1. Freshfields Bruckhaus Deringer LLP Global investigations What to advise your board Marius Berenbrok Edward Braham Matthew Herman Melissa Thomas 29 February 2012

2. 1 Today’s agenda and speakers What best practices should you have in place in relation to compliance? Matthew Herman Partner, New York T+1 212 277 4037 M+1 646 327 3953 Ematthew.herman@freshfields.com When and how do you start an investigation? Marius Berenbrok Partner, Hamburg T+49 40 3690 6210 M+49 172 40 08 783 Emarius.berenbrok@freshfields.com How do you conduct and control an investigation? Melissa Thomas Partner, Beijing T+86 10 6535 4602 M+86 13 9110 73349 Emelissa.thomas@freshfields.com Dealing with the aftermath of an investigation Edward Braham Partner, London T+44 20 7832 7084 M+44 7802 848989 Eedward.braham@freshfields.com

3. 2 What best practices should you have in place in relation to compliance? No ‘one size fits all’ approach ‘Tone from the top’ Tailored risk assessment – identify high-risk locations/businesses Alignment with corporate strategy Clear policies and procedures – communication and understanding are key

4. 3 What best practices should you have in place in relation to compliance? Robust investigation and reporting ­adequate resources ­audit, disclosure and financial reporting teams involved Audit and testing of programmes Best practices in M&A ­Risk based approach ­CPI score and nature of target’s business ­Sensitive to process ­Evaluate significance of diligence ­Equally as important in sell-side process Approach in China

5. 4 When and how do you start an investigation? When might you need to start an investigation? General rule Relationship with regulators Some examples ­inappropriate business practices identified that may lead to litigation exposure ­government/regulatory investigations ­investigations that relate to competitors ­audit problems ­unusual trading patterns ­whistleblower allegations ­press reports

6. 55 When and how do you start an investigation? Practical considerations before starting an investigation Matter of judgement in each case Degree of concern Size of the issue Risk of regulatory action or stakeholder interest Seniority of those potentially involved Cultural impact What about directors’ fiduciary duties? General duties of care, loyalty and good faith also include oversight duties Violations of duty of loyalty may lead to a loss of coverage under the D&O insurance

7. 66 When and how do you start an investigation? Who should supervise the investigation? Supervisory board/management board Audit committee Special committee General counsel/head of compliance/other senior management

8. 7 How do you conduct and control an investigation? Who should the board instruct? In-house counsel? Outside counsel (pre-existing relationship or independent)? Forensic accountants? IT experts?

9. 8 How do you conduct and control an investigation? Self-reporting considerations – whether and when to do so? What is the nature of the issue? Confined to a subsidiary? Or is the parent involved? An isolated incident? Or systemic? Are you able to investigate the issue internally, to understand the issue properly? Do you have the time? Is the information available to you? Do you need independence for ‘credibility’?

10. 9 How do you conduct and control an investigation? Self-reporting considerations – whether and when to do so Will the regulator/enforcement agency find out about the issue from another source? Is a competitor/the industry sector subject to investigation? Might a competitor or internal whistleblower tip off the regulator? Will you have to make any related notifications (eg to other regulators/in other jurisdictions)? Is a regulator in another jurisdiction already investigating? Is there any associated publicity in the press? Other considerations Overall exposure to fines Possibility of amnesty/leniency/settlement? Risk of follow-on litigation Risk of criminal sanctions

11. 10 How do you conduct and control an investigation? Public disclosure issues Announcements to the markets? Employee/works council consultations? Other contractual/statutory reporting obligations?

12. 11 How do you conduct and control an investigation? PR issues/media strategy Identify PR angles early and plan a response Have a central point of decision-making to ensure consistency/credibility of message Good consultation, including with external advisers to reflect legal risks, factual issues and market reactions Effective system for handling press enquiries

13. 12 How do you conduct and control an investigation? D&O insurance What does it cover? costs of defending civil, regulatory and criminal investigations costs of responding to informal inquiries/requests for information deductibles, caps and other limitations Also need to consider if it is not available due to a fiduciary duty breach Notification requirements

14. 13 Dealing with the aftermath of an investigation Depends on facts of the investigation as well as the industry Recurrent themes Cultural change Changing the business model Impact on contracts and procurement processes Employment issues Reporting issues Dealing with a monitor or regulator who is watching your every move

15. 14 Questions?

16. 15 SRA authorisation reference: 049/FRS LONBS8924896 This material is for general information only and is not intended to provide legal advice. © Freshfields Bruckhaus Deringer LLP 2012