Additionally, companies subject to the CSRD are required to report sustainability information in accordance with the Taxonomy. Alongside the Taxonomy, banks and financial institutions offer green financing for projects that promote sustainable development.

Føyen assists companies in adapting to these rules through advisory services, sustainability reporting, and compliance support. With our expertise, your business can ensure compliance while also leveraging the opportunities provided by the Taxonomy.

Public procurement is subject to a range of regulatory requirements governing both the tender documents and contracts. For example, during the tender phase, climate and environmental considerations are generally required to be included as award criteria. However, designing these criteria in an effective way to ensure actual payment for environmental protection and emission reductions can be challenging. Contracts must include provisions regarding wages and working conditions, pensions, wage payments, regulation of subcontractors, and various health, safety, and environment (HSE) rules. Although these are regulatory requirements, they must be carefully drafted and regulated in each individual contract. In addition to the mandatory requirements that public contracting authorities must include, many choose to impose additional environmental and labor-related requirements to demonstrate social responsibility. This raises questions about which requirements can lawfully be included and in what manner. There is no free rein in this regard, and mistakes can have serious consequences, such as the cancellation of an ongoing tender or grounds for complaints and potential legal action after the tender process has concluded.

As ESG (Environmental, Social, and Governance) and compliance gain increasing prominence in society, there are stricter requirements to identify and analyze relevant environmental, social, and business ethics factors in the purchase and sale of companies. Regulatory authorities have tightened the legal requirements regarding corporate practices, and compliance factors significantly impact investor interest and the company’s reputation.

To secure long-term value in transactions and acquisitions, a thorough due diligence process focusing on ESG and compliance is therefore essential. Føyen facilitates the early identification of relevant risk factors during due diligence. We also assist in assessing the potential impact of these risk factors on the transaction.

Regulations on export controls and export bans, the Penal Code, the Anti-Money Laundering Act, the Transparency Act, and the Working Environment Act impose a range of obligations on businesses. To responsibly comply with these duties, companies must maintain up-to-date knowledge of the rules and implement routines that ensure compliance and adequate risk assessments in daily operations. Føyen assists with the development and updating of routines based on the latest regulatory knowledge, including assessments of the extent to which individual rules apply to the business. We also observe that foreign customers and partners increasingly require Norwegian companies to provide documentation of routines and compliance. For Norwegian businesses, it is typically both ethically and commercially prudent to establish anti-corruption routines and internal policies, even though Norwegian criminal law does not strictly require companies to do so.

Føyen’s experts conduct training courses for board members, executives, union representatives, and employees on a wide range of compliance-related topics. For example, we provide mandatory courses and workshops on HSE, construction client responsibilities, and specific safety regulations. We offer tailored solutions adapted to the company’s needs and the existing expertise within the organization.