Roadmap For An Effective Compliance And Ethics Program The Top Ten Things the Board Must Know [Name of Presenter] [Title] [Date]

2 Not Just About Sentencing United States Sentencing Guidelines (“Guidelines”), which address criminal conduct, are the foundation for compliance and ethics programs that address all misconduct (“Program”) Amendments to the Guidelines set forth specific goals for Programs. The Department of Justice and the SEC measure Programs against Guidelines’ standards when considering actions against entities. Other government agencies such as HHS, EPA and State also use the Guidelines as the principle benchmark for Programs.

3 Key Requirements for Program 1. Board needs to be knowledgeable about and oversee the Program. 2.Must establish a “tone at the top” that demonstrates corporate commitment to ethical conduct and compliance with the law. 3.Requires an organizational structure where senior personnel have overall responsibility for the Program and individual responsible for day-to-day operations has appropriate authority and access to the Board or subcommittee of the Board. 4.Program must have adequate resources. 5.The Company must have appropriate corporate standards and procedures designed to achieve compliance.

4 Key Requirements for Program (continued) 6.Effective compliance training should be provided and Board needs to participate. 7.A confidential and anonymous disclosure mechanism (“hotline”) is required. 8.Must provide incentives to perform consistent with Program and apply consistent disciplinary measures for misconduct (“carrot and stick”). 9.Risk Assessment drives the Program. 10.The Program needs to be kept effective and regularly evaluated and revised as appropriate.

5 Board Must Know About and Oversee Program Guidelines Require “The [Board] shall be knowledgeable about the content and operation of the compliance and ethics program and shall exercise reasonable oversight with respect to the implementation and effectiveness of the compliance and ethics program.” (§8B2.1(b) (2) (A)). Implementation This training. Regular written reports [to be supplied]

6 Tone at the Top Guidelines Require Establishment and maintenance of an organizational culture that “encourages ethical conduct and a commitment to compliance with the law.” (§8B2.1 (a) (2)). Implementation [to be supplied]

7 Organizational Structure Guidelines Require High level personnel who have substantial control over the organization or who have a substantial role in making policy are responsible for the compliance program. (§ 8B2.1(b) (2) (B). Day-to-day operational responsibility for the program delegated to individuals who report to high level personnel. Individuals responsible for day-to-day operations must have... appropriate authority and direct access to the governing authority or an appropriate subgroup of the governing authority (§8B2.1(b) (2) (C)).

8 Implementation of Organizational Structure [to be revised appropriately]

9 Program Must Have Adequate Resources Guidelines Require Individuals responsible for day-to-day operations must have adequate resources....(§8B2.1(b) (2) (C)). Implementation Budget for Program for last year:$_____ Staffing for Program for last year:______ Budget for Program this year: ______ Staffing for Program this year:______

10 Compliance Standards and Procedures Guidelines Require “The organization shall establish standards and procedures [standards of conduct and internal controls] designed to prevent and detect [misconduct].” (§8B2.1 (b) (1)). Implementation [to be supplied—discussing code of conduct, policies etc.]

11 Compliance Training Guidelines Requirements “The organization shall take reasonable steps to communicate periodically and in a practical manner its standards and procedures, and other aspects of the compliance and ethics program, to [the Board, high level personnel, substantial authority personnel, the company’s employees, and as appropriate, the company’s agents] by conducting effective training programs and otherwise disseminating information appropriate to such individual’s respective roles and responsibilities.” (§8B2.1(b) (4) (A)).

12 Compliance Training (continued) Implementation [to be supplied—identifying training courses, when given, who took them (by category), what is to be provided in the future etc. ]

13 Hotline Guidelines Require “The organization shall take reasonable steps---(C) to have and publicize a system, which may include mechanisms that allow for anonymity or confidentiality, whereby the organization’s employees and agents may report or seek guidance regarding potential or actual [misconduct] without fear of retaliation.” (8B2.1(b)(5)(C)). Sarbanes-Oxley imposes similar requirements. Implementation [to be supplied]

14 Carrots & Sticks Guidelines Require “The organization’s compliance and ethics program shall be promoted and enforced consistently throughout the organization through (A) appropriate incentives to perform in accordance with the compliance and ethics program; and (B) appropriate disciplinary measures for engaging in [misconduct] and for failing to take reasonable steps to prevent or detect [misconduct].” (§8B2.1(b)(6)). Particularly important with regard to senior management who must set the “tone at the top” and whose performance and compensation may be considered by the Board.

15 Carrots & Sticks (continued) Implementation [to be supplied]

16 Risk Assessment Guidelines Require “The organization shall periodically assess the risk of [misconduct] and shall take appropriate steps to design, implement, or modify [the Program] to reduce the risk of [misconduct] identified through this process.” (§8B2.1(c)). Implementation [to be supplied]

17 Program Needs to be Kept Effective and Regularly Evaluated Guidelines Require “The organization shall take reasonable steps—(A) to ensure that the organization’s compliance and ethics program is followed, including monitoring and auditing to detect [misconduct]; and B) to evaluate periodically the effectiveness of the organization’s compliance and ethics program.” (§8B2.1 (b) (5) (A&B)). “After [misconduct] has been detected, the organization shall take reasonable steps to respond appropriately to the [misconduct] and to prevent further similar [misconduct] including making any necessary modifications to the organization’s compliance and ethics program.” (§8B2.1 (b) (7)).

18 Program Needs to be Kept Effective and Regularly Evaluated (continued) Implementation [to be supplied]