Could you prove that your staff is familiar with the company’s labor policies? Who verifies that they are being followed? Where are incidents and the measures taken documented?
Many organizations have protocols, policies, and procedures in place. The challenge comes later: keeping them up to date, communicating changes, assigning responsibility, and verifying their implementation.
A policy may have been approved yet remain unknown to a large portion of the workforce. Training may have been provided without a reliable record of it. A control may be listed in a document without anyone knowing when it should be implemented.
Social and labor compliance requires continuity: accountable individuals, defined processes, and evidence of what is being done. UNE 19604 provides a framework for organizing this work.
What is UNE 19604 and what is it for?
UNE 19604:2023, “Social and Labor Compliance Management Systems—Requirements with Guidance for Use, ” is a Spanish standard that establishes requirements and guidance for developing, maintaining, and improving a social and labor compliance management system.
Its purpose is to help prevent and manage compliance risks and foster a culture of compliance within the organization.
In practice, it helps answer four questions:
- What are the company’s obligations and commitments?
- Where might a breach occur?
- What measures are in place to prevent it?
- How can we verify that these measures are effective?
It is important to distinguish between three issues:
- Compliance with labor and Social Security regulations: This is mandatory, regardless of whether the standard is adopted.
- Implementing a system based on UNE 19604: In general, this is voluntary and allows you to organize compliance management.
- Certifying the system: This is an independent and optional assessment of its compliance with the standard’s requirements.
A company can use this framework to improve its internal management without seeking certification. It may also decide to certify the system when it wishes to obtain an external assessment of its performance.
UNE 19604 can be coordinated with other compliance systems, such as those based on ISO 37301 or UNE 19601. This allows for the sharing of management and monitoring processes while maintaining the specific scope of each system.
What Social and Labor Risks Should a Company Consider?
The first step is to identify the applicable obligations and the situations that may hinder compliance. For an initial assessment, here are some areas worth reviewing:
- Hiring: types of contracts, probationary periods, subcontracting, and potential cases of illegal labor assignment.
- Work Hours and Breaks: Time tracking, overtime, breaks, and digital disconnection.
- Compensation: calculation and payment of wages, compensation components, and compensation records.
- Equality and non-discrimination: recruitment, promotion, working conditions, and equality plans where required.
- Harassment prevention: preventive measures, response procedures, and training for responsible personnel.
- Collective rights: information and consultation with employees’ legal representatives.
- Social Security: enrollment, deregistration, and contributions.
- Communication channels: receiving and handling reports of potential violations, with appropriate procedures and safeguards.
- Third parties: contractors and subcontractors whose labor practices may pose risks or liabilities to the principal company.
The legal thresholds must be reviewed separately. For example, all companies are required to maintain a pay record, while equality plans are generally mandatory for companies with 50 or more employees, in addition to other cases provided for by law.
With regard to LGBTI issues, Royal Decree 1026/2024 sets forth the planned measures for equality and non-discrimination for companies with more than 50 employees, including a protocol to address harassment and violence.
Exposure varies depending on the type of business, size, applicable collective bargaining agreement, work sites, and how services are organized. A company with multiple shifts and locations will face different risks than one with a small workforce at a single location.
The risk map must reflect how the company actually operates.
A note on scope: UNE 19604 excludes occupational risk prevention. This area has its own legal framework and management standards, such as ISO 45001, although the two areas can be coordinated.
How to Move from Risks to a Management System
To put this approach into practice, link six elements together:
- Identify obligations. Determine which laws, agreements, and commitments affect the organization and how that information is kept up to date.
- Assess risks. Analyze where a noncompliance might occur, its potential consequences, and the measures already in place.
- Establish controls. Define specific actions: reviews, authorizations, verifications, communications, or training.
- Assign responsibilities. Clarify who carries out each action, how often, and who monitors the results.
- Retain evidence. Record what was done, when, who was involved, and the outcome.
- Review and improve. Verify the effectiveness of the measures and adjust them in response to incidents or changes.
UNE 19604 incorporates a risk-based approach and associated controls. This sequence allows for its implementation in day-to-day work.
For example, if an audit finds that a facility’s time log is incomplete, the finding must trigger an action with a designated person responsible and a deadline. Afterward, the implementation must be verified, and an assessment made as to whether the procedure needs to be changed.
Closing out the task is only part of the process. It is also necessary to understand why the problem occurred and what measures can prevent it from happening again.
A practical example: the harassment protocol
Let’s imagine a company with a protocol for preventing and addressing harassment. It has been approved and saved in a shared folder.
However, no one can confirm which version each person received, whether new hires are familiar with it, or whether those responsible for taking action know how to proceed.
Here’s how that document can be turned into an operational process:
| Step | Applied to the harassment protocol |
|---|---|
| Obligations | Identify the regulations, the applicable agreement, and the procedural requirements. |
| Risks | Lack of familiarity with the protocol, difficulties in reporting incidents, or handling cases without the necessary safeguards. |
| Controls | Communicate the protocol, incorporate it into the onboarding process, train those involved, and verify that communication channels are available. |
| Responsible Parties | Assign responsibilities for communication and training; designate the individuals or investigative body in accordance with the protocol; define oversight procedures. |
| Evidence | Approved version, communication records, training provided, and reviews conducted. |
| Review | Evaluate the implementation of the procedure and improve preventive measures based on the results. |
Communications received must be handled confidentially, with safeguards for all parties and strict access rules. Information regarding each case must be restricted to authorized individuals based on their roles.
In addition, it is advisable to separate general evidence of compliance—such as communication of the protocol or training—from the confidential documentation in the case files.
The result: the company can demonstrate that the protocol has been approved, communicated, and that the responsible individuals have received training. It also has the information needed to evaluate the protocol’s implementation and effectiveness.
Retaining evidence should help verify the process and protect individuals.
Who is involved: HR, compliance, and management
Social and labor management requires coordination across functions:
- Human Resources oversees and manages the processes related to hiring, onboarding, work schedules, compensation, and labor relations.
- The compliance function oversees the system and performs the necessary monitoring, with appropriate autonomy and resources.
- Management sets priorities, endorses policies, and allocates resources.
- Middle managers make day-to-day decisions that affect employees: shifts, overtime, leave, and work distribution.
The specific allocation of responsibilities will depend on each organization. Every process requires a person in charge, an oversight mechanism, and an escalation procedure. The participation of employee representatives must also be respected when appropriate.
A simple test can help identify gaps: if an incident arises tomorrow, is it clear who should take action, who they should report to, and who will verify that it has been resolved?
How Technology Can Help
When policies, controls, and evidence are managed through folders, emails, and spreadsheets, tracking can become overly dependent on specific individuals.
As the organization grows, duplicate versions emerge, pending tasks go unnoticed, and it becomes difficult to reconstruct what was done.
The right tool makes it easier to:
- Centralize policies and maintain their version history.
- Record your communication and any approvals, as applicable.
- Assign controls and monitor their implementation.
- Link actions to their supporting documentation.
- Manage communications with access permissions and traceability.
- Review pending tasks and identify delays.
At Ithikios, we understand operational compliance as the link between a company’s obligations and the actions that enable it to manage them.
The management of policies, controls, and documentation, along with the whistleblower channel, can support various processes within a social and labor management system, facilitating their organization and monitoring.
The software provides traceability. Its usefulness depends on the existence of clear criteria, assigned responsibilities, and individuals who execute and oversee the processes.
Where to Start: A Four-Question Assessment
You can start with a relevant area—such as working hours, equality, or harassment prevention—and answer:
- What obligations and commitments apply?
- What risks have we identified?
- What controls are in place, and who is responsible?
- What evidence is available to verify this?
Shortcomings typically take three forms: a preventive measure is missing; a control exists, but no one has been assigned to implement it; or the work is done without keeping a sufficient record.
Prioritize them according to their importance and turn the assessment into a plan with designated responsible parties, deadlines, and follow-up. Starting with one area allows you to make progress, although full implementation will require addressing the defined scope of the system.
The goal is for the company to know what it must do, to do it, and to be able to demonstrate it.
At Ithikios, we help you organize policies, controls, and documentation to ensure continuity in your compliance management. Request a demo to learn how we can support these processes with centralized, traceable management.
Frequently Asked Questions About UNE 19604
Is it mandatory to implement UNE 19604?
In general, adoption of the standard is voluntary. Compliance with applicable labor and Social Security regulations is mandatory. It is also advisable to check whether there are any specific contractual requirements for the organization.
Is UNE 19604 certifiable?
Yes. The system can undergo an independent audit and certification. Certification is optional: the standard can also be used to improve internal management.
What is the difference between UNE 19604 and UNE 19601?
UNE 19601 addresses criminal compliance. UNE 19604 focuses on social and labor compliance, including obligations that do not necessarily have criminal implications. Both systems can be coordinated while maintaining their specific scope.
Does it include occupational risk prevention?
No. The standard excludes this area, which has its own legal framework and management standards.
How does it relate to the whistleblower channel?
UNE 19604 includes requirements related to the whistleblowing channel. This can help identify potential social and labor law violations.
This use must be distinguished from the scope of protection under Law 2/2023: not every labor-related complaint falls under its purview. The law covers, among other cases, potential serious or very serious criminal or administrative violations. Therefore, it is necessary to coordinate the reporting channel with specific labor procedures.
Does this make sense for an SME?
Yes, by adapting the system to its size, business activity, and risks. The regulation was designed to be applicable to organizations of various sizes.
How long does it take to implement it?
It depends on the scope and the starting point. To estimate this, it’s advisable to review the obligations, risks, existing controls, and available evidence. Having approved policies helps, but you also need to verify their implementation and the system’s effectiveness.
*Article improved with the help of AI.
