IACA Compliance Benchmark Questionnaire

Transcription

1 27 June 2018 Reference No.: IACA-2018-CCA IACA Compliance Benchmark Questionnaire This questionnaire has been prepared in the context of the IACA Compliance Benchmark Project. It is addressed to private and public sector businesses headquarters and contains 82 questions under the following four sections. 1. Background information 2. The Company s compliance organization 3. Key components of the Company s anti-corruption compliance program 4. The anti-corruption compliance program monitoring and reporting system Please note that the present document is for information purposes and that data may be inputted only through the Project s dedicated online tool. The online tool and this document contain exactly the same questions and this document may thus be used to prepare the online submission. Companies and individuals who are not already part of the Project and who would like to join are kindly invited to contact the Project Team at the following address: compliancebenchmark@iaca.int. All questions, comments, or suggestions concerning the Project or this questionnaire may also be shared at the same address. Thank you very much in advance for your support and commitment to improving knowledge in the field of corporate compliance. The Project Team

2 Section 1 Background information 1. Position in the Company of the person filling in the questionnaire Answer: [position single choice] - Chief compliance officer - Compliance officer - Chief legal officer - Other [please specify] [NOTE : For this question and all following questions, it is always possible to answer: I do not know the answer or do not wish to answer ] 2. In what country are the Company s headquarters located? 3. What is the Company s main sector of activity? Note : For sectors of activity, we are using, for convenience sake, the firstlevel categories of the North American Industry Classification System (NAICS). In case of doubt, please refer to : Answer: [names of country single choice ] Answer: [sectors of activity single choice ] - 20 choices corresponding to the bold titles of the NAICS classification 4. Does the Company have other sectors of activity that you would like to mention? (Multiple choice is possible) Answer: [sectors of activity multiple choice ] - 20 choices corresponding to the bold titles of the NAICS classification 5. Is your Company a state owned enterprise? Note : For purposes of this question, state owned enterprise means a company with 50% or more of share capital or voting rights held directly or indirectly by one or more national or local governmental authority. 6. Is part or all of your Company s share capital traded on one or more stock markets? Note: Answer yes only if equity is publicly traded. 7. Approximately how many people are employed by the Company worldwide? Answer: [figure ranges single choice ]

3 8. What was the Company s consolidated turnover in your last fiscal year (in USD equivalent)? 9. In approximately how many countries does the Company currently operate? 10. What was the percentage of the consolidated turnover generated in countries with a Transparency International Corruption Perception Index of 50 or below, in your last fiscal year? 11. Is there any other background information that you would like to share? 12. Is there any comment that you would like to share with the Project Team concerning the questions of this Section 1? etc by 1000 until then: etc by 5000 until then by until Answer: [figure ranges single choice ] 0-50 million million million etc. until 901 million to 1 billion 1-10 billion billion etc. until 600 billion finish with : more than 600 billion Answer: [figure ranges single choice ] etc. until Answer: [percentage ranges single choice ] 0-5% 6-10% etc. 3

4 Section 2 The Company s compliance organization Subsection 2.1 The compliance organization generally 13. Which of the following matters are within the scope of employees who you would refer to as part of the Company s compliance organization? (Multiple choice is possible) Note: This question and other questions of this Subsection 2.1 refer to the compliance organization generally. Answers in this subsection should cover compliance functions at Headquarters level, as well as at regional, country or sectorial level. More specific questions on the compliance organization at each of these various levels will be asked later on in the questionnaire in Subsections 2.2 to What type of activities do such employees perform on a regular basis? (Multiple choice is possible) 15. What is the overall budget of the compliance organization for the current year (in USD equivalent)? Answer: [multiple choice] Ethics and professional conduct issues Corruption Competition and anti-trust Export control and international sanctions Money laundering Defrauding the Company Data privacy protection Sectorial regulation compliance Quality assurance Environmental responsibility and sustainable development Human rights and gender equality Workplace health and safety Capital markets law compliance (adhoc disclosures, directors dealings, etc.) Other (please specify) Answer: [multiple choice] Compliance risk mapping Awareness raising and training Drafting, amending and supervising implementation of basic documents (code, rules, procedures, etc.) Monitoring effective compliance to rules and procedures Piloting the design and roll out of compliance-related IT tools Receiving alerts or other warnings of potential violations Investigating alerts or other warnings of potential violations Participating to remediation of proven violations Third-party due diligence and risk management Participating to M&A related compliance due diligence and decision-making process Periodic reporting on the compliance program implementation (KPIs, compliance dashboard, presentation to the board, etc.) Other (Please specify) Answer : [figure ] Note 1: Do not include employeerelated costs in this answer. Headcount information will be requested in specific 4

5 questions below in this questionnaire. Note 2: The budget figure should correspond, to the extent possible, to the perimeter of matters and activities that you have defined in the previous two questions. 16. What is the overall number of employees working full time in the compliance organization (at Headquarters, sectorial, regional, local or other level)? Answer : [figure single choice] Note : This question and the next one concern the total number of employees working in compliance functions in the Company as a whole. More specific questions on compliance headcount at various geographical and sectorial levels of the Company will be asked at a later stage of the questionnaire. 17. Please specify whether certain employees work part-time and what is the overall full-time equivalent number of employees working in the compliance organization (at Headquarters, sectorial, regional, local or other level)? Answer : - All employees work full-time in compliance functions, there is no parttime - There are both full-time and part-time employees working in compliance functions: 18. Is there any additional information or comment that you would like to share concerning the Company s compliance organization generally, its budget and headcount? The full-time equivalent headcount is: [figure single choice] Answer : [open] Subsection 2.2 The compliance organization at Headquarters level 19. Is there a dedicated compliance organization in the org chart at Headquarters level? 20. Is there a Group Chief Compliance Officer or equivalent? Note: In this and the following questions, equivalent should be understood as meaning a senior executive in charge of key aspects of anti-corruption compliance, irrespective of his or her job title. 21. If yes to previous question: Is this his/her sole function? 5

6 22. If no to previous question: What is his/her other function(s) (Multiple choice is possible) 23. How many years of overall professional experience does the Group Chief Compliance Officer or equivalent enjoy? 24. In what year was the Group Chief Compliance Officer or equivalent appointed in his/her current position? 25. According to the Company s organizational chart, who is the Group Chief Compliance Officer or equivalent reporting to (solid line)? Answer: [function multiple choice] - General Counsel, Legal Director or equivalent - Chief Internal Auditor or equivalent - Chief Internal Controller or equivalent - Chief Ethics Officer or equivalent - Chief Quality or Management System Officer or equivalent - Chief Risk Management Officer or equivalent - Other : [please specify] Answer: [figure single choice] Answer : [year single choice] Answer: [function - single choice] - Board of Directors, Committee of the Board, or equivalent - Ethics and compliance Committee or equivalent - Chief Executive Officer - Secretary General or equivalent - General Counsel, Legal Director or equivalent - Chief Internal Auditor or equivalent - Chief Internal Controller or equivalent - Chief Quality or Management System Officer or equivalent - Chief Risk Management Officer or equivalent - Other : [please specify] 26. According to the Company s organizational chart, what is the hierarchical distance between the Group Chief Compliance Officer or equivalent and the Group Chief Executive Officer? 27. According to the Company s organizational chart, does the Group Chief Compliance Officer or equivalent have direct access to the Board of directors, or a committee of the Board, or an equivalent governing body, should he or she so request? 28. How many employees work full time in the compliance organization at Headquarters level? Note: this question and the next one Answer: [distance - single choice] - No reporting to the CEO - N-1 - N-2 - etc.. Answer: [figure- single choice] 6

7 concern only employees working in compliance functions at Headquarters level. Employees working at regional, country or sectorial level should be reported at a later stage of the questionnaire. Please do not count twice the same employee (or employee time) in this question and in questions relating to regional, country and sectorial compliance officers. 29. At Headquarters level, please specify whether certain compliance employees work part-time and what is the overall full-time equivalent number of employees working in the compliance organization. Answer : - At Headquarters level, all employees work full-time in compliance functions, there is no part-time - There are both full-time and part-time employees working in compliance functions at Headquarters level The full-time equivalent headcount is: [figure single choice] Subsection 2.3 The compliance organization at business units level 30. According to the org chart, is the Company organized by business units or sectors? 31. If yes: How many business units or sectors exist within the Group? 32. Are certain compliance officers responsible for designated business units or sectors? 33. If yes: how many of them are acting full-time in such a sectorial compliance function? Note: employees (or employee time) already counted in questions relating to the compliance organization at Headquarters level should not be counted again in this question and in the following one. 34. At sectorial level, please specify whether certain compliance employees work part-time and what is the overall full-time equivalent number of employees working in the compliance sectorial organization? Note : Do not count here time spent by compliance correspondents, champions and/or members of a compliance network. Specific questions below deal with such network. An employee should be considered headcount of the Answer: [figure single choice] [figure single choice] Answer : - At sectorial level, all employees work fulltime in compliance functions, there is no part-time - There are both full-time and part-time employees working in compliance functions at sectorial level The full-time equivalent headcount is : [figure single choice] 7

8 compliance organization and his or her time counted here only if: (i) compliance functions are listed in his or her job description; (ii) part of his or her goal is to spend a set minimum amount of time for compliance ; and (iii) he or she has a reporting line to the Chief Compliance Officer. 35. In most cases, to whom do the sectorial compliance officers report directly (including power over compensation and/or budget)? [function of direct hierarchical superior single choice] - Head of sector or business unit or other employee reporting directly or indirectly (solid line) to the Head of sector or business unit - Group Chief Compliance Officer or other employee reporting directly or indirectly (solid line) to the Group Chief Compliance Officer - Other : [please specify] 36. Is there one or more networks of ethics and/or compliance correspondents or champions for designated business units or sectors or other specific parts of the company (other than geographically defined)? Note: network refers to employees who are not part of the compliance organization headcount but may be involved in certain activities at the request of the compliance organization, on top of their core duties. 37. If yes: What is the overall number of employees participating to such sectorial network(s)? Note: please do not count here again employees whose time has been already accounted for in the question relating to the number of full-time equivalent employees working in sectorial compliance functions. Answer: [figure- single choice] Subsection 2.4 The compliance organization at regional and local level 38. Are certain compliance officers responsible for designated geographical locations (regions, countries or other geographically defined perimeters)? 39. If yes: how many of them are working full-time in such a geographical compliance function? Note: employees (or employee time) already counted in questions relating to the compliance organization at Answer: [figure single choice] 8

9 Headquarters and sectorial level should not be counted again in this question and in the following one. 40. At geographical level, please specify whether certain compliance employees work part-time and what is the overall full-time equivalent number of employees working in the compliance geographical organization. Note : Do not count here time spent by compliance ambassadors, champions and/or members of a compliance network. Specific questions below deal with such network. An employee should be considered headcount of the compliance organization and his or her time counted here only if: (i) compliance functions are listed in his or her job description; (ii) part of his or her goal is to spend a set minimum amount of time for compliance; and (iii) he or she has a reporting line to the Chief Compliance Officer. 41. In most cases, to whom do the geographical compliance officers report directly (including power over compensation and/or budget)? 42. Is there one or more networks of ethics and/or compliance correspondents or champions for designated geographical areas? Answer : - At geographical level, all employees work full-time in compliance functions, there is no part-time - There are both full-time and part-time employees working in compliance functions at geographical level The full-time equivalent headcount is : [figure single choice] [function of direct hierarchical superior single choice] - Head of Country or Region or other employee reporting directly or indirectly (solid line) to the Head of Country or Region - Group Chief Compliance Officer or other employee reporting directly or indirectly (solid line) to the Group Chief Compliance Officer - Other : [please specify] Note: network refers to employees who are not part of the compliance organization headcount but may be involved in certain activities at the request of the compliance organization. 43. If yes: What is the overall number of employees participating to such geographical network(s)? Answer: [figure- single choice] Note: please do not count here again employees whose time has been already accounted for in the question relating to the number of full-time equivalent 9

10 employees working in geographical compliance functions. 44. Is there any comment that you would like to share with the Project Team concerning the questions of this Section 2? Section 3 - Selected metrics of the Company s anti-corruption compliance program 45. Does the Company have a Code of conduct or other high-level document setting prohibitions and principles with respect to corruption? 46. If yes: is this Code meant to be formally acknowledged by all new employees upon onboarding (by signature or click)? 47. What is the percentage of current employees who have actually performed this initial acknowledgement of the Code? 48. Is Code awareness meant to be periodically re-certified by all employees? 49. If yes : What is the periodicity of this re-certification? 50. What is the percentage of employees who have actually performed periodic recertification of the Code for the last full certification period? 51. Does the Company perform as a matter of policy specific and periodic anti-corruption risk mapping(s)? 52. If yes: What is the periodicity of this risk mapping? 53. Is such risk mapping performed in one or more geographical locations, in addition to, or coordination with, Group-level risk mapping? 54. If yes: In how many locations has such regional or local risk-mapping exercise been performed during the last full risk-mapping period? Answer: [percentage ranges single choice] 0-5% 6-10% etc.. Answer: [periodicity single choice] - Periodicity shorter than a year - Periodicity equal to a year - Periodicity longer than a year Answer: [percentage ranges single choice] 0-5% 6-10% etc.. Answer: [periodicity single choice] - Periodicity shorter than a year - Periodicity equal to a year - Periodicity longer than a year Answer: [figure ranges single choice]

11 etc. until What is the overall number of risk items or hypothetical scenarios that have been included in the last anticorruption risk map produced at Group level? 56. What is the overall percentage of Company employees who have completed an ethics and/or compliance e-training during the last completed yearly period? 57. What is the overall percentage of Company employees who have completed a face-to-face ethics and/or compliance training during the last completed yearly period? 58. How many face-to-face ethics and/or compliance trainings or formal addresses have been given by members of the executive committee (or equivalent) in the Group during the last completed yearly period? Note: Trainings and addresses given at subsidiary level by members of the relevant Group or subsidiary governing bodies should also be counted here. 59. What is the overall number of integrity due diligence reports that have been realized (concerning clients, intermediaries, suppliers or other third parties of the Company) during the last completed yearly period? Note 1: This question concerned both due diligence reports realized internally and those that have been outsourced to a specialized provider. Note 2: Please sort by level of due diligence. Levels of due diligence should be understood as follows: - Light: due diligence based on automated database processes - Standard: due diligence based on professional judgment of data such as: administrative and judicial records, media and other publicly available sources of information - Enhanced: due diligence implying specific field work and/or the use of investigative or forensic techniques Answer: [figure ranges single choice] etc. until Answer: [percentage ranges single choice] 0-5% 6-10% etc.. Answer: [percentage ranges single choice] 0-5% 6-10% etc.. Answer: o o [Figure] Or : [This figure is not available] Number of due diligence reports: - Light due diligence: o Number realized internally : [number or : This number is not available ] o Number outsourced: [number or : This number is not available ] - Standard due diligence: o o Number realized internally: [number or : This number is not available ] Number outsourced: [number or : This number is not available ] - Enhanced due diligence: o o Number realized internally: [number or : This number is not available ] Number outsourced: [number or : This number is not available ] 11

12 60. Is there any other metric of the compliance program that you use for internal reporting purposes and consider particularly meaningful of the activity or impact of the Compliance organization? 61. If yes: Please explain the nature of such metric(s) 62. Is there any comment that you would like to share with the Project Team concerning the questions of this Section 3? Section 4 - The anti-corruption compliance program monitoring and reporting system 63. Does your company have a whistleblower policy? 64. Has one or more dedicated ethics and/or compliance hotline been set up? 65. If yes: Is this hotline operated internally or is it outsourced? 66. Does such hotline allow for reporting by third parties? 67. Does such hotline allow for anonymous reporting? 68. In how many languages is this hotline available? 69. How many reports were made through the hotline during the last completed yearly period? 70. Out of those, how many were not followed up upon by the Compliance Organization after preliminary review because they were deemed manifestly unfounded or irrelevant to the Compliance Organization? 71. Out of all integrity-related cases that have been investigated internally, how did the case arise? Note 1: internally may include assistance of forensic, legal or other service providers, as long as the Company controls the investigation process. Answer: - Yes, and it is publicized internally and externally - Yes, and it is publicized only internally - No Answer: [Internal/Outsourced] Answer: [figure] Answer : [figure] Answer : [figure] Answer: [percentages for each item] - Employee, former employee or thirdparty reporting through the dedicated hotline: [ ]% - Employee, former employee or thirdparty reporting through another channel: [ ]% - Internal review or audit: [ ]% - Automated data analysis system: 12

13 Note 2: Please ensure that the sum of the percentage figures that you enter is equal to Are you in a position to assess the cumulated monetary stake of all integrity-related cases that have been investigated internally during the last completed yearly period? Note 1: Monetary stake should be understood as meaning the maximum estimated value of the bribe potentially paid or of any other potential improper payment or misappropriation involved in the investigated case. Note 2: This question refers to alerts and incidents investigated, irrespective of whether they have finally been substantiated or not. 73. If yes: Would you say that this cumulated monetary stake is higher or lower than the previous year? 74. Does the Chief Compliance Officer, or any functional equivalent, prepare and communicate as a matter of policy a formal and periodical report on the compliance program implementation and operation? 75. If yes: To whom does the Group Chief Compliance Officer or equivalent communicate this report? (Multiple choice is possible) [ ]% - Administrative or judicial investigation: [ ]% - Media coverage: [ ]% - Other: [ ]% - [Please specify] Answer: [much higher/somewhat higher/roughly equivalent/somewhat lower/ much lower] Answer: [function multiple choice] - Board of Directors, Committee of the Board, or equivalent - Ethics and compliance Committee or equivalent - Chief Executive Officer - Executive Committee - Other: [please specify] 76. What is, as a matter of policy, the periodicity of this formal communication? Note: In case of communications to multiple bodies, with different periodicities, select the shorter periodicity. 77. Did the Company evaluate the corporate culture, in relation to integrity, through employee surveys or other means, during the last 12 months? Answer: [periodicity single choice] - monthly - quarterly - semestrially - yearly - period longer than a year - other: [please specify] 13

14 78. If yes: May the results of this evaluation be compared to those of a previous one? 79. If yes again: Based on this comparison, would you say that the corporate culture has improved, in relation to integrity? 80. Is there any other information concerning the Company s anticorruption compliance programme monitoring and reporting system that you would like to share? 81. Is there any comment that you would like to share with the Project Team concerning the questions of this Section 4? Answer : [Yes, very much / Yes/ Not significantly] 82. Thank you very much for taking the time to fill in this questionnaire. Is there any additional information or comment that you would like to share with the Benchmark Project Team? à Submit 14