Supplier Ethics: Program Checklist

Guidelines for Program Requirements Federal Sentencing Guidelines (FSG) Last amended 2010 Effective Compliance and Ethics Program (Chapter 8, Part B, Section 2) Due diligence to prevent and detect criminal conduct Promote organizational culture encouraging ethical conduct and compliance with law Defense Industry Initiative on Business Ethics and Conduct (DII) Creating and Maintaining an Effective Ethics and Business Conduct Program Suggestions for each element of an effective program Good resource for possible additions / enhancements

Guidelines for Program Requirements (cont’d) FAR Clause 52.203-13 “Contractor Code of Business Ethics and Conduct” Requires government contractors to: Exercise due diligence to prevent and detect criminal conduct Promote an organizational culture that encourages ethics and compliance Submit mandatory disclosures to the government Mandates: Code of Business Ethics and Conduct Business Ethics Awareness and Compliance Program Internal Control System Subcontract Flowdown FAR 52.203-13 (2008)

Checklist Checklist maps requirements of FSG and FAR, as well as DII recommendations, against program elements Reviewers should refer to the source documents for more detail Links to Source Documents Federal Sentencing Guidelines §8B2 FAR Clause 52.203-13 “Contractor Code of Business Ethics and Conduct” DII Creating and Maintaining an Effective Ethics and Business Conduct Program Note both potential gaps and highlights/best practices

Ethics & Business Conduct Program Sentencing Guideline Requirement Ethics & Business Conduct Program Standards and procedures Code of Conduct Distribution/Access Internal Control Procedures Corporate Policy Statements: _______________________________ _______________________________ _______________________________ FAR Requirement* Code of Conduct made available to each employee working on the contract Internal Control System Defense Industry Initiative Written policy signed by top official providing for key elements of program Code of Conduct, including potential content *for contracts of more than $5M and period of performance > 120 days Note: Bold text indicates minimum program requirement

Ethics & Business Conduct Program Sentencing Guideline Requirement Ethics & Business Conduct Program Board knowledge and oversight Certifications of training Frequency of reports to Board: Quarterly Bi-yearly Yearly Other: _____________ Oral report to Board Written report to Board

Ethics & Business Conduct Program Sentencing Guideline Requirement Ethics & Business Conduct Program High-level person responsible for program Report to executives and Board Resources, authority and access Access to company resources Budget Staff Level of person responsible for ethics__________________________ Report to CEO Hard line Dotted line Report to Board of Directors Steering Committee FAR Requirement Assignment of responsibility at sufficiently high level with adequate resources to ensure effectiveness of program (ICS) Defense Industry Initiative Defined organizational structure

Ethics & Business Conduct Program Sentencing Guideline Requirement Ethics & Business Conduct Program Due diligence for substantial authority positions Sources of information: Background Checks Ethics database check HR hiring processes Frequency of checks once in position: Upon offer only Once a year Other _____________________ FAR Requirement Reasonable efforts not to include individual as a principal, whom due diligence would have exposed conduct in conflict with Code (ICS)

Ethics & Business Conduct Program Sentencing Guideline Requirement Ethics & Business Conduct Program Communication and training Board of Directors training Employee training Code of Conduct (or general ethics) Training Compliance Training Training for agents and subcontractors Ethics staff training Employee communications Ethics messages integrated Standalone ethics communications FAR Requirement Ongoing ethics awareness and compliance program Reasonable steps to communicate periodically and in practical manner Contractor’s standards and procedures by conducting effective training programs otherwise disseminating information appropriate to individual’s respective roles and responsibilities Training for contractor’s principals and employees and, as appropriate, contractor’s agents and subcontractors Defense Industry Initiative Rules-based compliance training based on risk assessment Ethics awareness training and discussion Comprehensive communication plan

Ethics & Business Conduct Program Sentencing Guideline Requirement Ethics & Business Conduct Program Monitoring, auditing, and periodic evaluation Annual internal controls audit Employee survey Ethics program assessment Frequency: Once a year Every other year Other __________________ External benchmarking Ethics metrics review Monthly Quarterly Bi-Yearly Yearly General internal and external audits FAR Requirement Periodic reviews of business practices, procedures and internal controls (ICS) Defense Industry Initiative Regular program assessments, employee survey, metrics reporting, internal and external audits

Ethics & Business Conduct Program Sentencing Guideline Requirement Ethics & Business Conduct Program System for reporting misconduct or seeking guidance, without fear of retaliation Anonymous reporting Ethics Officers Help/hotline Other _________________________ Protection against retaliation System to report System to seek guidance System for tracking contacts FAR Requirement Standards and procedures to facilitate timely discovery of improper conduct (internal controls) Internal reporting mechanism, such as hotlines, to report suspected misconduct and instructions that encourage employees to make reports (ICS) Defense Industry Initiative Place for employees, suppliers, customers and business relations to raise concerns / ask questions

Ethics & Business Conduct Program Sentencing Guideline Requirement Ethics & Business Conduct Program Consistent enforcement Disciplinary process for violations Discipline review committees Internal investigations FAR Requirement Disciplinary actions for improper conduct or failing to take reasonable steps to prevent or detect improper conduct (ICS)

Ethics & Business Conduct Program Sentencing Guideline Requirement Ethics & Business Conduct Program Response to criminal activity Audits Corrective action analysis Discipline Internal investigations Mandatory Disclosure policy Voluntary Disclosure policy FAR Requirement Corrective measures are promptly instituted and carried out (internal controls)

Ethics & Business Conduct Program Sentencing Guideline Requirement Ethics & Business Conduct Program NEW (as of 2010): Obligation to communicate directly with the Board or a sub-group of the Board Periodic reports (oral and written) to Board committee: _______________________________ Frequency of reports to Board: Quarterly Bi-yearly Yearly Other: _____________ Communication with board documented in company policy/procedure: _______________________________

Ethics & Business Conduct Program FAR Requirement Ethics & Business Conduct Program Disclosures of violations of the civil False Claims Act or Federal criminal law shall be directed to the agency Inspector General, with a copy to the Contracting Officer Timely disclosure to the agency Inspector General of certain violations of law by principal, employee, agent or subcontractor Full cooperation with government agencies for audits, investigations and actions Process for making disclosures Policy stating expectations for full cooperation

Ethics & Business Conduct Program Defense Industry initiative Ethics & Business Conduct Program Leadership Commitment Tone at the top Engaged middle management Reinforcing messages