PILOT PROGRAM RESULTS REPORT

Transcription

1 PILOT PROGRAM RESULTS REPORT FEBRUARY 2014

2 Table of Contents Executive Summary Key Findings Top Findings: CREATe Leading Practices for IP Protection Top Findings: CREATe Leading Practices for Anti-Corruption Leading Practices for IP Protection Overview Top 3 Findings The Deeper Dive: Interesting Highlights Scenarios of Companies in the Pilot What Companies Had to Say Leading Practices for Anti-Corruption Overview Top 3 Findings The Deeper Dive: Interesting Highlights Scenarios of Companies in the Pilot What Companies Had to Say About CREATe 31

3 EXECUTIVE SUMMARY In 2013, the Center for Responsible Enterprise And Trade (CREATe.org) launched a pilot of two new services, CREATe Leading Practices for IP Protection and CREATe Leading Practices for Anti- Corruption. CREATe Leading Practices is designed to help companies and their supply chain and business partners reduce counterfeiting, piracy, trade secret theft and corruption. This report on the results of the pilot highlights what companies are currently doing to manage and protect intellectual property and to prevent corruption and where they can improve and mature their practices. Overall, the results of the CREATe pilot underscore that there is a growing awareness often characterized by the adoption of written policy documents among company executives that the proper management of these two issues will be critical to their companies future growth and sustainability. However, the results also indicated that most companies are often not doing enough to move from rhetoric to action. The best policies will be of no use if not routinely followed. How can a company tackle such major issues such as IP theft and corruption? It is all about management systems. Many companies have contracts and other legal means to protect IP and prevent corruption. CREATe helps companies complement these legal mechanisms by putting specific, effective practices into place throughout their own organization and also among supply chain and business partners. We do this with CREATe Leading Practices, a threestep service available in Brazilian Portuguese, Chinese, English and Spanish. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 3

4 The service includes: The best policy document will be of no use if it is not routinely followed. Online Self-Assessment: measuring the existing systems in place to protect IP or prevent corruption. Independent Evaluation: a discussion with a CREATe expert evaluator to review the Self-Assessment, followed by a Summary Report with specific steps to mature systems. Improvement Guidance: a 200+-page Guide one for IP protection and a second for anti-corruption with step-by-step instruction on how to improve practices, along with sample documents, checklists and other resources; and as needed, training, elearning and advisory services. The CREATe Leading Practices Pilot In 2013, more than 60 companies participated in the CREATe Leading Practices pilot. Here is a snapshot: Size: companies ranged from mid-sized to large multinationals. Geographies: China, Taiwan, India, United Arab Emirates, Malaysia, Japan, Singapore, Brazil, Mexico, Germany, Netherlands, Poland, Australia and the U.S. Industries: aviation, automotive, information technology (IT), apparel/footwear, electronics, manufacturing, finance, education. Pilot scenarios: Multinationals (based in the U.S., China, India, Latin America and Europe) enlisted key suppliers and business partners to participate in CREATe Leading Practices. Mid-sized and large companies in emerging markets participated in CREATe Leading Practices to assess existing internal systems and processes for protecting IP or preventing corruption. Companies asked subsidiaries or regional offices to complete the service. Private Equity firms requested that their portfolio companies use CREATe Leading Practices to ensure systems are in place to prevent corruption internally and among third parties. Companies joined through the Stanford Initiative for the Study of Supply Chain Responsibilities and took the CREATe Leading Practices for IP Protection Self-Assessment to benchmark practices. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 4

5 Key Findings How well prepared are companies for tackling IP theft and corruption? For both IP protection and anticorruption, these categories include: Policies, Procedures & Records Compliance Team Quality of Risk Assessment Supply Chain Management Training & Capacity Building Monitoring & Measurement Corrective Action & Improvement For IP protection, there is one more process category: Security & Confidentiality First, it is important to understand how companies were assessed. CREATe identified the key process categories that make up an effective compliance program. Next, we assigned a level of maturity for each category, ranging from one, where there are no systems in place, to a five, where systems are sophisticated and ongoing. Each company first took a minute online Self-Assessment where they answered a series of questions to determine the maturity of the systems they currently have in place to manage IP and/or corruption risk. Next, about half of the companies participated in an Independent Evaluation, where a CREATe expert evaluator made an independent assessment of the company s system maturity through a discussion with company representatives and a review of relevant documents. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 5

6 Top Findings: CREATe Leading Practices for IP Protection Security and Confidentiality is the most mature process in IP protection. o Companies have historically had good physical security measures in place to protect intellectual property, and this proactive behavior has transitioned to having strong IT security as well, particularly as more assets are kept in digital form. o During the Independent Evaluation interviews, it became clear to many companies that they were really only focused on IT security and not the broader issue of IP protection. o Within IT Security, companies were aware of the need to use licensed software as one element of protecting IP. Monitoring and Measurement is the least mature process in IP protection. o Many companies focus on contractual terms as the primary means of protecting their IP, yet they do no post-contract monitoring to ensure compliance with contractual terms. o Companies are primarily reactive in their approach to IP protection, but they realize the need to become more proactive. Policies, Procedures and Records is a foundational process that needs improvement. o Most companies have some policies and procedures in place, but they are incomplete and tend to focus primarily on IT and physical security. o Procedures are lagging behind policies, making effective implementation difficult. Top Findings: CREATe Leading Practices for Anti-Corruption Policies, Procedures and Records is the most mature process in anti-corruption. o There are well-established, international guidelines for anti-corruption compliance that provide companies with guidance on establishing their own policies. o Even so, most companies do not have specific procedures to direct employees in following those policies. Many companies seem to hide behind their policy document and do not take the steps necessary to implement it. Risk Assessment and Training and Capacity Building are the least mature processes in anti-corruption. o Most companies perform no formal anti-corruption risk assessment before entering a new market or business partner relationship, but instead rely on the common sense and experience of their employees to understand when corruption risk exists. o Most companies do not train their employees on anti-corruption measures. This lack of training is directly tied to the low level of implementation seen in most companies. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 6

7 Anti-Corruption Compliance Team is a foundational area that needs improvement. o In many companies, no one has specific responsibility for anti-corruption compliance. As a result, these companies tend to be reactive and only respond to incidents that occur rather than proactively managing and mitigating their risk. o Even in companies where a person has responsibility for anti-corruption compliance, they are often not given the authority and resources necessary to implement an effective anticorruption program. Learn More: CREATe Leading Practices for IP Protection and CREATe Leading Practices for Anti-Corruption are now available for a fee that is cost-effective and affordable to companies regardless of their size, sector or location. For further details, info@create.org. Many companies seem to hide behind their policy document and do not take the steps necessary to implement it. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 7

8 Leading Practices for IP Protection

9 OVERVIEW In 2013, 37 companies participated in CREATe Leading Practices for IP Protection. These companies crossed diverse industry sectors aviation, IT, consumer goods, telecommunications and geographies, including Asia, Latin America, Europe and North America. Each company took an online Self-Assessment that measured the maturity of the company s IP protection program across the following process categories: Policies, Procedures & Records IP Compliance Team Quality of Risk Assessment Supply Chain Management Security & Confidentiality Training & Capacity Building Monitoring & Measurement Corrective Action & Improvement After the Self-Assessment, the majority of companies also participated in an Independent Evaluation that was conducted by a team of CREATe expert evaluators. Company representatives discussed their IP protection program with the CREATe experts, who also reviewed key documents. The process is designed to be collaborative and focused on shared learning. Following the Independent Evaluation, the company received a Summary Report featuring a benchmark report, insights on leading practices and priority recommendations for improvement. The company also received access to the 200+ page CREATe Leading Practices Guide to Improving Your Intellectual Property (IP) Program, which outlines specific steps for maturing systems, along with sample resources, such as Model IP Policies and executive communications, checklists and other tools. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 9

10 Pilot scenarios: Multinationals (based in the U.S., China, India, Latin America and Europe) enlisted key suppliers to participate in CREATe Leading Practices. Mid-sized and large companies in emerging markets participated in CREATe Leading Practices. Companies asked subsidiaries or regional offices to complete the service. Companies joined through the Stanford Initiative for the Study of Supply Chain Responsibilities and took the CREATe Leading Practices for IP Protection Self-Assessment to benchmark practices. Following is an overview of the results. CREATe Leading Practices for IP Protection The Rankings IP Protection Program: Global Average Self-Assessment vs. Independent Evaluation 6.0 Maturity Level Policies, Procedures & Records IP Compliance Team Risk Assessment Management of Supply Chain Security & Confidentiality Training & Capacity Building Monitoring & Measurement Corrective Action & Improvement Overall Score Maximum Self-Assessment: All Participating Companies Independent Evaluation: All Participating Companies CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 10

11 Looking at the data another way: Process Category Self-Assessment: All Participating Companies Independent Evaluation: All Participating Companies Policies, Procedures & Records IP Compliance Team Quality of Risk Assessment Supply Chain Management Security & Confidentiality Training & Capacity Building Monitoring & Measurement Corrective Action & Improvement Overall Score Notes Self-Assessment scores are typically higher than independent evaluation scores. This is true in virtually every type of evaluation. The Independent Evaluation scores provide a more credible view on the maturity of the IP protection program. A narrow gap between the Self-Assessment and Independent Evaluation scores indicates that the companies had a realistic understanding of their system maturity. A wide gap between the Self-Assessment and Independent Evaluation scores indicates that companies had a more limited understanding of the process. Often this was addressed during the Independent Evaluation call as the company gained a deeper understanding of the topic. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 11

12 Top 3 Findings Security and Confidentiality is the most mature process in IP protection. o Companies have historically had physical security measures in place and this proactive behavior has transitioned to having strong IT security as more assets have become electronic. o During the Independent Evaluation interviews, it became clear to many companies that they were really only focused on IT security and not the broader issue of IP protection. o Within IT Security, companies were aware of the need to use licensed software as one element of protecting IP. Monitoring and Measurement is the least mature process in IP protection. o Many companies focus on contractual terms as the primary means of protecting their IP and they do not do any post-contract monitoring to ensure that their business partners are complying with those terms. o Companies are primarily reactive in their approach to IP protection, but they realize they need to become more proactive. Policies, Procedures and Records is a foundational process that needs improvement. o Most companies have some policies and procedures in place, but they are incomplete and tend to focus primarily on IT and physical security. o Procedures are lagging behind policies, making effective implementation difficult. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 12

13 The Deeper Dive: Interesting Highlights Policies, Procedures and Records Based on assessments by the CREATe expert evaluators, 80% of participating companies either have few or no written procedures related to their IP protection policies. CREATe expert evaluators found that only 10% of the companies have policies covering all aspects of IP protection. IP Compliance Team CREATe s expert evaluators found that 40% of the companies have a cross-functional team that leads the implementation of their IP management, protection and compliance program but these teams tended to be more focused on IT security rather than broad IP protection. Based on the Self-Assessment, 51% of the companies believe that their senior management was actively committed to IP protection by mandating the creation of IP policies and the formation of an IP compliance team. The CREATe expert evaluators found only 25% were at this level. Companies are measured in all categories on a scale of 1-5 Level 1 Little or no awareness of 5 repeatable processes Mature system implemented internally and in supply chain: focus on all IP Scope and Quality of Risk Assessment Based on the Self-Assessment 40% of the companies believe their supply chain risk assessment includes possible misuse of others IP, such as software. However, CREATe evaluators found that only 10% of companies had such a comprehensive risk assessment. According to the CREATe evaluators, 45% of companies are completely reactive and conduct a risk assessment only if they suspect there may be an IP protection problem. Management of Supply Chain According to the CREATe evaluators, 55% of the companies do not conduct any due diligence on third parties related to IP protection before entering into a new contract. Based on the Self-Assessment, 62% of companies either do not communicate their IP protection expectations to supply chain companies or only include a reference to IP protection in the contract. CREATe evaluators thought this was true with 85% of the participating companies. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 13

14 Security and Confidentiality 70% have a high maturity level for IT security and 80% have a high maturity for physical security based on the review by CREATe evaluators. CREATe evaluators found that 45% of companies have a low maturity for trade secret protection with trade secret protection primarily handled by security guards and/or IT staff and not integrated into business operations. Training and Capacity Building Based on the self-assessment 70% of companies at least provide introductory training on IP protection as part of their new employee orientation. CREATe evaluators found that 75% of companies provide no IP training to supply chain members even those handling important IP. CREATe evaluators found that 75% of companies provide no IP training to supply chain members. Monitoring and Measurement 45% of companies do no internal monitoring for IP protection or only monitor in reaction to an incident the figure rises to 65% in looking at supply chain monitoring based on CREATe expert evaluators. Only 20% of companies consider a third party s IP protection program in their performance evaluation based on interviews conducted by CREATe expert evaluators. Corrective Action and Improvement Only 30% of companies routinely conduct IP protection reviews and have a process for fixing problems to reduce their recurrence and this tends to be focused on IT and physical security. CREATe evaluators found that 55% of companies either do nothing or rely on their supply chain companies to fix any IP protection problems - 35% provide help if asked. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 14

15 Scenarios of Companies in the Pilot Chinese Electronics Company: $14.2 billion annual revenue; 89,000 employees Situation: The company was beginning to develop more of its own IP and to expand globally. They were concerned about the ability of their key supply chain members to protect their IP and they also wanted to emphasize to their suppliers, customers and business partners the importance of IP protection and their commitment to it. Actions Taken: After receiving the initial assessment of the company s supply chain members, CREATe conducted an onsite workshop for key managers involved in IP protection and supply chain management. The company decided to ask additional supply chain members to participate in the CREATe program to measure and improve their IP protection management systems. We agree that a management systems approach to IP protection is effective. We are now building a holistic IP management system with key business units involved. Although we have had IP policies and a cross-functional compliance team, we have problems in implementing and executing the policies - this is where CREATe can help. We also think it is important for our suppliers to build a strong IP protection system and we are weak in managing supply chain risk. We appreciate CREATe s help to mature our suppliers IP protection programs. U.S. Electronics Company: $13.3 billion annual revenue, 90,000 employees Situation: In response to the challenges of a very large global supply chain, the company was seeking a way to reduce the risk of IP infringement both upstream and downstream. They asked 10+ of their key suppliers to participate in CREATe Leading Practices so that all parties could learn more about the current maturity of IP protection and collaborate to drive improvement. Based on the supplier evaluations, the high priority improvement areas were: Policies, Procedures and Records IP Compliance Team Training and Capacity Building Monitoring and Measurement We think that CREATe s focus on helping companies understand where they are and how to improve is the right way to go. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 15

16 Actions Taken: The participating companies have started to improve their IP protection programs. Several used the CREATe Model IP Policies as the basis for developing a more complete set of IP protection policies. It has been really useful to gain visibility into the IP protection programs of key companies in our supply chain. We think that CREATe s focus on helping companies understand where they are and how to improve is the right way to go. European Software and Business Process Outsourcing Company: $6.1 billion annual revenue, 68,000 employees Situation: The company had strong policies and procedures in place, but the focus was on IT security not overall IP protection. Monitoring was completely focused on IT security. There was little awareness among employees of the importance of IP and what employees needed to do to manage and protect it....create s approach has been perfectly fine. The program has been really, really useful for guiding our activities. Actions Taken: The IP protection leader developed a report to the executive committee on the need to broaden their IP protection program beyond IT security. The company also focused on integrating trade secret protection into the policies, procedures and employee training, and implemented an improved IP protection monitoring program to be more proactive. When we were initially asked to participate by our customer, we complained about too many initiatives from them. But CREATe s approach has been perfectly fine. The program has been really, really useful for guiding our activities. Chinese IT and Automotive Manufacturer: U.S. $4.2 billion annual revenue, 150,000 employees Situation: The legal department has primary responsibility for IP protection and primarily uses contracts for IP protection. The company is developing more of its own IP and needs to become more proactive in protecting IP in its supply chain. Physical and IT security are mature and sophisticated. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 16

17 Actions Taken: Through CREATe Leading Practices, the company recognized the need to extend IP protection outside of the legal department and beyond the focus on contracts. They looked to perform a risk assessment and develop an IP protection monitoring program. I appreciate the recommended actions that you have proposed. I agree that Scope and Quality of Risk Assessment and Monitoring and Measurement are the building blocks of an IP protection system. We do not conduct any regular assessments and audits. The CREATe program provides valuable scores and a benchmark. Chinese Integrated Circuit and Electronics Manufacturer: $85 million annual revenues, 950 employees Situation: The legal department has the primary responsibility for protection and primarily manages it through contracts. The company is developing more of its own IP and needs to become more proactive in protecting IP in its supply chain. They are also seeing increased pressure from major international customers to protect the customers IP. Physical and IT security is currently a mature area, but there is no overall IP protection management system. Actions Taken: The company started making improvements based on CREATe s recommendations. First, they started to provide IP training to their key subcontractors. Second, they now consider a third-parties IP protection system when they evaluate and select supply chain members. Third, they are building a cross-functional IP team to take responsibility for improving the overall IP protection management system. The report is very complete. It showed us the weakness in our IP management system and provided recommended actions. We have a better understanding of our current IP management system and the improvement plan to get started. The Guide is a great resource to help us implement the recommended actions. I agree that a sophisticated IP protection system will give us a competitive advantage. U.S. Precision Metal Part Manufacturer Situation: The Company manufactures precision parts for multi-national medical equipment, aerospace and electronics companies. The processes are based on highly sensitive technology some of which is patented and some considered as trade secrets. The company has a mature access-control process at their U.S. facility, but they do not have an overall IP protection management system. They are opening a company-owned factory in Mexico. Due to the nature of their business, they have a very sophisticated quality management system. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 17

18 Actions Taken: Senior management immediately understood that they could piggy-back much of the IP protection program on the existing quality management system. They formed a crossfunctional IP compliance team in the US, led by the quality manager and the IT security manager. The team developed more comprehensive IP protection policies and procedures. They started to form a team at the new facility in Mexico and began to localize the policies and procedures. We have received much value from your program. I will be at our facility in Mexico next week and will call a meeting with our new IP Protection Team the first week of October to review the latest recommendations from CREATE.org and plan our next steps. The Summary Report is useful and indeed provides a very good holistic perspective. We enjoyed participating. Infosys CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 18

19 What Companies Had to Say Below are quotes from the companies about their participation in CREATe Leading Practices. Perspectives about the Management Systems Approach In the past, we never evaluated our internal [IP] management system. The CREATe assessment provides an outside view of how we are doing and how effective our current system is. The CREATe program is valuable to us. It showed us a new way to think about IP protection. Chinese company We have a better understanding of our current system. There is a lot of fruitful information and value. The program is very useful. The report and guide have been very helpful. It [the management system] serves as a supplement to the legal and contractual approach. It gives us different ideas. We agree that a management-systems approach is a helpful tool for IP protection. Global Manufacturing Company We knew very little about a management system approach to IP protection before participating in the CREATe program. Our IP protection system is not sophisticated. Chinese company The CREATe program provides valuable scores and a benchmark. Using CREATe Leading Practices with Supply Chain Partners and Subsidiaries Our multinational company customer thinks it is important for its suppliers to build a strong IP protection system. We, as a supplier, are willing to work on our system. But we need help on building the foundation of the policies and team. Chinese company We appreciate the recommended actions that CREATe proposed. Based on the summary report we are already working on the two high priority areas. We are going to have our annual meeting soon with our overseas offices. IP protection will be one of the topics. We will make recommendations to our overseas subsidiaries to strengthen their IP protection system based on what we have learned from CREATe. Global Manufacturing Company The Benefits of the Measure and Improve Approach At first, we were surprised at the score gaps [between the self-assessment and independent evaluation] in certain categories We now understand that the CREATe experts have a different opinion with us in these areas and we agree we have room to improve. Likewise, our CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 19

20 self-assessment scores are very close to the independent evaluation scores in some areas. That means we have a good understanding of our system in these categories. We now have a clearer idea of what to do next and how to get started. If our senior management agrees and approves, we will start working on three high priority areas, Policies and Procedures, IP Compliance Team, Training and Capacity Building. Chinese company The summary report gives us an outside international perspective. It shows us the value of preventive and proactive measures and also provides us with practical tools to improve. We now have a clear idea of what need to do in the next step. Global Manufacturing Company We really appreciate the feedback in the report. We will cite the CREATe program, the report and our score in the annual Executive Management Review. There was very helpful and valuable input in the report that we are already using. One specific issue is to better define and address trade secrets in our policies. We are also rolling out an improved monitoring program because we agree with the report that it was a weaker area for us. European company We really appreciate the feedback in the report. We will cite the CREATe program, the report and our score in the annual Executive Management Review. Implementing an IP protection program to gain a competitive advantage IP protection is absolutely a competitive advantage. It is at the core of our business. The more secure we get, the more we get a competitive advantage. European company The Guide is comprehensive and an excellent value for organizations especially those that are at a lower level of maturity then our company. It is extremely valuable to a company seeking to develop or strengthen their IP protection program. Global company with HQ in India Collaborating with CREATe.org to improve IP protection and compliance The experience [of participating in the CREATe program] was smooth and extremely valuable. Global company with HQ in India CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 20

21 The summary report gives us an outside international perspective. It shows us the value of preventive and proactive measures and also provides us with practical tools to improve. The interaction with the CREATe team was really engaging and interesting. The Summary Report is useful and indeed provides a very good holistic perspective. We enjoyed participating. Global company with HQ in India We have gone through the IP program and we like the measure and improve approach. We are also interested in the anti-corruption program. I believe that CREATe will help me to convince senior management to improve our compliance program. Chinese company We are happy to join the pilot program. We appreciate your suggestions and recommended actions for us to improve our IP program. Chinese company We really appreciate being involved in the program. It has been very valuable. Having gone through this program gives us confidence in what we are doing and identifies areas to improve. It has been extremely valuable to me and to my organization. Global company with HQ in India CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 21

22 Leading Practices for Anti-Corruption

23 OVERVIEW In 2013 and 2014, 23 companies participated in CREATe Leading Practices for Anti-Corruption, our three-step service that is based on internationally recognized best practices for preventing, detecting and mitigating corruption risk. The companies participating in the pilot crossed diverse industry sectors aviation, IT, consumer goods, telecommunications and geographies, including Asia, Latin America, Europe and North America. The scenarios for the companies, included: Private equity firms asking their portfolio companies to participate in CREATe Leading Practices for Anti-Corruption to assess and improve their anti-corruption programs Companies seeking to measure their own internal anticorruption systems to prepare for new anti-corruption legislation coming into effect Companies comparing the level of anti-corruption program implementation of their subsidiaries and regional offices After the Self-Assessment, the majority of companies also participated in an Independent Evaluation conducted by a CREATe expert. Company representatives discussed their anti-corruption program with the CREATe expert, who shared insights into anti-corruption best practices and helped to define key priority areas for improvement. Each participating company took an online Self-Assessment, which measured the maturity of the company s anti-corruption program across the following process categories: Policies, Procedures & Records Anti-Corruption Compliance Team Quality of Risk Assessment Supply Chain Management Training & Capacity Building Monitoring & Measurement Corrective Action & Improvement CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 23

24 Following the Independent Evaluation, each company received a Summary Report featuring detailed recommendations for improvements. Companies also received access to the 200+ page CREATe Leading Practices Guide to Improving Your Anti-Corruption Program, which outlines specific steps for maturing an anti-corruption program, along with sample resources, such as anti-corruption policy guidelines, executive communications, guidance on due diligence and risk assessment, and other tools....70% of companies do not have financial controls specifically designed to detect corruption. Following is an overview of the results. CREATe Leading Practices for Anti-Corruption The Rankings Anti-Corruption Program: Global Average - Self-Assessment versus Independent Evaluation 6.0 Maximum Maturity Level Policies, Procedures & Records Anti-Corruption Compliance Team Risk Assessment Management of Supply Chain Training & Capacity Building Monitoring & Measurement Corrective Action & Improvement Overall Score Self-Assessment: All Participating Companies Independent Evaluation: All Participating Companies Companies are measured in all categories on a scale of 1-5 Level 1 Little or no awareness of 5 repeatable processes Mature system implemented internally and in supply chain: focus on all IP CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 24

25 Looking at the data another way: Process Category Self-Assessment: All Participating Companies Independent Evaluation: All Participating Companies Policies, Procedures & Records Anti-Corruption Compliance Team Quality of Risk Assessment Supply Chain Management Training & Capacity Building Monitoring & Measurement Corrective Action & Improvement Overall Score Notes Self-Assessment scores are typically higher than independent evaluation scores. This is true in virtually every type of evaluation. The Independent Evaluation scores provide a more credible view on the maturity of the anti-corruption program. A narrow gap between the Self-Assessment and Independent Evaluation scores indicates that the companies had a realistic understanding of their system maturity. A wide gap between the Self-Assessment and Independent Evaluation scores indicates that companies had a more limited understanding of the process. Often this was addressed during the Independent Evaluation call as the company gained a deeper understanding of the topic. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 25

26 Top 3 Findings Policies, Procedures and Records is the most mature process in anti-corruption. o There are well-established, international guidelines for anti-corruption compliance that provide companies with guidance on establishing their own policies. o Even so, most companies do not have specific procedures to direct employees in following those policies. Many companies seem to rely on their policy document rather than implement effective procedures to enforce policies. Risk Assessment and Training and Capacity Building are the least mature processes in anti-corruption. o Most companies perform no formal anti-corruption risk assessment before entering a new market or business partner relationship, but instead rely on the common sense and experience of their employees to understand when corruption risk exists. o Most companies do not train their employees on anti-corruption measures. This lack of training is directly tied to the low level of implementation seen in most companies. Anti-Corruption Compliance Team is a foundational area that needs improvement. o In many companies, no one has specific responsibility for anti-corruption compliance. As a result, these companies tend to be reactive and only respond to incidents that occur rather than proactively managing and mitigating their risk. o Even in companies where a person has responsibility for anti-corruption compliance, they are often not given the authority and resources necessary to implement an effective anti-corruption program. The Deeper Dive: Interesting Highlights Policies, Procedures and Records CREATe expert evaluators found that 70% of companies do not have financial controls specifically designed to detect corruption or do not consistently use them if they do have such controls. 80% of companies do not have written procedures for how employees should follow the company anti-corruption policies, based on the CREATe evaluation. Anti-Corruption Compliance Team CREATe expert evaluators found that 40% of companies have not assigned day-to-day responsibility for anti-corruption compliance to a specific employee or group of employees. 13% of companies self-reported that that senior management had no involvement in anticorruption compliance. According to CREATe.org expert evaluators, that number is even higher, with 40% of companies having no senior management involvement. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 26

27 Scope and Quality of Risk Assessment Based on companies Self-Assessment, 65% do not proactively conduct an anti-corruption risk assessment before entering a new market or business partner relationship. The Self-Assessments also found that 55% of the companies do not conduct an anticorruption risk assessment even when they are working with government officials. Management of Supply Chain According to CREATe expert evaluators, 100% of participating companies only conduct financial and business due diligence or due diligence that is not anti-corruption specific. 60% of companies do not address anti-corruption at all in their relationships with supply chain and business partners, even through contractual requirements, based on the CREATe evaluations. Training and Capacity Building 62% of companies self-reported that they do not provide any anti-corruption training to their employees. The companies reported and the CREATe evaluators confirmed that 67% of companies do not provide any anti-corruption training to supply chain members or otherwise require them to train their own employees. Monitoring and Measurement 57% of companies self-report that they do not monitor the performance of their anticorruption program inside their company. 86% of companies do not monitor the anti-corruption compliance of their supply chain and business partners (e.g., through periodic audits, updated due diligence, requesting annual compliance certifications), based on the Self-Assessment. Corrective Action and Improvement According to CREATe expert evaluators, 60% of companies involve senior management when they take action to address and remediate specific corruption-related incidents. 67% of companies self-report that they do not take any corrective action to help supply chain members fix problems or improve their anti-corruption program. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 27

28 Scenarios of Companies in the Pilot Global Private Equity Firm: Regional offices, investors and portfolio companies in North America, Europe, Middle East, Asia, Australia Situation: The firm created a new position to build and lead its anti-corruption program. In part, this was in response to new anti-corruption laws and stricter enforcement in certain countries where the firm has portfolio companies. The new head of anti-corruption compliance sought an effective way to measure the maturity of the firm s anti-corruption program, as well as the programs of key portfolio companies. Prior to engaging with CREATe, the firm had already developed a new, comprehensive set of anti-corruption policies and a program to train employees on them. Actions Taken: The firm integrated CREATe s recommendations into its internal programs and asked portfolio companies to participate in CREATe Leading Practices as well. In part guided by the CREATe report, it wrote procedures to correspond with its new policies. It conducted anticorruption training at its regional offices, and has developed an annual anti-corruption training plan. I learned a lot from your program as how to build a strong anti-corruption compliance program. As a private equity firm, I also appreciate you helping us evaluate our existing and potential investments. We found CREATe s management systems approach useful as a means of helping us understand how we can go about making improvements. Global Heavy Equipment Manufacturer: $600 million annual revenue, 2,075 employees Situation: New management wanted to understand the maturity of the company s anti-corruption program throughout its global organization, which operates in many high-risk countries. The company had a strong anti-corruption culture, but no functioning anti-corruption management system. Management had started to update the code of conduct and anti-corruption policies, but needed more insight into the current anti-corruption practices in each region. Actions Taken: The regional offices each completed the CREATe Leading Practices Self- Assessment and Independent Evaluation. CREATe expert evaluators are working with the company to provide recommendations for improvement to each regional office as well as an overall improvement plan to headquarters. One of the key focuses for me is the improvement and rollout of our anti-corruption program. I am updating the existing Code of Conduct and policy, which is really just the first step in this process. To help with the next stage, CREATe has agreed to help me identify how mature our anti-corruption program is by providing me with an evaluation service. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 28

29 Global Compliance Verification Company Situation: The company conducts factory audits on behalf of many global brands, with the audits focusing on quality, labor and environmental compliance. Corruption in the compliance auditing industry has been a growing concern for the company. As a leader in the field, the company wanted an assessment of the effectiveness of its internal anti-corruption management systems. Prior to working with CREATe, the company had developed a very thorough set of anti-corruption policies. Actions Taken: The evaluation revealed that company procedures were no longer aligned with its policies, so it focused on updating its anti-corruption procedures while conducting training on the new policies for employees. The company also prioritized the creation of a formal corrective action system. Based on a growing general concern over corruption among its customers, the company is exploring how to incorporate an anti-corruption evaluation into its factory compliance program. Chinese Business Consulting Company Situation: As a portfolio company of a private equity firm, the company was asked to participate in CREATe Leading Practices in order to evaluate its anti-corruption program. The nature of the company s business placed its employees and agents in situations and markets with a high risk of corruption. The company has sophisticated internal controls for business and financial operations, but these are not specifically designed or used to detect corruption. The employee code of conduct is thorough in covering anti-corruption policies, but the company has no specific anti-corruption procedures for employees to follow, and does not conduct any training on its anticorruption policies. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 29

30 We are honored to participate in the CREATe anti-corruption program. We have received a lot of valuable professional advice from the assessment. I like CREATe s preventive and proactive approach. We look forward to further cooperation. What Companies Had to Say The CREATe program showed us the weakness in our anti-corruption compliance program. For example, we don t have full-fledged anticorruption policies. We don t have a crossfunctional anti-corruption compliance team. As a compliance director, I am eager to improve our anti-corruption program, but there is limit on what I can do I agree with you that we need to take incremental improvement steps. Global Private Equity Firm CREATe has agreed to help me identify how mature our anti-corruption program is by providing me with an evaluation service. We have participated in the CREATe IP program. It showed us the weakness in our IP program and the gaps between our system and internal best practices. I am very interested in the anti-corruption assessment as well. Compliance risks can bring huge damage to a company. I have been talking to our senior management about building an anti-corruption compliance program. Chinese Information Technology Company CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 30

31 About CREATe

32 ABOUT CREATe The Center for Responsible Enterprise And Trade (CREATe) is a non-profit organization dedicated to helping companies and their suppliers and business partners reduce counterfeiting, piracy, trade secret theft and corruption. CREATe was founded in October 2011 by Pamela Passman, former Corporate Vice President and Deputy General Counsel, Global Corporate and Regulatory Affairs, Microsoft Corporation. While at Microsoft, Ms. Passman led Microsoft s regulatory compliance work on a range of issues in more than 100 countries. She was integral to the company s global corporate citizenship efforts, and for nearly six years led Legal and Corporate Affairs in Asia, based in Tokyo, with a focus on Japan, Korea and the People s Republic of China. Ms. Passman s collective experience in compliance, corporate leadership, public policy and emerging markets led her to consider a new approach to two critical issues for companies around the world: intellectual property (IP) protection and anti-corruption. She recognized that companies such as Microsoft, GE, DuPont, P&G and many others have spent years developing robust management systems and best practices to appropriately manage and use IP and to prevent corruption. Equally important, she understood that while government regulation will continue to be the necessary foundation, the private sector can play a powerful role in driving responsible business practices and bridging regulatory gaps where adequate laws do not exist or enforcement is weak. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 32

33 From these perspectives, CREATe was founded. As a non-profit organization, CREATe works across industries and geographies with a mission to bring leading practices in IP protection and anti-corruption to all companies. The organization works to provide cost-effective and practical assessments, benchmarking, tools and step-by-step guidance for companies, particularly those that lack a track record of developing and implementing compliance programs. Sharing Leading Practices for IP Protection and Anti-Corruption In the organization s first two years, CREATe s in-house experts gathered insights on leading practices from companies around the world, and partnered with think tanks, academics and experts on IP protection, anti-corruption management systems and sustainable supply chains. The organization also looked at existing guidelines, including those for anti-corruption defined by the Organisation for Economic Co-operation and Development (OECD), the U.S. Department of Justice, Securities and Exchange Commission, The UK Ministry of Justice, the World Economic Forum, and the U.N. Global Compact. CREATe brought together these leading practices and guidelines and identified specific business processes critical to an effective IP management system and those essential to preventing corruption. These range from policies, procedures and records, to training, monitoring and having systems in place to take action when something goes wrong. To help companies assess and improve these systems, CREATe developed two services CREATe Leading Practices for IP Protection and CREATe Leading Practices for Anti-Corruption. Each service allows companies to measure the maturity of management systems in place to protect IP or prevent corruption; and then improve and mature such practices with incremental steps from CREATe s 200+ page Guides and insight from experts in IP and anti-corruption. CREATe has also developed individual training modules and resources, such as Model IP Policies and a compilation of internationally recognized anti-corruption guidelines, which are available for download from the CREATe.org website. The CREATe Leading Practices service is cost-effective, practical and flexible enough to meet the varying requirements of companies across industries and geographies. It is currently available in Chinese, English, Brazilian Portuguese and Spanish. CREATe LEADING PRACTICES / PILOT PROGRAM RESULTS REPORT / CREATe.ORG 33