Anti-corruption Maturity Model Post Assessment

1 Anti-corruption Maturity Model post Assessment Oversight Resources Risk Assessment Policy Statements Third-party Due Diligence Controls & Monitoring training Level 4 - Optimized Specific senior-level executives with appropriate authority, autonomy, and resources are responsible for oversight and implementation of the Anti-corruption compliance program. Compliance is included in corporate budget as a separate line item. External resources are consulted regularly on emerging issues and changes to mitigate their risks. Commensurate with the organization s size, industry, country, and the nature of transactions, it re-evaluates annually revenue, market share, payments to governments, payments to agents, time and expense spending, market share, and other factors for each country in which it does business.

2 A comprehensive compliance program that includes roles and responsibilities throughout the organization is documented and presented in all applicable languages. External service providers conduct background checks on third parties and formal due diligence procedures are in place, including merger and acquisition activities. Due diligence on existing third-party relationships is re-performed periodically. Compliance metrics are a significant measure for management s bonus plan. Testing of the achievement of these metrics is performed regularly and is evidenced in workpapers. Examples of metrics include the percentage of employees who have received FCPA/ethics training , percentage of third-party partners who have signed ethics statements, and ethics/ corruption -related incidences.

3 training is provided to board members, all employees in all areas exposed to corruption risk, and to significant business partners such as agents, vendors, and consultants. Level 3 Advanced Middle managers are responsible for the compliance program within their areas of responsibility. Compliance-related expenditures are included in budgets of the legal, internal audit, or risk management departments. A separate Anti-corruption risk Assessment is based on empirical metrics at the country/regional level. The company s code of conduct is communicated in the local languages of all subsidiaries, and employees sign annual certifications. Key provisions are included in contracts with significant business partners.

4 Due diligence is performed on new third-party business partners where a heightened level of Anti-corruption risk exists. Third-party contracts include audit rights that are exercised. Annual compliance certifications are required from significant business partners. Disciplinary procedures for policy violations are prompt. training covers company policies and procedures, instruction on applicable laws, and case studies. Level 2 Established Delegated to one or two individuals, usually in the legal or internal audit departments. Financial resources are devoted to compliance activities on an as-needed basis. Included in corporate-level enterprise risk management.

5 A policy statement that strictly prohibits bribes and facilitation payments is included in the company s code of conduct, ethics policy, or employee manual. Due diligence performed on third parties is limited to questionnaires that are not verified. Controls exist and are routinely monitored for transactions with foreign governments and officials; third parties; gifts, travel, and entertainment; donations; and facilitating and expediting payments. training is provided to a limited number of senior-level employees. Level 1 Basic Management is committed to anti -bribery but not at the expense of revenues and profits. Corporate budget does not include a line item for compliance.

6 Limited or nonexistent. Strongly worded Anti-corruption policies are not tested to ensure compliance. Nonexistent. Limited to policy statements. No verification that controls have been implemented. Limited or no Anti-corruption training . 17 12 15 18 11 21 13 68 48 60 72 44 84 52 47 31 46 66 18 67 33 Rating Note: Boxes highlighted in yellow indicate where the organization scored for each component.