Corporate Compliance Programs - Top Elements

Top 5 Elements of an Effective Compliance Program

1. Leadership

Tone at the Top

• Board of Directors

The Board of Directors has a key role to fulfill. The Board must ensure compliance policies, systems and procedures are in place and it should monitor implementation and effectiveness of the compliance program. The Board should receive periodic compliance briefings. 1. Top-Level, Top Down management which is committed to ethical conduct, compliance with all laws and foster a culture of ethical conduct and compliance.

• Ethics Committee and/or Audit Committee

• Group Executive

• Senior Management

Key Individual Roles

• Chief Compliance Officer

Authority??

• General Counsel

2. Risk Assessment

A risk assessment is designed to provide a big picture of your overall compliance obligations and then identify areas of high risk so that you can prioritize your resources to tackle these high risk areas first.

Risk Areas:

• Regulation Risk

• Business Opportunity Risk

• Pricing

• .Transaction/Accounting Risk

Risk assessments should be a regular, systemic part of compliance efforts rather than an occasional, ad hoc exercise. They should be performed periodically throughout the year. The should be performed by a group such as your Accounting and Finance, Internal Audit, Contracts, and Risk Management. The outcome of the risk assessment establishes the "Program Plan" for the upcoming period for the compliance and internal audit departments.

3. Standards and Controls

Levels of Standards and Controls

(1) Code of Conduct

Every company should have a Code of Conduct which should express its ethical principles. However, a Code of Conduct is not enough.

(2) Standards and Policies

Every company should have standards and policies in place that build upon the foundation of the Code of Conduct and articulate Code-based policies, which should cover such issues as bribery, corruption and accounting practices.

(3) Procedures

Every Company should then ensure that enabling procedures are implemented to confirm those policies are implemented, followed and enforced.

Note: FCPA compliance best practices now require companies to have additional standards and controls, including, for example, detailed due diligence protocols for screening third-party business partners for criminal backgrounds, financial stability and improper associations with government agencies. Ultimately, the purpose of establishing effective standards and controls is to demonstrate that your compliance program is more than just words on a piece of paper.

4. Training

A strong compliance program trains company officers, employees and third parties on relevant laws, regulations, corporate policies and prohibited conduct.

Measures

• Who is trained?

• How is the training conducted?

• How often?

5. Oversight - including monitoring, auditing and responses

Monitoring

A primary goal of monitoring is to identify and address gaps in your program on a regular and consistent basis.

Auditing

Auditing is a more limited review that targets a specific business component, region or market sector during a particular timeframe in order to uncover and/or evaluate certain risks, particularly as seen in financial records.

Remediating and Correcting

What are your remediation efforts? Your company should remediate problems quickly. A key concept behind the oversight element of compliance is that if a company is policing itself on compliance-related issues, the government will not have to do it for them. Remediation, then, is an important component of oversight. It is not enough to just gather information and identify compliance problems through monitoring and auditing. To fulfill this essential element of compliance, you also have to respond and fix the problems.

Ethics and Compliance Program Principles

1. Continual oversight 2. Establishment and maintenance of Code of Business Conduct (CoBC) and Corporate Framework (CF). 3. Establishment and maintenance of procedures that are proportionate to the compliance risks, the extent of its involvement in certain areas of compliance risk (bribery, USG contracting), size of the Group, and nature, scale and complexity of the Group. 4. Periodic, informed and documented assessment of exposure to criminal conduct by Group employees and, where appropriate, its suppliers, partners, and other third parties, with appropriate steps to design, implement or modify business ethics awareness, compliance program and internal control system to reduce the risk of criminal conduct. 5. Performance of appropriate due diligence on employees, including potential employees, or third parties who will perform services for or on behalf of the Group to mitigate risks of compliance with criminal laws and to ensure persons who have engaged in illegal activities, unethical misconduct, or conduct in conflict with the CoBC and CF are not promoted or hired to positions of management or other substantial authority 6. Periodic and practical communications of, and training on, the Group’s ethical standards, policies, procedures and ethics program, to employees and, as appropriate suppliers, partners and other third parties to ensure that the standards, policies and procedures are embedded and understood 7. Monitoring and auditing of business practices, policies, and internal controls for compliance with the CoBC and CF and to prevent criminal conduct 8. Periodic evaluation of the program’s effectiveness 9. Establishment, maintenance and continued publicized system of an internal reporting mechanism by which employees may report suspected instances of improper conduct and which encourages employees to make such reports. 10. Promoting or enforcing the program through incentives and disciplinary actions for improper and criminal conduct or failing to take reasonable steps to prevent or detect improper or criminal conduct. 11. Timely response to and disclosure of criminal conduct where appropriate/credible evidence exists.

Compliance Program Plan

Strategic • Establish annual USG Compliance Program Plan for management review and agreement • Establish Policy on Policies • Review existing policies and identify new policies (ie., Do we need a policy on a Contract Management System) • Establish annual Compliance Workshop o Institute and define this annual workshop/training • Enhance existing training plan, identifying SAI training, and other supplemental training needed. • Quarterly updates distributed no longer than 30 days after the end of a quarter • Revisit Leadership Team Charter and team members, making sure the proper people are attending, and meeting the objectives or re-defining objectives. Consider having a Compliance Communication/Group Discussion team in addition to the leadership team, or the need and success of a leadership team. • Establish USG Compliance assessment program • Institutionalize the USG Compliance “How To” and Guidance Manual

Tactical • Site Visits • Proactive in resolving DCAA open items and issues • Responding to BU requests for assistance, guidance, or advice on a timely basis The USG Compliance Program success is contingent upon: • Buy in from Management • Active participation, collaboration, and resources • Appropriate Budget for Compliance Workshop • Budget for travel • Other priorities not taking precedent