1. FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS A Conference Board – Ethics and Compliance Officers’ Association (ECOA) Survey October 31, 2008 Ronald Berenbeim The Conference Board

2. © FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS THE DELICATE BALANCE: Company partners in global markets are not always mindful or responsive to corporate policies devised in response soft law issues and mandates to implement ethics and compliance programs Although the imposition of ethics and compliance requirements on third parties can exert some control, it also increases the likelihood that third party conduct will be imputed legally or reputationally to the company

3. © The Conference Board-ECOA Survey was Conducted between February – May 2007 – 169 Companies Responded 2006 Median Sales -- $5-10 Billion 2006 Median Sales Outside US – 50 – 74 percent FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS

4. © Primary Business

5. © FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS Company does business in:

6. © A company’s code of practice for its own employees in dealing with third parties is the most common method for handling third party ethics and compliance issues: 95 percent use this approach 88 percent post it on the internal web site 68 percent post on the public web site subject matter categories: (1) legal/financial (most common) (2) environmental health and safety (3) human rights (least common) 69 percent – statement of conditions applies in the same manner to all kinds of third parties If third party is identified, contractors (84 pct) and agents (82 pct) are the most likely to be mentioned FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS

7. © On which subject(s) does the company have a written policy that applies to third parties

8. © Background or due diligence checks: 77 pct. Perform background/due diligence checks on any third parties prior to entering into a business relationship Disabling financial or legal conditions (e.g., credit and financial background) are more likely than reputational impairments (media or reputation checks) to be the subject matter of due diligence searches FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS

9. © Company performs background or due diligence on:

10. © FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS In what area(s) is the third party subject to review

11. © FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS Ethics and compliance program features extended to third parties

12. © FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS Whistleblowing Systems: 98 pct. use the same system for third parties as for their own employees e-mail is the most common information conduit (65 pct. Calls/inquiries from third party employees is lower than from the company’s own employees

13. © FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS Risk Assessments: 79 percent of participating companies use risk assessment as part of their e & c program 76 percent address third party risks (agents, suppliers of services and contractors are the most frequent subjects) 56 percent conduct third party risk assessment as part of a broader enterprise risk process 44 percent limit third party risk assessment to ethics and compliance issues

14. © FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS Audits of third party compliance with company policies: routine basis – 45 percent specific concerns – 55 percent highest percentage of audits – suppliers of services (58 percent), contractors (56 percent)

15. © FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS Company codes of conduct for third parties: Within this group, supplier codes (both goods and services) are the most common – 81 percent

16. © FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS Company questions regarding third party’s own ethics program: Roughly half (14 percent) of the percentage (28 percent) that ask third parties if they have them require documentation

17. © FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS How difficult a challenge is posed by each of the following in trying to ensure ethical behavior by third parties with which your company does business (162 companies responding) (1=not difficult 4=extremely difficult)

18. © FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS How effective are the following measures in ensuring compliance with appropriate standards of business conduct by third parties? (161 companies responding) (1=not effective – 4=extremely effective)

19. © LOOKING FORWARD Companies likely to emphasize:  oversight of their own employees  due diligence (1) more sophisticated, reliable and comprehensive background checks (2) embed due diligence in the negotiation process (“must haves” and robust exit strategy)  Training is the e & c program element that can be used to promote greater third party understanding of business conduct situations – particularly with employees in high risk situations (e.g., sales force) FINDING A DELICATE BALANCE: THIRD PARTY ETHICS PROGRAM REQUIREMENTS