2. Internal Controls

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-bribery and corruption programme. The company indicates that the results of risk assessments are reviewed by the Audit Committee on at least an annual basis. There is evidence that the results of such reviews are used to update specific parts of the company's anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company’s anti-bribery and corruption programme is subject to regular review by an internal audit department. The company states that this process takes place regularly, no less than annually, and it is clear that the results of audits are used to make updates and improvements to the anti-bribery and corruption programme.

However, the company receives a score of ‘1’ because there is no evidence that high-level audit findings are presented to the board. Moreover, ownership of this process is unclear as the company does not publicly state which body or senior individual is responsible for using the audit findings to make updates to the company’s programme. There is also no clear evidence that – in addition to ensuring the proper functioning of the company’s internal controls – these audits are used to ensure that the programme is consistent with best practice and the business risks facing the company.

There is evidence that the company publicly commits to investigating allegations and incidents of bribery and corruption, including those reported through whistleblowing channels. For whistleblowing cases, there is a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome, and the company indicates that it will inform whistleblowers of the outcome of investigations. although the company does not explicitly state that the Audit Committee receives reports concerning investigations on an annual basis, there is sufficient evidence of regular and ongoing reporting systems for the company to receive a score of ‘2’.

Based on publicly available information, there is some evidence that the company assures itself of the quality of its internal investigations. There is evidence that investigators are appropriately qualified to perform the function.

However, there is no evidence that the company has a system in place to handle complaints about the investigation process, nor which individual would be responsible for the handling such complaints. It is also not clear that the company assures itself of the quality of both incident investigations and whistleblowing cases. In addition, there is no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

Based on publicly available information, there is evidence that the company reports findings of corruption investigations to the Audit Committee of the board of directors. However, the company receives a score of ‘1’ because there is no evidence that the company publicly commits to disclose criminal offences to the relevant authorities if necessary, nor does it indicate that a specific senior individual is responsible for ensuring such disclosures.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations, or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure that is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company has an investigative procedure that includes a commitment to report material findings to the board or relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is some evidence to suggest that the company recently conducted a risk assessment that was used to inform the design of its anti-corruption programme. However, there is no clear evidence that bribery and corruption risk assessments are reviewed on at least an annual basis, or that the results are reviewed at board level.

It is noted that the company has broader risk assessment procedures in place, however there is no evidence that these assess bribery and corruption risk, nor that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is some evidence to suggest that the company’s anti-corruption programme is subject to regular review. However there is no clear evidence that such reviews include a formal audit or review process, nor is there evidence that high-level findings are presented to the board or that a specific individual or body has responsibility for making improvements to the programme.

There is evidence that the company publicly commits to investigating incidents and that it has a specific procedure in place to deal with whistleblowing cases, which stipulates some of the documentation and actions that will be taken. There is also evidence that whistleblowing investigations are handled by an independent team.

However, the company receives a score of ‘1’ because no evidence has been identified which describes the entire investigative process, from receipt to final outcome. There is also no evidence that the company commits to provide whistleblowers with updates on the outcome of investigations. Furthermore, there is no evidence that a central body reviews information on cases on at least an annual basis.

There is evidence that the company assures itself of the quality of its internal investigations, stating that investigative teams are trained to perform their roles. There is also some evidence that there is a system in place for escalating concerns if an unacceptable response is not received in the first instance.

However, the company receives a score of ‘1’ because it does not provide further details with regards to how complaints about the investigation process are handled, or who is responsible for the handling of such complaints. There is also no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

There is no evidence that the company has an investigative procedure which includes a commitment to report material findings to the board. Although there is evidence that indicates the company may report findings to the relevant authorities, there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical, bribery or corruption-related investigations or associated disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme. The company indicates that risk assessments form part of its ethics and compliance programme, but provides no further information in its public materials regarding the nature of these procedures.

The company states that it conducts periodic audits to ensure the company’s continued compliance with anti-corruption laws. In 2018 the Audit Committee conducted a review of the Company’s ethics and compliance programme. However, it is unclear how frequently audits are conducted and whether the findings are used to update the anti-bribery and corruption programme.

While there is evidence that the company publicly commits to investigating incidents and that it has a whistleblowing channel, it does not provide information about its specific procedures in place, which stipulate documentation and actions to be taken at each step.

The company does not provide evidence in its public materials regarding how it assures itself of the quality of internal investigations.

While the company states that it may, if necessary, report certain investigations to appropriate authorities, there is no evidence that the company makes a firm commitment to report material findings of bribery and corruption to its board and the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company incorporates bribery and corruption risk into its wider Enterprise Risk Management process.

However, further information on this process is not publicly available. The company does not provide any further detail on the assessment process, such as the frequency at which the assessment is undertaken and reviewed, the types of risk factors which are considered and how the assessment is used to inform the company’s anti-bribery and corruption programme.

The company’s Audit Committee is responsible for periodically reviewing its ethics and compliance programme as well as the effectiveness of its compliance function. This includes reviewing the adequacy of policies and practices and the independence, staffing and performance of the Ethics and Compliance Team, and recommending improvements or changes.

However, the company’s publicly available evidence suggests that internal audits are conducted on the company’s operating functions and it is unclear from public information how frequently audits are undertaken on the company’s ethics and compliance programme.

The company indicates that it commits to conduct timely investigations, and states that employees are required to cooperate with internal investigations. The company provides some information about the steps in its investigative procedure and there is evidence that the company has a central database where it stores information on whistleblowing reports. There is also evidence that the Executive Ethics Committee reviews quarterly briefings and data on investigations.

However, the company provides no further publicly available details its investigative process from receipt to final outcome. While the company indicates that employees may follow up on reports, there is no evidence that it clearly commits to provide whistleblowers with information on the outcome of investigations. It is also not clear whether investigations are handled by an independent team and/or report to an independent board member.

There is no publicly available information regarding how the company ensures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

There is publicly available evidence that the company’s investigative procedure includes provisions to report information about cases to the Board of Directors and Audit Committee on a quarterly basis. The company indicates that the Ethics and Compliance function is responsible for providing updates on this subject.

However, the company receives a score of ‘1’ because it is not clear from publicly available information that an appropriate senior individual is ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon, if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees. The company indicates that it collects and evaluates this data on a quarterly basis, however there is no evidence that it publishes this data on its website or in a publicly available report.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. It is clear that the results of these risk assessments are used to develop action plans and update policies and procedures. There is evidence that the board reviews the results of these assessments on at least an annual basis.

Based on publicly available evidence, the company’s internal processes and activities – including the company’s anti-bribery and corruption programme – are subject to internal and external audit. The company develops action plans to improve its anti-corruption policies based on the findings and recommendations of these audits and, more recently, has appointed an Independent Compliance Review Panel to advise the CEO and Board on how to improve ethics and compliance processes. There is evidence that these audits are conducted annually.

Based on publicly available information, the company commits to investigating incidents promptly and has a specific procedure in place to deal with whistleblowing cases. This procedure covers the whole investigation from receipt to outcome and includes provisions to provide employees (including whistleblowers) with updates on the outcome of investigations. Additionally, the company’s investigations procedure ensures independence by outsourcing to an external provider and by stipulating the involvement of different senior individuals depending on the type of report. However, the company does not clearly state that information on each investigation is documented, nor that a central body reviews summary information of all reports and their status on an annual basis

There is some evidence that the company assures itself of the quality of its internal investigations and whistleblowing cases, for example by asking for feedback from those who report cases. There is also evidence that staff conducting investigations are properly qualified. However, the company does not provide sufficient detail on how complaints about the investigation process are handled, nor does it state that its procedures are reviewed regularly or at least every three years in response to any changes in the regulatory environment. More information may be available in the document entitled “Airbus Method for Investigation of Compliance Allegations”, however this is not publicly accessible.

The company makes a clear commitment to report material findings of bribery and corruption from investigations to the board. An appropriate senior individual is ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if found necessary.

There is no evidence that the company publishes high-level results from incident investigations or any information related to disciplinary actions against its employees.

There is no evidence that the company has a formal risk assessment procedure which is used to inform an anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no publicly available evidence that the company has an investigative procedure which includes a commitment to report material findings.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company has an investigative procedure which includes a commitment to report material findings to the board or relevant authorities.

The company does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-corruption and bribery programme.

However, there is no evidence that the results of this risk analysis are reviewed at board level on at least an annual basis.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is evidence that the company publicly commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases which stipulates documentation and actions to be taken. There is evidence that the procedure covers the whole investigation process from receipt to final outcome. There is also evidence that reports shall be reviewed by the Board of Directors within thirty days from its entry.

However, it is unclear whether investigations are handled by an independent team. There is also no evidence of a commitment to provide whistleblowers with updates on the outcome of investigations or that the information on each investigation is documented.

There is no evidence that the company assures itself of the quality of its internal investigations.

The company commits to report material findings of bribery and corruption from investigations to the board.

However, the company receives a score of ‘1’ because there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is publicly available evidence that the company’s Internal Audit Department systematically reviews bribery and corruption risks. The company also states that executives are responsible for evaluating and implementing controls in response to potential risks.

However, the company receives a score of ‘1’ because it is not clear whether the company has a formal bribery and corruption risk assessment procedure in place that informs the design of its entire anti-bribery and corruption programme. There is evidence that the company has an enterprise risk management process where the results are reviewed by the board on an annual basis; however, the company does not explicitly state that an assessment of bribery and corruption risk forms part of this process.

Based on publicly available information, there is evidence that the company’s anti-bribery and corruption programme is subject to regular review by its Internal Audit Department. The company states that results of these reviews are presented to the board, which is responsible for ensuring that required changes are made.

However, the company receives a score of ‘1’ because it is unclear how frequently audits are conducted. There is no clear evidence that the company’s entire programme is audited at least every two years to ensure that it is consistent with high standards of best practice and the business risks facing the company.

There is evidence that the company publicly commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases. There is evidence to suggest that a central body, the Ethical Principles Committee, receives summary information on investigations. It meets on at a quarterly basis and reports investigation findings to the board on a bi-annual basis.

However, the company does not publish information on the whole investigative process from receipt to final outcome. There is no clear evidence that investigations are handled by an independent team or report to an independent board member. The company also does not publicly commit to inform whistleblowers of the outcome of investigations.

Based on publicly available information, there is no evidence that the company takes steps to ensure the quality of its internal investigations through ensuring that staff are properly trained or providing a mechanism to report concerns about the investigative procedure.

Based on publicly available information, there is evidence that the company commits to report material findings of bribery and corruption from investigations to the CEO and to the board. However, there is no clear evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption-related investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal risk assessment procedure, which is used to inform the its compliance programme. The company indicates that its board of directors reviews the effectiveness of the company’s risk management and compliance procedures on an annual basis.

The company scores ‘1’ because there is no clear evidence that it assesses bribery and corruption risks as part of its risk management procedures. It is also not clear from publicly available evidence whether the findings of compliance reviews are used to develop tailored mitigation plans and to update specific parts of the company’s anti-bribery and corruption programme.

There is some evidence that the company’s compliance programme is subject to audit to ensure that its procedures are in line with relevant regulatory requirements and good practice standards.

However, the company receives a score of ‘1’ because there is no clear evidence that such reviews cover the whole anti-corruption or compliance programme, nor does the company provide clear information on the frequency of such reviews.

There is evidence that the company has a system for tracking, investigating and responding to bribery and corruption allegations or incidents, including those reported through whistleblowing channels. The company’s Whistleblower Protection Policy outlines the whole investigation process from receipt to final outcome and there is a commitment to providing whistleblowers with updates on the outcome of investigations. There is also evidence indicating that information on each investigation is appropriately documented.

However, the company receives a score of ‘1’ because there is no evidence that a central body reviews summary information on investigations on a regular basis. It is also not clear that investigations are handled by an independent team and/or report to an independent board member.

There is no clear evidence that the company assures itself of the quality of its internal investigations. The company indicates that its investigators receive training on the Whistleblower Protection Policy, but there is no evidence that staff conducting investigators receive other training related to internal investigations, nor is there evidence that the company has a procedure in place to handle complaints about the process or to review the procedure regularly.

There is no evidence that the company’s investigative procedure includes a commitment to report material findings of bribery and corruption to the board or to relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review. The company publishes some information on the number of audit projects conducted but makes no clear statement that these relate to the company’s anti-corruption programme.

There is some evidence that the company publicly commits to investigating incidents, and that there is a specific procedure in place to deal with whistleblowing cases. The company provides a description of its whistleblowing procedure from the initial submission of the report to the final outcome of the investigation. There is clear evidence that information on reports is documented and that individuals submitting reports are provided with updates on the outcome of investigations. In addition, the company publishes some information regarding the number of corruption-related reports submitted and handled.

However, the company receives a score of ‘1’ because there is no clear evidence that investigations are handled by an independent team or report to an independent board member or that summary information of investigations is reviewed by a central body on at least an annual basis.

Based on publicly available information, there is no evidence that the company assures itself of the quality of its internal investigations.

There is some evidence that the company makes a commitment to report suspected instances of corruption and criminality to law enforcement, according to its publicly available investigations procedure. However, the company receives a score of ‘1’ because there is no clear evidence that reports of corruption and criminality are shared with the company’s board of directors, nor is there evidence that a designated senior individual has responsibility for ensuring that the disclosure of such findings to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is clear evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. The company states that all departments produce a corruption risk assessment twice a year, and that the results are reviewed by the company’s central risk management function. In addition, there is evidence that high level findings from risk assessments are reviewed by the board and that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

Based on publicly available information, there is evidence the company’s anti-bribery and corruption programme is subject to regular review. The company indicates that the results of such reviews are presented to the board.

However, the company receives a score of ‘1’ because there is no clear evidence that its entire programme is subject to internal or external audit on a regular basis to ensure that it is consistent with high standards of best practice and the business risks facing the company.

There is evidence that the company publicly commits to investigating incidents, and that it has a specific procedure in place to deal with whistleblowing cases. The company indicates that whistleblowing reports are initially handled by an independent third party, then transferred to the company’s senior management for investigation. There is evidence to suggest that summary information on investigations is reviewed at the Audit and Risk Committee’s quarterly meetings.

However, the company receives a score of ‘1’ because there is no evidence that it publishes information on its whole investigation process from receipt to final outcome, nor is there evidence that it publicly commits to provide whistleblowers with updates on the outcome of investigations. It is also not clear how the company ensures the independence of its investigations, for example through an independent investigations team or reporting to an independent board member.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations by ensuring that staff are properly trained, implementing a system to handle complaints about the procedure, or reviewing its procedure at least every three years.

There is evidence that the company publicly commits to report material findings of bribery and corruption from internal investigations to the board-level Audit and Risk Committee. However, the company receives a score of ‘1’ because there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes high-level data on ethical or bribery and corruption investigations or disciplinary actions involving its employees. The company publishes the number of reports received through its whistleblowing channels on an annual basis, however there is evidence that this does not include reports received through other channels and it does not include further details such as number of investigations or disciplinary actions taken as a result.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure that is used to inform the design of the anti-corruption and bribery programme. The company indicates that the results of the assessments are reviewed at board level twice a year. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is evidence that the company’s entire anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. The company indicates that this includes provisions for continuous improvement, supplemented by internal and external audits; the last external audit was conducted by Deloitte in 2018. There is also evidence that high-level audit findings are presented to the board, with clear ownership assigned to units for planned updates and improvements to the anti-bribery and corruption programme.

There is evidence that the company publicly commits to investigating incidents promptly, independently and objectively. There is evidence that the company takes steps to ensure the independence of its investigations. The company commits to putting in place remediation plans and reporting investigative findings to senior management and the board. For whistleblowing cases, there is evidence that the company has a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome, and it commits to ensure whistleblowers are informed of the outcome if they so wish.

In addition, there is evidence that a senior central body receives and reviews summary information of all incidents and their status in the organisation and its subsidiaries. There is evidence that the data is reviewed on a quarterly basis.

Based on publicly available information, there is evidence that the company takes steps to assure itself of the quality of its internal investigations, including those reported through whistleblowing channels. The company clearly indicates that staff tasked with conducting investigations are properly trained to perform the function. There is evidence that complaints about the handling of concerns or investigations can be made to the company’s human resources department. In addition, there is evidence that the company reviews its investigations procedure at least every three years.

Based on publicly available information, the company has an escalation procedure to report material findings of bribery and corruption from investigations to the board. There is also a commitment to ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if found necessary. Although the company does not explicitly reference a senior individual responsible for ensuring such disclosures, there is sufficient evidence in the company’s publicly available information that this role would be filled by the Group General Counsel (who also has a direct reporting line to the CEO).

There is evidence that the company publishes high-level data from ethical-related incidents and investigations involving company employees at all levels. This data includes the number of reports received, including the number received anonymously, and the number of disciplinary actions as a result of investigation findings. The data is published annually.

However, the company receives a score of ‘1’ because there is no evidence that it publishes information on the number of investigations launched as a result of the reports or enquiries received.

There is no evidence that the company has a formal risk assessment procedure which is used to inform its anti-bribery and corruption programme.

Although there is some evidence that the company reviews its anti-bribery and corruption programme, it does not provide sufficient detail to receive a score of ‘1’, and the company does not specify how frequently it conducts these reviews. It is also unclear if the review findings are presented to the board or used to update the programme.

There is evidence that the company publicly commits to investigating incidents, and that it has specific procedures in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step.

However, the company does not cover the whole investigation process from receipt to final outcome, there is no evidence that investigations are handled by an independent team and/or report to an independent board member, and there is no evidence that the company commits to providing whistleblowers with updates on the outcome of investigations. Finally, there is no evidence that summary information is reviewed by a central body on an annual basis.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company’s investigative procedure includes a commitment to report material findings of bribery and corruption to the board or to the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is no evidence that the institute has a formal risk assessment procedure which is used to inform its anti-bribery and corruption programme.

There is no evidence that the institute’s anti-bribery and corruption programme is subject to audit or review.

There is some evidence that the institute commits to investigate ethical allegations and incidents and that a specific procedure is in place to deal with those reported through its whistleblowing channel. There is evidence that the institute takes steps to ensure the independence of investigations through the use of an external reporting channel and the establishment of a regular investigative committee formed of multiple individuals.

However, the institute receives a score of ‘1’ because it does not provide further details of its investigative procedure, from receipt to final outcome, and does not specifically mention allegations or incidents relating to bribery or corruption. There is also no evidence that information on each investigation is documented at each stage.

There is some evidence that the institute takes steps to ensure the quality of its investigations. It states that all staff tasked with conducting investigations are properly trained to perform the function and indicates that the Investigation Oversight Committee is composed of appropriate senior individuals.

However, the institute receives a score of ‘1’ because there is no evidence of a procedure to handle complaints about the investigation process, nor is there evidence that the institute reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

There is no evidence that the institute’s investigative procedure includes a commitment to report material findings to the board and, if necessary, to the relevant authorities.

There is no evidence that the institute publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company has a formal risk assessment procedure that informs the design of the ethics and compliance programme, which is understood to address anti-bribery and corruption. There is evidence that the results of risk assessments are reviewed by the board on at least an annual basis. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's compliance programme.

There is evidence that the company’s ethics and compliance programme is subject to a regular audit process to ensure the entire programme is consistent with best practice and the business risks facing the company, including corruption risk specifically. There is evidence that this includes provisions for continuous improvement, supplemented by an internal audit at least every two years. There is also evidence that high-level audit findings are presented to the board, with clear ownership assigned to units and individuals for planned updates and improvements to the ethics and compliance programme.

There is evidence that the company commits to investigating incidents and there is a specific procedure in place to deal with whistleblowing cases. There is evidence that the company takes steps to ensure the independence of its investigations and that the company commits to ensure whistleblowers are informed of the outcome, if they so wish.

There is also evidence that the company’s Chief Ethics and Compliance Investigator receives and reviews all investigation reports, and that the board-level Audit Committee receives periodic reports on violations of the company’s Code of Conduct. However, it is not clear from the evidence how frequently these reviews take place. Furthermore, the information provided does not cover the whole investigation process from receipt to final outcome, including documentation and actions to be taken at every step.

There is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels. The evidence indicates that staff tasked with conducting investigations are properly qualified to perform the function. There is evidence that complaints about the handling of concerns and investigations are overseen by an appropriate senior management officer.

However, there is no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

There is evidence that the company commits to provide reports regarding significant violations of its Code of Conduct to the board-level Audit Committee, as well as statistics from its Ethics Helpline. The company also states that it may be required to report material findings to the relevant authorities, and although it is not explicitly stated, there is sufficient evidence to indicate that the Chief Ethics and Compliance Officer is responsible for ensuring this disclosure.

There is evidence that the company publishes high-level data from ethical-related incidents and investigations involving company employees. This includes the number of reports received in total, including from whistleblowing channels, as well as the number of investigations launched, and the number of disciplinary actions as a result of investigation findings. This data is published at least on an annual basis covering cases from the past 12 months.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company has an investigative procedure which includes a commitment to report material findings to the board or to relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-corruption programme.

Based on publicly available information, there is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review. The company states that its activities are monitored by several external bodies associated with the government, including the Statutory Auditors, the Controller and Auditor General of India and the Central Vigilance Commission; however, it does not provide further details on the frequency of such reviews or whether this includes anti-corruption activities specifically.

Based on publicly available information, there is evidence that the company commits to investigating incidents and that it has a specific procedure in place to deal with whistleblowing cases, which stipulates actions to be taken at each step. The company provides publicly available information on this procedure to cover the whole investigation process from receipt to final outcome. There is evidence that investigations are handled by an independent team.

However, the company receives a score of ‘1’ because it is not clear that the company commits to providing whistleblowers with updates on the outcome of investigations or that information on each investigation is documented. There is also no indication that an Audit Committee receives and reviews the status of investigations on at least an annual basis.

There is no clear evidence that the company assures itself of the quality of its internal investigations. The company states that its Audit Committee reviews the functioning of the whistleblower mechanism; however there is no evidence that staff tasked with conducting investigations are properly trained to perform the function or that the company has a procedure in place to handle complaints about the process.

There is evidence that the company’s Audit Committee is responsible for reporting any material findings of unethical activity to the Management of the Company, which is understood to be equivalent to board level. However, there is no evidence to indicate that the committee commits to report such findings to the relevant authorities, nor is it clear that a specific senior individual is responsible for ensuring this information is disclosed, if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. The company indicates that results of risk assessments are reviewed by the board on at least an annual basis. There is also evidence that the results of these reviews are used to develop tailored mitigation plans and to update specific parts of the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review. The company indicates that some of its policies – including those covering anti-bribery and corruption controls – are reviewed periodically; however the frequency of these reviews is unclear and there is no evidence that the company’s programme as a whole is reviewed regularly. There is also no evidence that high-level findings are presented to the board or that a designated team or individual has responsibility for updating the policies.

There is evidence that the company publicly commits to investigating incidents promptly, independently and objectively and that the company takes steps to ensure the independence of its investigations. There is evidence that the company commits to reporting major investigative findings to senior management and the board. For whistleblowing cases, there is evidence of a procedure in place that stipulates documentation and actions to be taken at every step of the case, from the receipt to final outcome. The company also commits to inform whistleblowers of the outcome, if they so wish. There is also evidence to indicate that a senior central body receives and reviews summary of all incidents and their status in the organisation on an annual basis.

There is evidence that the company assures itself of the quality of its internal investigations regarding both incident investigations and whistleblowing cases. There is also evidence that the company reviews its whistleblowing mechanism on an annual basis.

However, the company receives a score of ‘1’ because there is no clear evidence that staff responsible for conducting investigations are properly trained or qualified. In addition, the company does not provide any information to indicate how complaints about the investigation are handled or who is responsible for handling such complaints.

There is evidence that the company makes a clear commitment to report material findings of corruption from investigations to the board. The company states that the ‘Competent Authority’ (the Chairman and Managing Director) is ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if found necessary.

There is some evidence that the company publishes information about complaints in relation to vigilance matters. However, the company receives a score of ‘0’ because there is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. There is evidence to indicate that risk assessments are reviewed by the board on an annual basis and that the results are used to update specific parts of the company's anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company’s ethics and compliance programme is subject to annual review, supplemented with periodic audits and external assessments. The company indicates that it conducts continuous monitoring of its compliance programme to maintain its effectiveness, and states that such processes are built into all levels of the business. There is evidence that the company’s board-level Audit Committee reviews the results of these assessments and there is evidence that the company’s Senior Vice President of the Office of Internal Governance and Administration is responsible for making updates and improvements to the programme on this basis.

Based on publicly available information, there is evidence that the company has a system in place to track, investigate and respond to bribery and corruption allegations or incidents, which includes those reported through whistleblowing channels. There is evidence that the company takes steps to ensure the independence of its investigations, as well as committing to establish root causes, put in place remediation plans and implement procedures to report investigative findings to senior management and the Audit Committee.

In addition, the company’s procedure stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome, and it commits to keeping individuals informed of the outcome of investigations if they so wish. There is evidence that the company’s Audit Committee reviews summary information of all allegations and investigations on a bi-monthly basis.

Based on publicly available information, there is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels. The company clearly states that staff tasked with conducting investigations are properly qualified and trained to perform the function. There is evidence that any complaints about the handling of concerns and investigations are overseen by an appropriate senior management officer and a procedure is in place to handle the escalation of complaints. The company indicates that its investigations procedure is subject to ongoing evaluation with a management review conducted on an annual basis.

Based on publicly available information, there is evidence that the company commits to report material findings from investigations to the board. There is evidence that a senior manager in the law department is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is evidence that the company publishes high-level data from ethical investigations involving employees at all levels. This data includes the number of reports received (including those reported through whistleblowing channels), the number of investigations launched and the number of disciplinary actions as a result of investigation findings. There is evidence that this data is published on an annual basis covering cases for the last 12 months

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-bribery and corruption programme, and that the results of risk assessments are reviewed by the board on at least an annual basis or when the results of the risk assessments reveal significant findings. The company states that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

The company states that its anti-bribery and corruption programme is subject to regular audit and review, the results of which are presented to the board.

However, the company receives a score of ‘1’ because it does not specify that the entire programme is audited to ensure that it is consistent with high standards of best practice and the business risks facing the company.

There is evidence that the company publicly commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases. There is also evidence that all investigations are documented and that whistleblowers are provided updates on the outcome of investigations, if they so wish. There is evidence that investigations are handled by an independent team.

However, the company does not provide information covering the whole investigative process, from receipt to final outcome, and there is no evidence that a central body reviews the status of investigations on an annual or regular basis.

There is no publicly available evidence that the company assures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

The company commits to report material findings of bribery and corruption to the board. There is evidence that the company’s Chief Legal Officer is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions.

Based on publicly available information, there is some evidence that the company has a risk assessment procedure in place that informs the design of its compliance-related policies. There is evidence that the board-level Culture, Character, Integrity and Ethics Committee is responsible for reviewing results of risk assessments and ensuring that the results of such assessments are used to update specific parts of the anti-corruption programme. In addition, there is evidence to indicate that the board reviews and evaluates the company’s business ethics policies on an ongoing basis, and that it has oversight of related risks facing the company.

There is some evidence that the company’s anti-bribery and corruption programme is subject to regular review. The company indicates that the Culture, Character, Integrity and Ethics Committee is responsible for such reviews.

However, it is not clear from publicly available information that the company’s entire anti-bribery and corruption programme is subject to a formal audit or equivalent assurance process to ensure that it is consistent with best practice and the business risks facing the company.

There is evidence that the company publicly commits to investigating incidents promptly, and that it has a specific procedure in place to deal with whistleblowing cases. The company indicates that reports received through its whistleblowing channel are handled by the General Counsel and a group of other senior individuals for further investigation and evaluation. The company also publicly commits to take appropriate action where improper conduct is identified.

However, there is no publicly available evidence that the company provides information on the whole investigation process from receipt to final outcome, for both whistleblowing cases and reports through direct channels. In addition, there is no publicly available information to indicate that the company commits to inform whistleblowers of the outcome of investigations, nor is there evidence that a central body reviews summary information of all cases and their status in the organisation on an annual basis.

There is some evidence that the staff responsible for conducting the company’s internal investigations are properly trained and qualified to perform the function.

However, there is no further publicly available information on how the company ensures the quality of its investigations, for example by indicating that it has a procedure in place to receive and escalate complaints about the handling of investigations or by reviewing its investigative procedure at least every three years or in response to any changes in the regulatory environment. It is also not clear from publicly available evidence that staff responsible for handling allegations received through direct channels are properly trained and qualified, in addition to those associated with the whistleblowing channel.

There is evidence that the company commits to report material findings of bribery and corruption from internal investigations to various senior individuals, including the General Counsel and the Chairman of the Audit Committee, depending on the nature of the report and the channel through which it was reported.

However, the company receives a score of ‘1’ because it is not clear from publicly available information that material findings are reported to the board of directors as part of the investigation process. In addition, although the company states that it will disclose criminal offences to the relevant authorities, there is no clear evidence that an appropriate senior individual is responsible for ensuring that such disclosures are evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption reports, investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-corruption and bribery programme. The Annual Information Form provides evidence that the board conducts quarterly and annual reviews of risks, including corruption. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is evidence that the company’s Ethics and Compliance programme has recently been subject to a diagnostic to ensure that it is consistent with best practice, and that the company conducts periodic audits of areas of risk. There is evidence of clear ownership assigned to the Global Ethics and Compliance Office for planned updates and improvements based on audit findings.

However, the company scores ‘0’ as it does not clearly state how frequently audits are conducted. Also, while there is evidence that the results of the recent diagnostic was presented to the board-level Governance Committee, there is no further evidence that audit findings in relation to the anti-bribery and corruption programme are presented to the board.

There is evidence that the company has a system for tracking, investigating and responding to bribery and corruption allegations or incidents, including those reported through whistleblowing channels. There is evidence that the company takes steps to ensure the independence of its investigations and reports investigative findings to senior management and the board.

There is also evidence that the company has specific procedures in place for whistleblowing cases, stipulating documentation and actions to be taken at every step of the case, from receipt to final outcome, and that the company’s Governance Committee receives and reviews summary information of all incidents and investigations and their status on a quarterly basis.

However, the company receives a score of ‘1’ because there is no evidence of a commitment to inform whistleblowers of the outcome of investigations, if they so wish.

There is insufficient publicly available evidence that the company takes measures to assure itself of the quality of its internal investigations.

There is clear evidence that the company commits to report material findings of bribery and corruption from investigations to the board.

However, the company receives a score of ‘1’ because there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

In its 2019 Corporate Social Responsibility Report the company published a summary of the number of reports submitted to its whistleblowing line, which included ethics and compliance-related data.

However, the company receives a score of ‘1’ because the data does not include details concerning the number of investigations or disciplinary actions.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

The company does not state that its anti-bribery and corruption programme is subject to audit or review.

The company does not have a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence of an investigative procedure which includes a commitment to report material findings.

The company does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. The results of risk assessments are reviewed by the board on at least an annual basis, or when the results of the risk assessments reveal significant findings. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is evidence that the company’s anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. This includes provisions for continuous improvement, supplemented by an internal or external audit annually. There is also evidence that high-level audit findings are presented to the board, with clear ownership assigned to units for planned updates and improvements to the anti-bribery and corruption programme.

There is evidence that the company publicly commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases.

However, the company receives a score of ‘1’ because the procedure does not stipulate documentation and actions to be taken at each step nor does it cover the whole investigation process from receipt to final outcome. Furthermore, it is unclear whether the investigations are handled by an independent team and/or report to an independent board member. Also, there is no commitment to providing whistleblowers with updates on the outcome of investigations. Additionally, there is no evidence that the information on each investigation is documented or that summary information is reviewed by a central body.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company’s investigative procedure includes a commitment to report material findings to the board of directors or the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company clearly states that its anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company publishes any information on its procedures for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company publishes an investigative procedure which includes a commitment to report material findings.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is some evidence that the company has a formal risk assessment procedure in place that informs the design of its anti-bribery and corruption activities on an annual basis. The company indicates that it monitors and assesses the performance of its employees in implementing anti-corruption measures and there is evidence that it recognises the different corruption risks faced by employees in different positions. There is some evidence that the results of these assessments are used to make recommendations for management on how to better counter the corruption risks identified.

However, the company receives a score of ‘1’ because there is no evidence that the company has a group-wide risk assessment procedure, rather than one targeted at specific employees or job roles. There is also no evidence that the company has a group-wide anti-bribery and corruption programme that is designed or adapted based on this procedure. Moreover, the company states that ‘management’ is responsible for reviewing the results of such assessments, but it is not clear that this includes board-level review.

Based on publicly available information, there is no clear evidence that the company has an anti-bribery and corruption programme nor that this programme is subject to audit or review. There is some indication that the company reviews the risks facing employees in certain departments and positions, but there is no evidence that it has a group-wide programme which is subject to review on a regular basis.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company takes steps to assure itself of the quality of its internal investigations.

There is no evidence that the company has an investigative procedure which includes a commitment to report material findings to the board or, if necessary, to the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-corruption and bribery programme. The company indicates that risk assessments are conducted and reviewed by the board-level Audit Committee on an annual basis. In addition, there is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company’s anti-bribery and corruption programme.

There is evidence that the company’s anti-bribery and corruption programme is subject to regular review, and that the results of audits and reviews are presented at board level. There is further evidence that the Business Ethics & Compliance Committee holds responsibility for implementing suggested improvements to the company’s programme resulting from audits and reviews, with oversight of the company’s board.

However, the company receives a score of ‘1’ because it is not clear that its entire programme is audited or reviewed at least every two years.

There is evidence that the company publicly commits to investigating incidents promptly, independently and objectively. There is evidence that the company takes steps to ensure the independence of the teams carrying out investigations, and the company commits to put in place remediation plans and report investigative findings to senior management and the board. For whistleblowing cases, there is a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome. There is also evidence that the company commits to ensure whistleblowers are informed of the outcome.

In addition, the company indicates that a senior committee – Ethics & Compliance Working Group – receives and reviews summary information on investigations and regularly reports key findings to senior management. There is also evidence that the Group Executive receives monthly reports on ethics and compliance related issues.

There is evidence that the company takes steps to assure itself of the quality of its internal investigations, including those reported through whistleblowing channels. The company indicates that staff tasked with conducting investigations are properly qualified and trained to perform the function. There is evidence that the company reviews its investigations procedure annually.

However, the company receives a score of ‘1’ because there is no evidence that it has a procedure in place to handle complaints about the investigation process or to escalate such complaints to senior management for review if necessary.

There is evidence that the company commits to report material findings of bribery and corruption from investigations to the board and to senior management.

However, the company receives a score of ‘1’ because there is no evidence that its investigative procedure includes a commitment to report material findings from internal investigations to the relevant authorities if necessary, nor is there evidence that a senior individual responsible for ensuring that such disclosures are evaluated and acted upon.

There is evidence that the company publishes high-level data from ethical incidents and investigations involving company employees at all levels. This includes the number of investigations launched and the number of disciplinary actions taken as a result of investigation findings. The number of investigations launched is understood to reflect the number of reports received. There is evidence that this data is published and updated on an annual basis.

There is no evidence that the company’s anti-bribery and corruption programme is designed and adapted based on an assessment of risk. Although there is evidence that the company has a broader Enterprise Risk Management process, details about this as it relates to the anti-bribery and corruption programme is insufficient to merit a score of ‘1’.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review, and the company does not clearly state how frequently audits are conducted or whether the findings are used to update the programme.

There is evidence that the company publicly commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step. Information on whistleblower reports is held by EthicsPoint, the operator of the company’s external whistleblower channel. Whistleblower reports are made available to the Ethics and Corporate Compliance Group, as well as appropriate members of the company’s management. The company commits to providing whistleblowers with updates on the outcome of investigations where legal. The Chief Ethics and Compliance Officer provides summary information on reports received to the Ethics and Corporate Responsibility Committee.

However, it is not clear how frequently the committee reviews this summary information or whether it is on a regular basis.

There is no evidence that the company assures itself of the quality of its investigations. Although the company indicates that individuals receiving reports receive some training regarding the confidentiality of the investigations, there is nothing to suggest that they are otherwise trained or qualified. Furthermore, there is no evidence that the company has a system in place for handling complaints about investigations themselves, or whether an appropriate senior individual would be responsible for oversight of such a process. Finally, there is no evidence that the company reviews its investigations procedure at least every three years, or in response to any changes in the regulatory environment.

There is evidence that the company commits to report material findings of bribery and corruption from investigations to the board level Ethics and Corporate Responsibility Committee and the Audit and Compliance Committee.

However, there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations, or disciplinary actions involving its employees.

There is evidence that the company has a risk assessment procedure in place that informs its decisions and the design of the company’s programmes. However, there is no publicly available evidence that this risk assessment procedure informs the design of the company’s anti-corruption and bribery programme. Publicly available documents refer to ‘compliance’ generally and seem to focus on financial risk rather than anti-bribery and corruption risks.

There is evidence that the company organises internal audits to ensure full compliance with all relevant laws, regulations and internal policies. The company also states that the Code of Conduct for Directors is reviewed on an annual basis. However, it is not clear from publicly available evidence that the anti-bribery and corruption programme itself is subject to audit or review, or whether findings are used to update the programme.

There is evidence that the company publicly commits to investigating allegations and incidents promptly and objectively. There is evidence that the company has specific procedures in place to involve the Legal Department and any other relevant business units in investigations. In addition, there is evidence that the company takes steps to ensure the independence of investigations through the use of an externally-operated hotline; however there is no evidence of how the company ensures this when evaluating reports internally.

The company receives a score of ‘1’ because it does not provide further details of its investigative procedure – both for reports received through the whistleblowing hotline and those reported directly – and does not stipulate documentation of cases beyond recording allegations through the hotline. There is also no evidence that the company commits to ensure whistleblowers are informed of the outcome, if they so wish. Furthermore, there is no evidence that summary information is reviewed by a central body at least on an annual basis.

There is some evidence that the company takes steps to ensure the quality of its internal investigations, including those reported through whistleblowing channels. The company states that representatives from the Legal Department are responsible for receiving internal reports and that EthicsPoint representatives who receive allegations through the third-party hotline are properly trained.

However, the company receives a score of ‘0’ because there is no evidence that it has procedures in place to receive, handle and escalate, if necessary, complaints about the investigation process. There is also evidence that individuals outside the Legal Department that might be involved in investigations and properly trained, nor is there evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

There is no clear evidence that the company commits to report material findings of bribery or corruption from investigations to the Board of Directors and, if necessary, to the relevant authorities. The company states that Directors must report any violations to the Chairman of the board-level Committee on Directors and Governance, however it is not clear that this applies to employees at other levels involved in handling investigations. The company also states that violations may be reported to government authorities, but there is no evidence that a specific senior individual has responsibility for ensuring this disclosure.

There is no evidence that the company publishes data on ethical or bribery and corruption-related investigations or disciplinary actions.

Based on publicly available information, there is some evidence that the company has a formal risk assessment procedure that informs the design of its ethics programme.

However, the company receives a score of ‘1’ because there is limited publicly available information concerning this procedure. There is also no clear evidence that risk assessments are reviewed on at least an annual basis at board level.

Based on publicly available information, there is some evidence indicating that the company’s ethics programme is subject to continuous review by the internal audit department. However, there is evidence that this department is also responsible for implementing the programme and it is unclear based on publicly available evidence whether there is a separate, independent review of the programme. There is also no clear evidence that the findings of audits are used to update the company’s anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company publicly commits to investigating incidents and that there is a specific procedure in place to deal with whistleblowing cases which stipulates actions to be taken and documented at each step. There is evidence that investigations are carried out by an independent team and reported to the Audit Committee. The company’s stated procedure covers the whole investigation process from receipt to final outcome. There is further evidence that the company informs whistleblowers of the outcome of investigations.

Based on publicly available information, there is some evidence that the company assures itself of the quality of its internal investigations. The company states that its internal audit department, which carries out investigations, takes steps to ensure that investigators are sufficiently trained and qualified to perform investigations.

However, there is no clear evidence that the company assures itself of the quality of both incident investigations and whistleblowing cases. In publicly available information, there is no evidence of how complaints about the investigation process are handled. There is also no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

Based on publicly available information, there is evidence that the company commits to report material findings of bribery and corruption investigations to the board and external authorities. However, there is no evidence that the company has an appropriate senior individual who is responsible for ensuring the disclosure of criminal offences to the relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or the disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its compliance programme. The risk assessments are conducted at board level and reviewed at least annually or when the results of the risk assessments reveal significant findings. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company’s anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company’s compliance programme is subject to regular review. The company states that external audits are conducted annually, the results of which are reviewed by a board-level committee.

However, the company does not specify that the entire anti-bribery and corruption programme is audited to ensure that it is consistent with high standards of best practice and the business risks facing the company.

Based on publicly available information, there is evidence that the company publicly commits to investigating incidents and there is a specific procedure in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step. The company’s policy covers the whole investigation process from receipt to final outcome. There is evidence that investigations are handled by an independent team and that the company commits to providing whistleblowers with updates on the outcome of investigations. There is also evidence that information on each investigation is documented and that summary information is reviewed by a central body on at least an annual basis.

Based on publicly available information, there is evidence that the company assures itself of the quality of its internal investigations. There is evidence that the company assures itself of the quality of both incident investigations and whistleblowing cases. There is also evidence that staff conducting investigations are properly qualified.

However, there is no evidence on how complaints about the investigation process are handled or who is responsible for handling such complaints. There is also no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

Based on publicly available information, there is evidence that the company commits to report material findings
of bribery and corruption from investigations to the board.

However, there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

Based on publicly available information, there is evidence that the company publishes some high-level information on its ethics and compliance related incidents and investigations involving company employees.

However, it is not clear the information provided applies to employees at all levels in the company, nor is there evidence that the data provided includes the number of reports received, including those through whistleblowing channels, or the number of investigations launched.

There is evidence that the company has a formal bribery and corruption risk assessment procedure in place that informs the design of the anti-corruption and bribery programme. The company indicates that its risk management system includes a mapping of all relevant corruption risks and that there is evidence that the results of such reviews are used to update specific parts of its anti-corruption programme.

However, there is no clear publicly available evidence that such assessments are undertaken on at least an annual basis, nor is there clear evidence that the results are reviewed at board level.

Based on publicly available information, there is some evidence that the company’s anti-corruption programme is subject to annual audit or review. The company indicates that it has systems in place to review and evaluate its anti-corruption measures, and there is evidence to indicate that the Ethics Department is responsible for implementing planned updates to the programme on the basis of such reviews.

However, it is not clear from publicly available information that the company’s review process includes clear internal and/or external audits of the entire anti-corruption programme, to ensure that it is consistent with best practice and the business risks facing the company. There is also no clear publicly available evidence to indicate how frequently these reviews are undertaken, nor is it clear that high-level findings are presented to the board.

There is some evidence that the company has procedures in place to deal with allegations, incidents and whistleblowing reports relating to possible bribery and corruption. The company indicates that it has established an internal alert procedure and that the Ethics Department, which reports to the Chairman-Chief Executive Officer, is responsible for this process.

However, the company receives a score of ‘0’ because there is no publicly available evidence that the company has a specific procedure to deal with whistleblowing cases that stipulates clear documentation and actions to be taken at each step. There is also no clear evidence that the company takes steps to ensure the independence of its investigations, nor that it commits to inform whistleblowers of the outcome of investigations. The company’s investigation procedure, from receipt to final outcome, is not clear from publicly available information.

There is no publicly available evidence that the company assures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

There is no publicly available evidence that the company has an investigative procedure in place which includes a commitment to report material findings of bribery and corruption to the board and any criminal conduct to the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. The results of risk assessments are reviewed by the Ethics and Compliance Committee on a quarterly basis. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is evidence that the company’s entire anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. There is evidence that this includes provisions for continuous improvement, which are supplemented by annual internal audits. There is also evidence that high-level audit findings are presented to the Ethics and Compliance Committee and Leadership Council, which recommends changes, if appropriate, to the company’s ethics and compliance programme.

There is evidence that the company has a system for tracking, investigating and responding to bribery and corruption allegations or incidents, including those reported through whistleblowing channels. There is evidence that the company takes steps to ensure the independence of its investigations and reports investigative findings to the Ethics and Compliance Committee. There is evidence that for whistleblowing cases, the company has a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome. The company commits to ensure whistleblowers are informed of the outcome, if they so wish. There is evidence that the Ethics and Compliance Committee receives and reviews summary information of all incidents and their status in the organisation and its subsidiaries, on at least a quarterly basis.

There is some evidence that the company assures itself of the quality of its internal investigations. There is evidence that staff conducting investigations are properly trained and qualified.

However, in publicly available evidence there is no mention of how complaints about the investigation process are handled and it is unclear who would be responsible for handling such complaints. There is no clear evidence that the company reviews its investigations procedure at least every three years or in response to any relevant changes in the regulatory environment. It is also unclear from publicly available evidence if the company assures itself of the quality of both incident investigations and whistleblowing cases.

There is evidence the company commits to reporting material findings of bribery and corruption to members of its Leadership Council. There is evidence that an appropriate senior individual, the General Counsel, is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary. It is noted that the company only makes reference to authorities in the United States.

The company publishes some high-level data on calls received on its ethics and corruption reporting service.

However, it does not publish data on ethical and corruption-related investigations or disciplinary actions involving its employees.

The company has a risk assessment process managed by the Risk and Finance Committee. While this makes reference to fraud risk evaluation, there is no evidence that the company specifically refers to assessment of bribery and corruption risks.

There is evidence that the company’s mitigations for fraud and corruption include provisions for continuous review of internal controls by internal audit. However, the company receives a score of ‘0’ because further details are not provided, for example, it is not clear how frequently audits are conducted or whether the findings are used to update the anti-bribery and corruption programme.

There is evidence that the company commits to investigating incidents, which are monitored by the Audit Committee and Social Ethics Committee. However, the company receives a score of ‘1’ because it does not provide details on its investigation process from receipt to final outcome. It is also not fully clear which team or individual currently conducts investigations and whether evidence on each investigation is documented. The company does not make a commitment to providing whistleblowers with updates on the outcome of investigations. In addition, it is not clear whether the Audit Committee or Social Ethics Committee review summary information on investigations on a regular, at least quarterly, basis.

In its 2018 Annual Report, the company describes plans to establish a penal to ensure that cases are independently investigated. However, publicly available information does not contain any further information on what changes were made and whether they were implemented.

There is no evidence that the company assures itself of the quality of its internal investigations. The company states that ethics matters are monitored by the Audit Committee and Social Ethics Committee, but it is not clear whether the committees review the company’s investigation procedures. Moreover, there is no evidence that staff tasked with conducting investigations are properly trained to perform the function, nor that a procedure is in place to handle complaints about the process.

In its 2018 Annual Report, the company describes plans to establish a penal to ensure that cases are independently investigated. However, publicly available information does not contain any further information on what changes were made and whether they were implemented.

There is no evidence that the company’s investigative procedure includes a commitment to report material findings to the board or relevant authorities. The company states that ethics issues are monitored and reported to the board-level Audit Committee and Social and Ethics Committee, but it is not clear from this statement whether this specifically applies to material findings, nor how direct this reporting line is to the board itself. Moreover, there is no evidence that an appropriate senior individual within the committees is responsible for ensuring this disclosure, if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption-related investigations or disciplinary actions involving its employees. In its 2018 Annual Report, the company makes reference to one corruption allegation involving former senior management at the company, but this is not counted as high-level data from all ethics investigations.

There is some evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-corruption and bribery programme. The company indicates that its Corporate Compliance Officer (CCO) is responsible compliance risk assessments and there is some evidence that the CCO reports to the board on a regular basis; however, there is no clear publicly available information that the results of risk assessments are reviewed by the board on at least an annual basis. There is also no clear evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is some evidence that the company conducts compliance reviews on its business processes, however it does not provide any further publicly available evidence to indicate that this may include an internal or external audit of the anti-corruption programme itself. There is also no clear evidence that high-level findings are presented to the board, nor is it clear that ownership for planned improvements is assigned to a specific individual or committee.

There is evidence that the company commits to investigating incidents and there is a specific procedure in place to deal with whistleblowing cases through its independent corporate ombudsman. The board reviews findings related to bribery and corruption incidents within the company, although it is not explicitly stated that it reviews summary information on investigations on at least a quarterly basis.

However, the company receives a score of ‘1’ because in publicly available information it does not publish details of its whole investigation process from receipt to final outcome. There is also no publicly available evidence that it commits to providing whistleblowers with updates on the outcome of investigations.

There is no publicly available evidence that the company assures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

There is clear evidence that the company commits to report material findings of bribery and corruption from investigations to the board. In addition, there is evidence that an appropriate senior individual – the Corporate Compliance Officer – is ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon, if necessary.

The company states that it received reports from employees on bribery and corruption in the most recently reported financial year, and indicates that it conducted investigations and took disciplinary actions as a result. However, there is no evidence that the company publishes any data to accompany this statement, such as the number of reports received, number of investigations launched and number of disciplinary actions taken as a result.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme. While the company refers to internal processes for the evaluation of risk and a risk management process, it does not make any mention of bribery and corruption risk.

There is evidence that the company’s anti-corruption programme is subject to regular review and audit to ensure the entire programme is consistent with best practice and the business risks facing the company. The company explicitly refers to provisions for continuous improvement through regular monitoring by its internal audit department and external audits. In addition, the company undergoes an external audit on an annual basis. A quarterly briefing on this work is provided to the Audit Committee and there is evidence that high-level audit findings are presented to the board, with clear ownership assigned to units for planned updates and improvements to the anti-bribery and corruption programme.

There is evidence that the company commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken. There is evidence that the Business Ethics and Compliance Committee receives summary information on the status of investigations.

However, this does not cover the whole investigation process from receipt to final outcome, and it is unclear whether information on each investigation is documented. There is no evidence that investigations are handled by an independent team and/or report to an independent board member. The company also does not publicly commit to providing whistleblowers with updates on the outcome of investigations. Finally, it is unclear how frequently the Business Ethics and Compliance Committee receives and reviews information on the investigations.

There is no evidence that the company assures itself of the quality of its internal investigations. While government investigations require the involvement of the legal department, it is not clear whether a specific function or appropriately senior individual is responsible for conducting all incident investigations and managing all whistleblowing cases. There is no mention of how complaints about the investigation process are handled. Also there is no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

There is evidence that material findings of bribery and corruption are reported to a designated board committee, the Business Ethics and Compliance Committee.

However, although the company commits to cooperating with government investigations, there is no evidence that it commits to reporting material findings of bribery and corruption to relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme. There is some indication that the company is aware of the potential bribery and corruption risks that it faces, but there is no evidence that it has an assessment process to determine these risks or to adapt and update its anti-corruption programme on this basis.

Based on publicly available information, there is evidence that the company’s anti-bribery and corruption programme is subject to periodic review. The company indicates that it reviewed its ethics and anti-corruption procedures in 2018 and there is evidence that its policies and procedures were updated and improved based on opportunities identified. There is also evidence that the board and Audit Committee review high-level findings.

However, the company receives a score of ‘1’ because there is no clear publicly available evidence that it has procedures in place to conduct formal audits of its programme, with an internal or external audit taking place at least every two years.

There is evidence that the company publicly commits to investigating incidents and there is evidence that it takes steps to ensure the independence of its investigations. It commits to reporting investigative findings to senior management and the Audit Committee, including root cause analysis and remedial or mitigation recommendations.

There is evidence that there is a procedure in place for whistleblowing cases that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome, and the company indicates that it has a mechanism to keep whistleblowers informed of the outcome. In addition, the company indicates that the CCO and the Audit Committee receive and review summary information of all incidents and their status in the organisation upon the completion of every investigation.

Based on publicly available information, there is no clear evidence that the company assures itself of the quality of its internal investigations. The company provides some evidence to indicate senior functions are involved in investigations and that the ethics procedures as a whole are reviewed periodically, but it is not clear from publicly available evidence that the company has specific measures in place to ensure the quality of its investigative procedure specifically, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

There is evidence that the company makes a public commitment to report material findings of bribery and corruption from investigations to the board and to the relevant authorities. The company indicates that its Chief Compliance Officer, along with the Chief Legal Officer, is ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is evidence that the company publishes some information on its corruption-related incidents and investigations involving company employees. The company provides information to indicate that it did not have any confirmed incidents of corruption in the most recently reported financial year.

However, the company receives a score of ‘1’ because there is no publicly available evidence that it publishes further data on its incidents and investigations, such as the number of reports received, including the number received through whistleblowing channels, and the number of investigations launched to determine whether an incident had occurred.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-corruption and bribery programme. The company indicates that risk assessments are reviewed annually by the Board of Executive Officers, and this body reports to the Audit, Risk and Ethics Committee. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company’s anti-bribery and corruption programme is subject to regular review. However, the company receives a score ‘0’ because it is not clear how frequently these audits or reviews are conducted, nor is there evidence to indicate that the findings are used to update the company’s anti-bribery and corruption programme.

There is evidence that the company publicly commits to investigating incidents, and there is evidence that the company documents information on each investigation.

However, the company receives a score of ‘1’ because there is no evidence that it publishes information on the whole investigation process from receipt to final outcome, nor is it clear that the company takes steps to ensure the independence of its investigations. There is also no evidence that a central body reviews the status of investigations on at least an annual basis. Although there is evidence of an option for whistleblowers to monitor the progress of an investigation, there is no evidence that the company makes a clear commitment to providing whistleblowers with updates on the outcome of investigations.

Based on publicly available information, there is no evidence that the company assures itself of the quality of its internal investigations.

There is no clear evidence that the company commits to report material findings from internal investigations to the board or to the relevant authorities, if necessary. There is some indication that reviewing reports falls under the remit of the Audit, Risk and Ethics Committee, however it is not clear that this may include handling and escalating material findings or criminal conduct to the board or authorities.

There is evidence that the company publishes some data on the reports made to its Helpline in 2017. The company also publishes a statement that in 2017 and 2018 there were no confirmed cases of corruption. The company’s data is disaggregated to give the number of investigations launched and the number of disciplinary actions as a result of investigation findings.

However, the company receives a score of ‘1’ because there is evidence that this data only relates to one specific reporting channel, so it is not clear that it covers all incident investigations. There is also no evidence that the information is published on an annual basis.

Based on publicly available information, there is some evidence that the company engages in regular risk assessment procedures in the form of annual internal audits. However, there is no clear evidence that the company’s anti-bribery and corruption programme as a whole is designed and updated as a result of these assessments. There is also no evidence that the results of risk assessments are reviewed at board level.

Based on publicly available information, there is some evidence that the company’s anti-bribery and corruption programme is subject to regular review in the form of annual internal audits. In addition, the company indicates that it conducts random checks, inspections, and questionnaires to determine the efficacy of its anti-corruption programme.

However, the company receives a score of ‘1’ because there is no evidence that audit findings are reviewed by the board. Moreover, there is no evidence that the company provides any information regarding ownership of this process, i.e. which body or senior individual is responsible for using the audit findings to make updates to the company’s programme. There is also no evidence that – in addition to ensuring the proper functioning of the company’s internal controls – these audits ensure that the programme is consistent with best practice.

Based on publicly available information, there is evidence that the company commits to investigating incidents and that there is a procedure in place to deal with whistleblowing cases. There is evidence that the group’s human resources department receives all complaints, and that it commits to informing whistleblowers of the outcome of investigations. There is some evidence to indicate that information on each investigation is documented.

However, the company receives a score of ‘1’ because there is no evidence that investigations are handled by an independent team or that the team leading investigations report to an independent board member. In addition, there is no evidence that a central body reviews summary information on all investigations.

Based on publicly available information, there is no evidence that the company takes steps to ensure the quality of its internal investigations.

Based on publicly available information, there is evidence that the company commits to reporting criminal offences to the relevant authorities. However, the company receives a score of ‘1’ because there is no evidence that material findings of bribery and corruption are reported to the board, nor that an appropriate senior individual is responsible for ensuring the disclosure of criminal offences.

There is no evidence that the company publishes high-level results from incident investigations and disciplinary actions against its employees.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. The results of risk assessments are reviewed by the board on at least an annual basis. There is evidence indicating that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company’s anti-bribery and corruption programme is subject to regular review. This includes provisions for continuous improvement, supplemented by an internal audit on an annual basis. There is evidence high-level audit findings are presented to the board, with clear ownership assigned to units/individuals for planned updates and improvements to the anti-bribery and corruption programme

There is evidence that the company publicly commits to investigating incidents promptly, independently and objectively. There is evidence that the company takes steps to ensure the independence of its investigations. It commits to establishing root causes, putting in place remediation plans and reporting investigative findings to senior management and the board. For whistleblowing cases, there is a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome, and the company commits to ensure whistleblowers are informed of the outcome. There is evidence that summary information of all investigations is reviewed by a central body. However, it is not clear that this information is reviewed on at least a quarterly basis.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations.

There is evidence that the company commits to report material findings of bribery and corruption from investigations to the board and to relevant authorities. However, based on publicly available information, the ownership process for reporting to relevant authorities is unclear. There is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

The company states that no cases of corruption concerning companies in the Group were found in the previous two years. However, the information published is insufficiently detailed. The company does not publish information on the number of reports received, the number of investigations launched or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-bribery and corruption programme. There is evidence that the results of such reviews are used to develop tailored mitigation plans and update the programme. The company indicates that three board-level committees – the Audit Committee, the Commercial Strategies and Operational Risk Committee and the Compliance and Ethics Committee – review the risk assessment procedures in the company and there is evidence that the company’s anti-corruption policies and procedures are reviewed on an annual basis.

There is evidence that the company’s anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. The company indicates that its Compliance and Ethics Committee is responsible for auditing the company’s compliance and ethics programme and there is evidence that it reports on a quarterly basis to the board-level Audit Committee. In addition, there is evidence that the Chief Compliance Officer is responsible for implementing planned updates and making improvements to the company’s anti-bribery and corruption programme based on audit findings.

There is evidence the company has a system for tracking, investigating and responding to bribery and corruption allegations or incidents, including those reported through whistleblowing channels. There is evidence that the Corporate Investigations team handles all ethics and compliance investigations with oversight from the Chief Compliance Officer. The company states that the Compliance and Ethics Committee receives and reviews summary information about investigations on an ongoing basis. There is evidence that the company commits to putting in place remediation plans and indicates that information on each investigation is documented.

In addition, there is evidence that the company commits to ensure that whistleblowers are informed of the outcome if they so wish. The Compliance and Ethics Committee provides information on cases and updates the Audit Committee on a quarterly basis.

There is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels. The company indicates that staff conducting the investigations are properly trained. There is evidence that the company’s Corporate Compliance Department reviews and updates the reporting and investigation guidelines at least every three years or in response to any changes required by law.

However, the company receives a score of ‘1’ because there is no publicly available evidence to indicate how complaints about the investigation process are handled and who is responsible for handling such complaints.

There is evidence that the company commits to reporting material findings of bribery and corruption from internal investigations to the board-level Audit Committee. There is also evidence that the company commits to implement a procedure to ensure the disclosure of any ethics and compliance violations to relevant government officials or authorities. The company indicates that the Vice President, Corporate Compliance is the chair of the Compliance and Ethics Committee, and therefore this individual is understood to be responsible for ensuring that such disclosures are evaluated and acted upon if necessary.

There is evidence that the company publishes some high-level information on its compliance and ethics investigations, including the total number of investigations launched and the percentage of cases that related to bribery or conflicts of interest.

However, the company receives a score of ‘1’ because there is no evidence that it publishes any information on the number of disciplinary actions taken as a result of investigation findings. It is also not clear whether the information provided includes all investigations involving at all levels, including board members.

Based on publicly available information, there is evidence that the company has a formal risk assessment procedure that informs the design of its anti-bribery and corruption programme. There is evidence the assessments are reviewed by the Risk Management and Compliance Committee, a designated board committee, and that the results are used to update the company’s anti-bribery and corruption programme.

However, while the company states that risk assessment are conducted regularly, it is unclear whether they are conducted and reviewed on at least an annual basis.

Based on publicly available information, there is evidence that the company’s anti-bribery and corruption programme is subject to regular review. This includes provisions for continuous improvement, supplemented by internal and external audits, to ensure that the programme is consistent with the business risks facing the company. There is evidence that the results of audits are reported to the Risk and Compliance Committee, a designated-board committee.

However, based on publicly available information, the frequency of audits is unclear and there is no clear evidence that audits of the entire anti-bribery and corruption programme are conducted at least every two years.

There is evidence that the company publicly commits to investigating incidents promptly, independently and objectively, and that there is a specific procedure in place to deal with whistleblowing cases. The company’s compliance department is responsible for conducting investigations, and has procedures in place that stipulate documentation and actions to be taken at every step, from receipt to final outcome. The company commits to put in place remediation plans and to report investigative findings to senior management and the Risk Management and Compliance Committee, which receives information concerning all investigations on a regular basis. There is also evidence indicating that information on each investigation is documented and that the company informs whistleblowers of the outcome of investigations.

Based on publicly available information, there is some evidence that the company assures itself of the quality of its investigations. The company indicates that managers supervising investigations must be properly qualified and that it reviews its investigation procedure on an annual basis.

However, in publicly available information, there is no mention of how complaints about the investigation process are handled.

Based on publicly available information, there is evidence that the company reports material findings of bribery and compliance to the board. The compliance team is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if found necessary.

The company publishes limited information on ethical or bribery and corruption investigations or the disciplinary actions involving its employees. The company provides details concerning one case in its 2019 Sustainability Data Book. However, there is no evidence that it publishes high-level information on all ethical, bribery or corruption incidents and investigations involving employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure in place that informs the design of its anti-bribery and corruption programme. There is evidence that the results of risk assessments are reviewed by the board-level Audit Committee that oversees the programme. There is also evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is evidence that the company’s entire anti-corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. There is evidence that the company conducts annual internal audits, supplemented by external audits, on a regular basis. There is evidence that the Audit Committee reviews audit findings on an annual basis, and that that the company’s management are tasked with implementing required changes identified through audits.

There is evidence that the company publicly commits to investigating incidents promptly and objectively, and that it has a specific procedure in place to deal with whistleblowing cases. The company provides information on its investigative procedure with documentation and actions to be taken at each step, from receipt to final outcome. The company commits to informing whistleblowers of the outcome of investigations, if they so wish.

In addition, there is evidence that all investigations are handled by independent teams. There is evidence that the company’s Corporate Ombudsperson's Office gathers and reviews summary information on investigations and that this body submits reports on investigations to the company’s Audit Committee on a regular basis.

There is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels. The company indicates that the staff conducting investigations are properly qualified and trained to perform this function. There is some evidence that the company has a procedure for handling complaints about the investigation process; the company states that concerns are raised to an appropriate higher level for review. In addition, there is evidence that investigations are conducted under the Corporate Ombudsman programme, which is subject to an annual review.

There is evidence that the company commits to report significant findings from ethics and corruption investigations to board via the Audit Committee. In addition, there is evidence that company’s General Counsel is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is evidence that the company publishes high-level data from bribery and corruption-related incidents and investigations involving company employees at all levels. This includes the number of reports received, information about the number of investigations launched and the number of disciplinary actions as a result of investigation findings. There is evidence that the company publishes and updates this data on an annual basis.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no publicly available evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company has an investigative procedure which includes a commitment to report material findings to the board of directors or the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is no evidence that the company has a formal risk assessment procedure in place that informs its anti-bribery and corruption programme. Although there is evidence that the company has a risk management strategy, it is not clear that such a procedure includes anti-corruption considerations or that the results of these assessments are used to inform the design of its anti-bribery and corruption programme.

There is evidence that the company’s anti-bribery and corruption programme, as part of its Standards of Ethics and Business Conduct, is subject to annual review by the Audit Committee. The company’s publicly available documents indicate that the Audit Committee has a direct line to report findings to the board.

However, the company receives a score of ‘1’ because there is no clear evidence that it conducts internal and/or external audits of its anti-bribery and corruption programme at least every two years, to ensure that the programme is consistent with high standards of best practice and the business risks facing the company.

There is evidence that the company publicly commits to investigating incidents promptly and that it has a specific procedure in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step. The company indicates that investigations are handled by an independent team and it provides information on the process from receipt to final outcome. The company states that whistleblowers will receive updates on the outcome of investigations. There is evidence that information on each investigation is documented and that summary information on all reports is held in a central database.

However, the company receives a score of ‘1’ because there is no evidence that the process includes reporting findings to an independent board member. There is also no evidence that summary information on investigations is reviewed by a central body on at least a quarterly basis.

There is some evidence that the company assures itself of the quality of its internal investigations, for example by indicating that its staff responsible for conducting internal investigations are professionally qualified.

However, the company receives a score of ‘1‘ because there is no evidence that it reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment. It is also not clear how complaints about the investigation process are handled, nor who might be responsible for handling such complaints.

There is evidence that the company commits to report material findings of bribery and corruption to the relevant authorities, if necessary.

However, the company receives a score of ‘1‘ because there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary. In addition, there is no clear evidence that material findings are reported to the board.

There is no evidence that the company publishes any data on ethical or bribery and corruption incidents, investigations or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure that is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to regular audit or review. Although the company commits to reviewing and updating its policies as a result of any allegations of corruption, this is insufficient to receive a score of ‘1’.

Although the company publicly commits to investigating incidents and providing feedback to whistleblowers, there is no clear evidence that of specific procedures in place to deal with complaints, which stipulates documentation and actions to be taken at each step.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company has an investigative procedure, which includes a commitment to report material findings to relevant authorities.

The company does not publish any data on ethical or bribery and corruption investigations, or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to regular audit or review.

There is no publicly available evidence that the company has a procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company takes steps to ensure the quality of its investigations.

There is no evidence that the company’s investigative procedure includes a commitment to report material findings to relevant authorities.

There is no evidence that the company publishes high-level results from incident investigations and disciplinary actions.

Based on publicly available information, there is evidence that the company has a formal corruption risk assessment procedure that informs the design of its anti-corruption programme. There is evidence that the results of the risk assessments are reviewed annually by the Compliance Committee. In addition, there is evidence to indicate taht the results of such asessments are used to update specific parts of the company’s anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company’s entire anti-corruption programme is subject to regular audit. The company indicates that this includes provisions for continuous improvement, supplemented by an internal audit every year. In addition, there is evidence that audit findings are presented to the board, with ownership assigned to the Compliance Committee for amendments to the anti-corruption programme.

There is evidence that the company publicly commits to investigating incidents and that it has a specific procedure in place to deal with whistleblowing cases. There is evidence that this procedure covers the whole investigation process from receipt to final outcome, and that it includes a commitment to providing whistleblowers with updates on the outcome of investigations. The company commits to put in place remediation plans and report investigative findings to senior management and the board upon the completion of every investigation. There is evidence to indicate that investigations are only undertaken by a qualified, independent team.

However, the company receives a score of ’1’ because there is no clear evidence that a central body reviews the status of all investigations on an annual basis.

Based on publicly available information, there is evidence that the company assures itself of the quality of its internal investigations, both for incident investigations and whistleblowing cases. There is evidence that staff conducting investigations are properly trained and qualified, and the company provides an explanation of how complaints about the investigation process are handled and who is responsible for handling such complaints.

However, there is no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

Based on publicly available information, there is evidence that the Compliance Team commits to report material findings of bribery and corruption from investigations to the board and to the relevant authorities. The company indicates that the Compliance Team is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

Based on publicly available information, there is evidence that the company publishes some high-level information on its ethics and compliance-related incidents and investigations involving company employees. The data is updated on at least an annual basis.

However, the company receives a score of ’1’ because there is no evidence that the company publishes disaggregated information to indicate the number of reports received, including those received through whistleblowing channels, and the number of disciplinary actions as a result of investigation findings.

Based on publicly available information, there is evidence that the company has a formal risk assessment procedure in place that informs the design of its ethics and compliance programme. The results of risk assessments are reviewed by the board’s Audit Committee on at least an annual basis. There is evidence that the results of such reviews are used to update specific parts of the company's ethics and compliance programme.

Based on publicly available information, there is evidence that the company’s ethics and compliance programme is subject to a regular audit process. The company indicates that it conducts audits on an annual basis and that the results are reviewed by the board-level Audit Committee, which provides oversight of the compliance programme. There is evidence to indicate that the company’s Ethics & Compliance Office is tasked with implementing planned updates and improvements to the ethics and compliance programme.

There is evidence that the company publicly commits to investigating incidents, and that it has a specific procedure in place to deal with whistleblowing cases. There is evidence that the information on each investigation is documented and that summary information on investigations is reviewed centrally on a regular basis.

However, the company receives a score of ‘1’ because it does not provide publicly available information on the whole investigation process from receipt to final outcome. There is also no evidence that it takes steps to ensure the independence of its investigations, for example by stating that cases are handled by an independent team or that staff conducting investigations report to an independent board member. There is also no clear evidence that the company commits to providing whistleblowers with updates on the outcome of investigations.

There is no publicly available evidence that the company assures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

Based on publicly available information, there is evidence that the company commits to report material findings of criminal conduct to the board-level Audit Committee. However, there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

The company publishes some high-level information on bribery and corruption-related incidents reported to its Standards of Business Conduct team. This data relates to the most recent reporting year and there is evidence indicating that it is updated annually.

However, the company receives a score of ‘1’ because it is unclear whether the data includes the number of reports received via whistleblowing channels. There is also no evidence that the company publishes information on the number of investigations launched or the number of disciplinary actions as a result of investigation findings.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is evidence that the company commits to investigating incidents, and that there is a specific procedure in place to deal with whistleblowing cases, which stipulates actions to be taken at each step. There is evidence that information on each investigation is recorded through the hotline system and that the company commits to informing whistleblowers with updates on the outcome of investigations.

However, the company receives a score of ‘1’ because there is no evidence that investigations are handled by an independent team and/or report to an independent board member, and there is no clear evidence that summary information is reviewed by a central body, or that the central body reviews the status of investigations on a regular or at least an annual basis.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is evidence that the company commits to reporting evidence of bribery and corruption to law enforcement in accordance with Russian federal law. However, there is no clear evidence of internal responsibility for reporting findings from investigations to the company’s leadership or board.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-bribery and corruption programme. There is evidence that the results of risk assessments are reviewed by the board on at least an annual basis. There is additional evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is evidence that the company‘s entire anti-corruption programme is subject to a regular audit and review process to ensure maximum efficacy and that it is consistent with best practice and the business risks facing the company, including provisions for continuous improvement. There is also evidence that audit findings are presented to the board, with clear ownership assigned to units and/or individuals for planned updates and improvements to the programme.

The company publicly commits to investigating incidents promptly, independently and objectively. There is evidence that the company takes steps to ensure the independence of its investigations and it commits to establishing root causes, putting in place remediation plans and reporting investigative findings to senior management and the board. For whistleblowing cases, there is evidence that there is a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome, and that the company commits to ensure whistleblowers are informed of the outcome, if they so wish. There is also evidence that the company’s Vigilance Commission receives and reviews summary information of all incidents and their status in the organisation and its subsidiaries, on at least an annual basis.

There is evidence that the company assures itself of the quality of its internal investigations by ensuring that investigative staff are adequately trained.

However, it is not clear that the company assures itself of the quality of both incident investigations and whistleblowing cases. Additionally, while there is some evidence suggesting that the company reviews its investigative procedures, it is unclear if this occurs at least every three years or in response to any changes in the regulatory environment. Furthermore, there is no evidence to suggest that the company has a system in place for escalating complaints about the investigative process itself.

There is evidence that the company reports instances of corruption to the board of directors. The company indicates that its Chief Vigilance Officer is responsible for referring material findings to the relevant authorities

There is evidence that the company publishes high-level data from ethical or bribery and corruption-related incidents and investigations involving company employees at all levels. The publicly available data includes the number of reports received, the number of investigations launched and the number of disciplinary actions brought against employees. The data covers the most recent reporting year.

However, there is no evidence that the company disaggregates its data to indicate the number of reports received via whistleblowing channels.

There is evidence that the company has formal procedures in place to conduct risk assessments on its operations which covers commercial, strategic, legal, compliance and reputational risks. There is some indication that these risks include ethics and anti-corruption as part of compliance. There is also evidence that both the Audit Committee and the Board review the results of these assessments on an annual basis.

However, the company receives a score of ‘1’ because it is not clear from publicly available evidence that the results of such risk assessments are used to inform the company’s anti-bribery and corruption programme.

There is evidence that the company reviews its internal procedures to identify legal and compliance risks on an annual basis, and there is also some evidence that the company’s Code of Business Conduct is reviewed on a regular basis. There is also evidence that the Board and Audit Committee are involved in this review process.

However, the company receives a score of ‘1’ because it is not clear from publicly available information that the company’s internal procedures – including its anti-bribery and corruption programme – are subject to internal audit or similar assurance process to ensure that the programme is consistent with best practice and to update the policies accordingly.

There is evidence that the company publicly commits to investigating bribery and corruption allegations and/or incidents, and that there are procedures in place to track, investigate and respond to such concerns through the Integrity and Compliance programme. In addition, there is evidence that the Audit Committee is responsible for reviewing all significant integrity and compliance investigations on a quarterly basis.

However, the company receives a score of ‘1’ because it does not provide further publicly available information on its investigative procedures from receipt to outcome, with ownership and actions to be taken at each step. There is also no evidence that information on each investigation is documented, nor that the company clearly commits to ensure that whistleblowers are informed of the outcome, if they so wish.

There is no publicly available evidence that the company assures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

There is evidence that the company commits to report material findings from internal investigations to the appropriate authorities when necessary, upon the advice of the Law Department. There is some indication that the company’s Senior Vice President and General Counsel reviews material matters with the Audit Committee on a regular basis, and this individual is understood to be associated with the Law Department and therefore a key individual in evaluating the decision to disclose criminal offences to the authorities when necessary.

However, there is no clear publicly available evidence that the company commits to report material findings from investigations to the board of directors. The company’s publicly available information on the reporting link between the Law Department and the Senior Vice President and General Counsel is not entirely clear.

There is no evidence that the company publishes data on ethical or bribery and corruption reports, investigations or disciplinary actions involving its employees.

Based on publicly available information, the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. The company also states that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme. The results of risk assessments are reviewed by the board on at least an annual basis.

There is evidence that the company’s entire anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. The company states that it continually monitors and improves its programme, which undergoes an annual review. There is also evidence that high-level audit findings are presented to the board, and that the company’s compliance department holds responsibility for implementing planned updates and improvements to the anti-corruption programme.

The company publicly commits to investigating incidents promptly, independently and objectively. The company states that corruption investigations are carried out by an external team or by an investigations unit within the legal department. The company states that all allegations and investigative steps are documented, and that the senior management, the relevant divisional leadership and the legal department are informed of the status and outcomes of all investigations. The company commits to informing whistleblowers of the outcome of investigations if they so wish. The company also states that as part of each investigation root causes are examined and remediation plans implemented if appropriate.

However, although the company states that all investigations are reported to senior management, it is not clear how frequently this occurs.

There is evidence that the company assures itself of the quality of both its internal investigations and whistleblowing investigations. The company indicates that its investigators are properly trained and qualified, or that investigations are carried out by specialist external investigators. The company states that its investigations process is reviewed annually.

However, there is no information about how complaints about the investigation process are handled.

The company states that either the Chief Compliance Officer, Chief Legal Officer, or CEO will report material findings of corruption to the board of directors. There is evidence that the company’s Chief Compliance Officer and Chief Legal Officer hold joint responsibility for disclosing findings to the relevant external authorities.

The company publishes a statement that it has not received any corruption-related internal reports or whistleblowing reports in the last 12 months and has not initiated any corruption-related investigations.

However, the company’s statement is not dated and it is unclear whether it updates this information annually.

There is no publicly available evidence that the company has a formal risk assessment procedure which is used to inform the company´s anti-corruption or compliance programme.

There is no publicly available evidence that the company’s ethics, compliance or anti-bribery and corruption programme is subject to audit or review.

Based on publicly available information, there is some evidence that the company commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases. The company stipulates actions to be taken at each step and indicates that whistleblowers can check on the outcome of the investigation.

However, the company scores ‘1’ as this does not cover the whole investigation process from receipt to final outcome. There is no evidence that investigations are handled by an independent team or reported to an independent board member. There is also no evidence that the information on each investigation is documented with summary information on investigations reviewed by a central body on a quarterly basis. In addition, it is noted that the company’s investigative procedure as outlined in publicly available information relates only to reports received through whistleblowing channels.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations.

There is no publicly available evidence that the company’s investigative procedure includes a commitment to report material findings to the board or the relevant authorities.

There is no publicly available evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company has an enterprise risk management system in place. The company indicates that its risk assessment procedures include compliance-related risks and there is evidence that it has designed and implemented mitigation plans on this basis.

However, the company receives a score of ‘1’ because there is no clear evidence that these assessments take account of bribery and corruption risks or that the assessment informs the design of the company’s anti-bribery and corruption programme.

There is some evidence that the company has procedures to conduct internal audits, however there is no clear evidence that its anti-bribery and corruption programme specifically is subject to audit or review.

There is evidence that the company publicly commits to investigating violations of its Code of Conduct and that it maintains a whistleblowing hotline which is available to employees in Japan and the United States. There is evidence that the company commits to informing whistleblowers of the outcome of investigations. The company provides information on the whole investigation process from receipt to final decision, and there is evidence that the Legal Division is responsible for reviewing information on cases.

However, there is no clear evidence that the company takes steps to ensure the independence of its investigations, for example by establishing an independent investigation team or reporting to an independent board member.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations by ensuring that staff are properly trained, implementing a system to handle complaints about the procedure, or reviewing its procedure at least every three years.

Based on publicly available information, there is no clear evidence that the company has an investigative procedure which includes a commitment to report material findings to the board or relevant authorities. The company’s reporting structure indicates that the Compliance Committee reports to the board, however it is not clear from publicly available information that the Legal Division must report all findings to the Compliance Committee, nor that the all findings must be communicated to the board.

There is evidence that the company publishes some high-level information on the number of whistleblowing reports it receives on an annual basis.

However, there is no evidence that the company publishes further information on its reporting systems, such as the number of investigations launched, the number of disciplinary actions as a result of investigation findings and the number of reports received through other channels.

Based on publicly available information, there is some evidence to indicate that the company conducts compliance-related risk assessments. The company indicates that such surveys form part of the Compliance Officer’s annual work plan and that the board or audit committee is responsible for reviewing and approving such findings.

However, it is not clear from publicly available information that the results of risk assessments are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company’s anti-bribery and corruption programme is subject to regular review. There is evidence to indicate that these reviews are conducted on a periodic basis with any changes to the programme reported to the company’s board on a quarterly basis. The company’s management is responsible for making changes to the programme.

However, there is no clear evidence that the company’s anti-bribery and corruption programme is subject to internal or external audits, nor that the company’s review process ensures that the programme is consistent with high standards of best practice and the business risks facing the company.

There is evidence that the company publicly commits to investigating incidents, which are conducted by the Compliance Officer and the Ombudsman. There is evidence that the investigative findings are reported to senior management and the board, and the company indicates that the Compliance Officer provides updates on cases or violations of the compliance programme to the CEO and Audit Committee on a quarterly basis.

However, it is not clear from publicly available information that the company publishes information on the whole investigation process from receipt to final outcome, nor is there evidence that it publicly commits to inform whistleblowers of outcome of investigations if they so wish.

There is no publicly available evidence that the company assures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

Based on publicly available information, there is evidence that the company commits to report material findings of bribery and corruption from investigations to the President and board-level Audit Committee. In addition, there is evidence to indicate that the Ombudsman is responsible for ensuring that the disclosure of material findings to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or corruption-related reports, investigations or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-corruption programme.

There is no publicly available evidence to indicate that the company reviews or audits its anti-corruption programme.

There is some evidence the company publicly commits to investigating incidents. On its website the company publishes a statement indicating that the Central Vigilance Commission, a government agency, is responsible for investigating allegations of corruption at state-owned companies.

The company scores ‘1’ as there is no evidence it commits to providing whistleblowers with updates on the outcome of investigations, nor does it publish information on the whole investigation process. There is also no evidence that a central body within the company reviews summary information on investigations.

There is no publicly available evidence to indicate that the company assures itself of the quality of its internal investigations.

There is no publicly available evidence to indicate that there is an investigative procedure which includes a commitment to report material findings from investigations to the board.

There is no publicly available evidence to indicate that the company publishes any data on ethical and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure in place that informs the design of its anti-bribery and corruption programme. The company indicates that such assessments are conducted on an annual basis. There is evidence indicating that the results are reviewed at board level and the assessments are used to update the company’s anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company’s anti-bribery and corruption programme is subject to annual audit and review to ensure that it is consistent with high standards of best practice and the business risks facing the company. In 2018 the company also conducted an external audit of its compliance programme and there is evidence to suggest that external audits will be updated on an annual basis. The results of audits are reviewed by the company’s Audit and Compliance Committee, and there is evidence that the Compliance Unit is responsible for implementing improvements to the programme.

There is evidence that the company publicly commits to investigating incidents and that investigations are conducted by the company’s Compliance Unit. The company provides details of the investigation process and the bodies involved at each stage. There is evidence that information on each investigation is documented and that the company commits to update whistleblowers and those who report concerns on the outcome of investigations. In addition, there is evidence that the Audit and Compliance Committee and Compliance Unit review summary information on all cases on a regular basis, at least annually as part of its yearly activity report.

There is no publicly available evidence that the company assures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

There is evidence that the company commits to report material findings of bribery and corruption from investigations to the board-level Audit and Compliance Committee and to relevant authorities. The company indicates that the Audit and Compliance Committee is responsible for determining whether to disclose criminal offences to the relevant authorities.

The company publishes some high-level information on ethics and compliance-related incidents and investigations involving company employees on an annual basis. The information includes the number of reports received through the company’s whistleblowing line and the number of disciplinary actions as a result of investigation findings. There is evidence indicating that the Compliance Unit investigates all reports.

There is evidence indicating that the company has a formal risk assessment procedure that incorporates reviews of governance and compliance issues. The results of risk assessments are reviewed by the board on an annual basis.

However, in publicly available information, the company does not explicitly refer to reviews of bribery and corruption risks.

There is some evidence suggesting that the company conducts an annual internal audit of its anti-bribery and corruption programme, and that the results of these audits are reviewed at board level.

However, the company receives a score of ‘1’ because there is no clear ownership assigned to units and/or individuals for planned updates and improvements to the anti-bribery and corruption programme. The company additionally does not specify that its entire programme is audited to ensure that it is consistent with best practice and the business risks facing the company.

There is evidence that the company publicly commits to investigating incidents, which are handled by the Compliance Officer. There is evidence that information on each investigation is documented. The company commits to put in place remediation plans and to report investigative findings to senior management and the board. A senior central body of the holding or parent company receives and reviews summary information of all incidents and their status in the organisation and its subsidiaries, on an annual basis.

However, the company does not describe the whole investigation process from receipt to final outcome, nor does it commit to providing whistleblowers with updates on the outcome of investigations. There is also no evidence that the company takes steps to ensure the independence of its investigations, by stipulating that investigations are handled by an independent team and/or report to an independent board member

There is no evidence that the company assures itself of the quality of its internal investigations.

Based on publicly available information, the Compliance Officer reports material findings of bribery and corruption from investigations to the board. There is also evidence that the company commits to cooperating with government investigations and will inform authorities of corruption incidents when appropriate.

The company publishes some high-level information on the number of cases reported through its whistleblowing line on an annual basis.

However, publicly available information indicates that the company does not release data on the number of investigations launched and the number of disciplinary actions as a result of investigation findings.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations.

There is no publicly available evidence that the company has an investigative procedure which includes a commitment to report material findings.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is some publicly available evidence that the company has a risk assessment procedure, however there is no clear evidence that the results of risk assessments are used to inform or update the company’s anti-bribery and corruption programme.

Based on publicly available information, there is no clear evidence that the company’s anti-bribery and corruption programme is subject to audit or review. The company provides some indication that it has a process to conduct audits, but it is not clear that such reviews cover the compliance or anti-corruption programme specifically.

Based on publicly available information, there is evidence that the company investigates compliance incidents and violations of the Code of Conduct, which includes the company’s anti-bribery and corruption policy. There is evidence that the company has a procedure in place to deal with whistleblowing cases, which outlines actions to be taken at each step. The company commits to notifying the whistleblower of the outcome of investigations.

In addition, the company’s procedure indicates that whistleblowing reports received through the CRC System are investigated by outside lawyers. There is also evidence that internal inquiries are conducted by an independent team and that the CSR Committee receives reports on all investigations.

There is no publicly available evidence that the company has a process in place to assure itself of the quality of its investigations, for example by ensuring that staff conducting investigations are properly trained or by stipulating a procedure for handling complaints about the process.

Based on publicly available information, there is evidence that the company commits to report material findings of bribery and corruption to the CSR Committee. The committee’s members include the company’s President who is a member of the board of directors.

However, the company receives a score of ‘1’ because there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is evidence that the company publishes some high-level information on compliance-related incidents involving its employees on an annual basis. This information includes the number of investigations launched and resulting disciplinary actions.

However, the company receives a score of ‘1’ because this information refers to compliance matters such as “abuse of authority” and “financial fraud”, without clearly indicating whether the data includes investigations into ethics or bribery and corruption related incidents, investigations or disciplinary actions.

There is evidence that the company has a formal bribery and corruption risk assessment procedure in place. The company indicates that such risk assessments are undertaken periodically and that the results inform the design of its anti-corruption and bribery programme. In addition, there is some evidence that the company’s board-level Audit Committee is responsible for reviewing the compliance programme, including significant updates from risk assessments, on a quarterly basis with input from the Chief Compliance Officer and General Counsel.

There is evidence that the company’s anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. This process includes provisions for continuous improvement, supplemented by regular internal or external audit. There is also evidence that high-level audit findings are presented to the board, with clear ownership assigned to units and/or individuals for planned updates and improvements to the anti-bribery and corruption programme.

However, the company receives a score of ‘1’ because it is not clear from publicly available information that the compliance and anti-corruption programme is subject to audit at least every two years.

Based on publicly available information, there is evidence that the company commits to investigating incidents promptly and objectively. There is evidence that the company reports investigative findings to the Audit Committee through the General Counsel and Director of Business Conduct. The company provides publicly available details on its investigation process from receipt to outcome, for both reports received through whistleblowing and internal channels.

In addition, there is evidence that the company ensures the independence of its internal investigations by involving individuals from different departments or external counsel. There is evidence that the General Counsel reviews all significant investigations and findings on a monthly basis and that the board-level Audit Committee reviews summary information on all cases on a quarterly basis.

There is evidence that the company takes steps to assure itself of the quality of its internal investigations, including those reported through whistleblowing channels. The company provides clear information to indicate that staff tasked with conducting investigations are properly qualified and trained to perform the function, and indicates that in cases where specific expertise is required staff may engage external assistance. There is evidence that the company has a system in place to handle complaints about the investigation process and that this process is ultimately overseen by the Chief Compliance Officer, General Counsel and board of directors.

However, the company receives a score of ‘1’ because it is not clear from publicly available information that its investigations procedure is subject to review at least every three years, or in response to any relevant changes in the regulatory environment.

There is evidence that the company clearly commits to report material findings of bribery and corruption from investigations to the board. There is evidence that an appropriate senior individual – the General Counsel, along with the Audit Committee – is ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if found necessary.

The company does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no investigative procedure which includes a commitment to report material findings.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure that is used to inform the company’s anti-bribery and corruption policy. There is some evidence to indicate that the company has risk management systems in place, but it is not clear that this specifically includes anti-bribery and corruption considerations nor that it is used to inform the company’s anti-bribery and corruption activities.

There is no clear evidence that the company’s anti-bribery and corruption programme is subject to regular audit or review. The company states that it has procedures to conduct compliance audits of areas such as safety, sales and export controls, but there is no evidence that it covers the company’s anti-bribery and corruption programme.

Based on publicly available information, there is some evidence that the company commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases.

However, the company receives a score of ‘1’ because its procedure does not stipulate actions to be taken at each step, and it is unclear whether investigations are handled by an independent team which reports to an independent member of the board. There is also no stated commitment to provide whistleblowers with updates on the outcome of investigations. Furthermore, there is no evidence that the information on each investigation is documented and that summary information is reviewed by a central body on an annual basis.

Based on publicly available information, there is no clear evidence that the company assures itself of the quality of its internal investigations. The company indicates that staff tasked with conducting investigations are experienced, but it is not clear that they receive specific training to perform this function. There is also no evidence that the company has a procedure in place to handle the escalation of complaints about the investigation process, if necessary.

There is no evidence to suggest that the company’s investigative procedure includes a commitment to report material findings to the board or to relevant authorities.

There is evidence that the company publishes high-level information on its ethics and compliance-related incidents involving employees, including the number of reports received and the number of disciplinary actions as a result of investigation findings.

However, the company receives a score of ‘1’ because it is unclear whether this information applies to employees at all levels. Additionally, the company does not publish the number of investigations launched as a result of reports and the information provided does not cover the past 12 months.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-corruption and bribery programme. The company indicates that its risk assessments incorporate a range of sector-specific risks, including industry, country, business area and the use of third parties. There is evidence that the board reviews risk management and internal control procedures, as well as the group’s governance documents, on an annual basis. Since this is process is interpreted to include risks relating to the company’s anti-bribery and corruption approach, the company receives a score of ‘2’.

Based on publicly available information, there is evidence that the company’s anti-bribery and corruption programme is subject to periodic evaluation and a regular internal audit process. Evidence in the company’s Annual Report indicates that the company plans to carry out internal audits of its internal controls and compliance processes on an annual basis, supplemented by an external audit of the anti-corruption programme every third year. In addition, it is clear that the findings of these audits are presented to the Board and used to develop follow-up risk management plans. Although it is not explicitly clear where ownership for this process lies, it is assumed to sit with the Board’s Audit Committee.

There is evidence that the company publicly commits to investigating bribery and corruption allegations or incidents, which includes a statement that all allegations must be investigated promptly and by personnel who have no connection with the case. In addition, there is a specific procedure in place to deal with whistleblowing cases which stipulates documentation and actions to be taken at each step, covering the whole investigation process from receipt to final outcome. The company commits to providing those who raise concerns – including whistleblowers – with updates on the outcome of investigations. Although the company does not explicitly state that a senior central body receives and reviews summary information of all incidents on a regular basis, the involvement of the CCO and legal department in the investigation process is assumed to cover this role.

There is no evidence that the company assures itself of the quality of investigations. Although the company provides information about its investigation process, it does not provide any publicly available evidence of how it ensures the quality of these procedures, for example by stating that staff tasked with conducting investigations are properly trained and qualified. There is also no mention of how complaints about the process are handled, nor does the company state that an appropriate senior individual is responsible for oversight of this process. Additionally, there is no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

There is evidence that the company’s investigative procedure includes provisions to report material findings to the board and potential criminal conduct to the relevant authorities where appropriate. There is evidence that there are procedures in place which determine the relevant senior manager responsible for reporting findings to authorities.

There is evidence that the company publishes data on the number of ethics and compliance-related investigations involving its employees for the most recently reported financial year.

However, this data is insufficiently detailed: it does not include the number of reports received, including through whistleblowing channels, nor the number of disciplinary actions taken as a result of investigation findings.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-bribery and corruption programme.

However, the company receives a score of ’1’ because there is no clear publicly available evidence that the company reviews risk assessments on at least an annual basis with the results also reviewed at board level.

Based on publicly available information, there is evidence that the company's ethics and compliance programme is subject to regular audit and review. There is evidence indicating that this includes measures for continuous improvement, supplemented by an internal audit on an annual basis. There is also evidence that high-level audit findings are presented to the board and Audit Committee, with ownership assigned to individuals for planned updates and improvements to the anti-bribery and corruption programme.

There is evidence that the company publicly commits to investigating incidents and there is a specific procedure in place to deal with whistleblowing cases. The company’s compliance department conducts investigations.

However, in publicly available evidence the company does not cover the whole investigation process from receipt to final outcome. There is also no clear publicly available evidence that a central body reviews the status of all investigations on at least an annual basis.

There is no clear publicly available evidence that the company assures itself of the quality of its internal investigations by ensuring that staff are properly trained, implementing a system to handle complaints about the procedure, or reviewing its procedure at least every three years.

Based on publicly available information, there is no clear evidence that the company commits to report material findings of bribery and corruption from investigations to the board. The company states that its Compliance Officer may report violations to the company CEO, but it is not clear whether this is required. In addition, while the company refers to potential criminal prosecution for violations of its Code of Conduct, there is no clear public evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

While the company publishes some data on disciplinary actions and reports received through its whistleblowing channel, there is no clear evidence that this includes data on ethical or bribery and corruption investigations. The company also does not publish further information on its investigations, such as the number of reports received and number of investigations launched.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is some evidence that the company commits to investigating incidents. However, the company does not provide any details about specific procedures in place to deal with whistleblowing cases, which stipulate documentation and actions to be taken at each step.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations.

There is no publicly available evidence that the company’s investigative procedure includes a commitment to report material findings of bribery and corruption to the board, or that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes high-level results from incident investigations and disciplinary actions.

There is evidence that the company has a formal bribery and corruption risk assessment procedure in place that informs the design of its anti-bribery and corruption programme. The results of risk assessments are reviewed by the board-level Audit Committee on an annual basis or when significant findings are identified. The company states that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is evidence that the company’s entire anti-bribery and corruption programme is subject to a regular audit to ensure the programme is consistent with best practice and the business risks facing the company. This includes provisions for continuous improvement, supplemented by an internal audit. There is also evidence to indicate that internal audits are conducted on an annual basis and that high-level audit findings are presented to the Audit Committee and the Nomination and Governance Committee. There is evidence that the company has management structures in place to implement recommended changes from audits.

There is evidence that the company publicly commits to investigating incidents, and there is evidence that it has procedures in place to deal with whistleblowing cases. The company establishes dedicated ethics and compliance review boards composed of senior management to consider any reports received. There is evidence that summary information on investigations is reviewed by the Nominating and Governance Committee of the board of directors periodically, which is understood to indicate at least once annually. The company also indicates that it provides whistleblowers and those who report concerns with updates on the outcome of investigations.

However, the company receives a score of ‘1’ because in publicly available evidence it does not stipulate documentation and actions to be taken at each step or provide clear details covering the entire investigation process, from receipt to final outcome. There is also no publicly available evidence on how the company ensures the independence of its investigations, for example by stating that reports are handled by an independent team or that the team reports to an independent board member.

There is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels. There is evidence that the company reviews all compliance and anti-corruption procedures at least every two years, as well as subject to testing by regular internal audits. The company also indicates that it has a procedure in place to handle complaints about the investigation process, stating that employees may contact the Vice President of Internal Audit or the General Counsel in such cases.

Although the company does not explicitly state that staff conducting investigations are properly trained to perform this function, there is sufficient evidence that it the ethics review boards or the Nomination and Governance Committee may engage independent and in-house legal expertise in the investigative process.

There is evidence the company commits to reports material findings of bribery and corruption from investigations to the board. The company also indicates that it will report identified instances of criminality to law enforcement.

However, the company receives a score of ‘1’ because ownership for this process is unclear; there is no clear evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption reports, investigations or associated disciplinary actions involving its employees.

There is evidence that the company’s Ethics Review Board meets quarterly with an Enterprise Risk Management Committee to discuss ethics matters and compliance matters. The company indicates that purpose of the meetings is to review and strengthen the programme and that this committee is composed of senior individuals.

However, there is no clear publicly available evidence that this review process specifically includes a bribery and corruption risk assessment procedure that informs the design of the ethics and anti-corruption programme. it is also not clear from publicly available information that the results of risk assessments are reviewed by the board.

There is evidence that the company’s internal audit department periodically reviews the anti-bribery and corruption programme. There is evidence that the results of audits are shared with the Corporate Governance and Ethics Committee of the board of directors.

However, the company receives a score of ‘1’ because it is not clear from publicly available information that its entire anti-corruption and ethics programme is audited to ensure that it is consistent with high standards of best practice and the specific business risks facing the company. There is also not clear evidence that a specific individual or department holds ownership and responsibility for implementing recommended changes from audits.

There is evidence that the company publicly commits to investigating and resolving incidents, including any whistleblowing reports received via its independent third party operator. The company also commits to providing whistleblowers and employees who submit reports with information on the conclusion of investigations. There is clear evidence that the company’s investigations are documented.

However, the company receives a score of ‘1’ because, although there is clear evidence that the company collects summary data on investigations, it is not clear from publicly available information that this data is reviewed by a central body, or that a central body reviews the status of investigations on a regular basis.

There is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels and states that its investigative process is reviewed on a continuous basis. The company also clearly states that staff tasked with conducting investigations are properly qualified and trained to perform the function. The company states that the Corporate Governance and Ethics Committee handles complaints related to the company’s investigative procedure and states that if unsatisfied employees are able to escalate complaints on the investigative process through other reporting channels.

There is evidence that either the company’s Chief Ethics and Compliance Officer or General Counsel are responsible for informing the board-level Corporate Governance and Ethics Committee of any identified instances of potential criminality.

However, the company receives a score of ‘1’ because there is no clear publicly available evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-bribery and corruption programme. The results of risk assessments are reviewed by the board on an annual basis. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company’s anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. The company explicitly includes provisions for continuous improvement, supplemented by internal audits as well as an external audit of its anti-bribery management system accreditation every year. There is evidence that high-level audit findings are presented to the board and acted upon by the anti-corruption unit.

Based on publicly available information, there is evidence that the company publicly commits to investigating incidents promptly, independently and objectively. There is evidence that the company takes steps to ensure the independence of its investigations. It commits to establishing root causes, putting in place remediation plans and reporting investigative findings to senior management and the board. For whistleblowing cases, there is a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome, and the company commits to ensure whistleblowers are informed of the outcome. There is evidence that a central body of the company receives and reviews summary information on all incidents on a regular basis.

Based on publicly available information, there is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels. There is evidence that staff tasked with conducting investigations are properly trained and qualified to perform the function. There is evidence that the company’s Surveillance Body oversees complaints about the investigation process. The investigations procedure is subject to review at least every three years, or in response to any relevant changes in the regulatory environment.

Based on publicly available information, the company makes a clear commitment to report material findings of bribery and corruption from investigations to the board. There is evidence that an appropriate senior individual is ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if found necessary.

The company publishes high-level data from bribery and corruption-related incidents and investigations involving company employees at all levels. This includes the number of reports received, including the number received through whistleblowing channels, the number of investigations launched, and the number of disciplinary actions as a result of investigation findings. The information covers the last financial year.

There is evidence that the company has a risk assessment procedure that informs the design of its anti-corruption programme. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

However, the company receives a score of ‘1’ because it is not clear whether the results of risk assessments are reviewed by the board on at least an annual basis.

There is evidence that the company's anti-bribery and corruption programme is subject to regular audit and that the compliance program is monitored once a year. There is also evidence that the findings are used to improve the procedure. However, the company does not clearly state how frequently audits are conducted and so a score of ‘0’ applies.

There is evidence that the company commits to investigating incidents and that there is a specific procedure in place to deal with whistleblowing cases. There is a commitment to providing whistleblowers with updates on the outcome of investigations, and there is evidence that the CEO and Chief Justice review summary information of all incidents.

However, it is not clear from publicly available information how frequently this occurs and the company does not provide publicly available information to cover the whole investigation process from receipt to final outcome. Although the company mentions record keeping as part of its anti-corruption procedures, it is not clear whether this covers investigations and therefore whether information on each investigation is documented. There is also no clear evidence that all investigations are handled by an independent team or reported to an independent board member.

There is no publicly available evidence that the company assures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

There is evidence that the company commits to report material findings from investigations to the board. The company commits to report criminal offences to the relevant authorities, and there is evidence that an appropriate senior has been assigned responsibility for ensuring this occurs when necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a risk assessment procedure that informs the design of its anti-corruption and bribery programme. The company indicates that it continually monitors corruption risks in order to develop mitigating procedures and that it conducts a biennial Compliance Risk Assessment that includes bribery and corruption risk. It also undertakes a separate annual risk assessment of its international consultants.

However, it is unclear whether the results of risk assessments are reviewed at board level.

The company states that its anti-bribery and corruption programme is subject to annual internal audit to ensure that it is consistent with best practice and addresses the business risks facing the company. There is evidence that significant findings are reported to the board-level Audit Committee and, when issues are identified, the company assigns an individual responsible to implement a corrective action plan.

The company publicly commits to investigating incidents and there is a specific procedure in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step. The procedures cover the whole investigation process from receipt to final outcome and there is evidence that the company takes steps to ensure the independence of its investigations. Ethics officers from the company’s Legal, Ethics, Human Resources, Industrial Security, Internal Audit, or Information Security departments generally perform investigations. The company’s Ethics Office collects information on investigations and presents these to the executive leadership team four times per year.

There is evidence that the company assures itself of the quality of its internal investigations for incident reports and whistleblowing cases. The company’s investigations policy states that investigators are properly trained to perform this function and receive support from the legal department. There is additional evidence that the company ensures the quality of its investigations procedure by requesting employee feedback, and publishing the results. Furthermore, there is evidence that the company has procedures in place to account for complaints or concerns about Ethics Officers in the investigation process. The company’s investigations procedures are reviewed every three years.

The company makes a clear commitment to disclosing material findings of bribery and corruption to government authorities. The company’s legal team handles this process, obtaining sign-off by an appropriately senior individual, namely the Senior Vice President, General Counsel & Corporate Secretary; although the company does not explicitly state findings are reported to the Board of Directors, this individual is a member of the executive leadership. There is also evidence that there are provisions in place to allow employees to report directly to the Board where appropriate.

The company publishes high-level information on ethics and compliance-related incidents and investigations involving all company employees covering the last 12 months. This includes the number of ethics contacts made per thousand employees and the percentage of investigations that resulted in disciplinary action. The company states that its data includes investigations originating from internal and external sources, which appears to include reports received through the company’s whistleblowing channel.

There is no publicly available evidence that the company has a formal risk assessment procedure in place, which is used to inform the company’s anti-bribery and corruption programme. There is evidence that the company has a risk management programme, but there is no publicly available indication that this includes an assessment of ethics and compliance-related risks.

There is evidence that the company’s Audit Committee conducts periodic reviews of the company’s Standards of Ethics and Business Conduct document, which includes its policy on anti-bribery and corruption. However, there is no clear publicly available evidence that the company conducts internal or external audits of its anti-bribery and corruption programme.

There is evidence that the company commits to investigating incidents and that it has a procedure for documenting and handling whistleblower reports.

However, the company receives a score of ‘1’ because there is no evidence that it publishes information on the whole investigation process from receipt to final outcome. There is no clear evidence that all investigations are handled by an independent team, nor that the company commits to providing whistleblowers with updates on the outcome of investigations. In addition, although the Audit Committee reviews whistleblower complaints related to the integrity of the company’s financial statements, it is not clear that it receives summary information of all investigations relating to bribery and corruption incidents.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations.

There is some evidence that the company commits to report material findings of bribery and corruption from internal investigations to the board, through the Audit Committee. However, the company receives a score of ‘1’ because there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption incidents, investigations or disciplinary actions involving its employees.

There is evidence that the institution has a formal risk assessment procedure that informs the design of its compliance programme, and that the results of these assessments are reviewed at board level. These procedures do not explicitly apply to bribery or corruption; however, it seems clear that the programme would include these issue areas. It is unclear how often risk assessments are conducted.

The institute states that it has an Audit Division which regularly undertakes audits into its various divisions, inclusive of the Lincoln Laboratory. While there is some evidence that the institute’s audits entail the review of compliance concerns, it is not explicitly clear whether this component of the Lincoln Laboratory’s operations is subject to review.

There is evidence that the institute has a complaint resolution procedure, which details actions and documentation to be taken at each step. However, publicly available evidence suggests that these procedures only relate to employment policy concerns, such as discrimination and harassment; there is no evidence that they extend to bribery, corruption or ethics-related concerns. The Lincoln Laboratory also publishes separate information for reporting violations, but it does not detail any specific procedures for dealing with such reports.

There is no evidence that the institute assures itself of the quality of its internal investigations relating to anti-bribery and corruption. There is some evidence that the institute commits to investigating misconduct, harassment and other employment policy complaints promptly and objectively; however the institute receives a score of ‘0’ because it is not clear that this extends to reports made about corruption and bribery concerns, and there is insufficient evidence that it assures itself of the quality through training of staff conducting investigations.

The institute commits to informing a relevant senior executive of the results of investigations regarding complaints about employment policy violations. However, there is no evidence that there are any mechanisms in place for reporting corruption or bribery investigations to the board, or for ensuring the disclosure of material findings of such investigations to the relevant authorities.

The institute does not publish any data on ethical or bribery and corruption investigations or disciplinary actions.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-corruption and bribery programme. The company indicates that it conducts risk assessments on an ongoing basis and in response to any major changes in the regulatory environment.

The company states that its Group Internal Audit function conducts regular reviews of its business ethics programme. The results are reviewed by the Business Ethics Committee, with the findings used to update the company’s programme.

However, the company receives a score of ‘1’ because it is not clear from publicly available evidence show frequently audits are conducted and whether they take place at least every two years.

There is evidence that the company publicly commits to investigating incidents and that it has a specific procedure in place to deal with whistleblowing cases. The company indicates that allegations may be reported to the Business Ethics Committee, although it is unclear whether this committee reviews summary information for all investigations. There is evidence that the company takes steps to ensure the independence of its investigations.

The company commits to putting in place remediation plans and reporting investigative findings to senior management and the board. For whistleblowing cases, there is a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome, and the company commits to ensure whistleblowers are informed of the outcome. In addition, there is evidence that a central body is responsible for reviewing investigations.

There is no evidence that the company assures itself of the quality of its incident investigations and whistleblower cases. While the Business Ethics Committee is kept informed of evolutions in the company’s procedures for handling investigations, it is not clear whether these procedures are reviewed at least every three years. There is no evidence that staff conducting investigations are properly trained and qualified, nor is it clear that the company has a procedure in place to handle complaints about the investigation process.

There is no evidence that the company commits to reporting material findings of bribery and corruption to the board, although there is some evidence that a managerial committee receives reports on allegations. There is also no evidence that the company publicly commits to reporting material findings to the relevant authorities, nor that it has an appropriate senior individual who would be responsible for evaluating such decisions.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations, or any associated disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company has an enterprise risk management process in place that includes reviews of bribery and corruption risk. There is evidence that the results of these assessments are reviewed by the board on an annual basis.

However, the company receives a score of ‘1’ because there is no clear evidence that the results of such reviews are used to update specific parts of the company's anti-bribery and corruption programme. The company indicates that it updated its approach to commercial intermediaries as part of a risk management plan, however it is not clear that the results of risk assessments are used to update the company’s anti-corruption initiatives as a whole.

Based on publicly available information, there is evidence that the company’s anti-bribery and corruption programme is subject to a regular audit process. This includes provisions for continuous improvement, supplemented by internal and external audits. There is also evidence that all findings are presented to the Audit Committee, with ownership assigned to units for planned updates and improvements to the anti-bribery and corruption programme. In addition, the company indicates that it conducts internal and external audits on a rolling basis based on an assessment of risk.

Based on publicly available information, there is evidence that the company commits to investigating incidents and that it has a specific procedure in place to deal with whistleblowing cases. There is evidence indicating that investigations are handled by an independent team and that the company publicly commits to providing whistleblowers with updates on the outcomes of investigations. There is also evidence that the Corporate Responsibility Committee receives all information on significant ethics violations and that this information is communicated to the board after each meeting, at least twice a year.

However, the company receives a score of ‘1’ because it does not provide any further publicly available information on the whole investigation process from receipt to final outcome, including documentation and actions to be taken at each step.

Based on publicly available information, there is some evidence that the company assures itself of the quality of its internal investigations. There is evidence that the Corporate Responsibility Committee reviews the company’s investigations procedure and that the Company Secretariat conducts a continuous review of the quality of investigations.

However, the company receives a score of ‘1’ because there is no publicly available evidence that it has a procedure in place to receive and handle complaints about the investigation process. There is also no clear evidence that staff conducting investigations are properly trained and qualified to perform their function.

Based on publicly available information, there is evidence that the company commits to report material findings of bribery and corruption from investigations to the board-level Corporate Responsibility Committee. There is evidence that the company commits to report material findings of bribery and corruption from investigations to the relevant authorities, where necessary, and indicates that the chair of the Corporate Responsibility Committee, with oversight from the board, would be responsible for this process.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is no evidence that the organisation has a formal risk assessment procedure that is used to inform its anti-bribery and corruption programme.

There is no evidence that the organisation’s anti-bribery and corruption programme is subject to audit or review.

There is no publicly available evidence that the organisation has a procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports. There is evidence that it operates a whistleblowing channel, however the organisation does not provide any further information on how allegations and investigations are handled.

There is no evidence that the organisation assures itself of the quality of its internal investigations.

There is no evidence that the organisation’s investigative procedure includes a commitment to report material findings to the board and, if appropriate, to relevant authorities.

The organisation does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is some evidence that the company’s anti-bribery and corruption programme, as part of its compliance framework, is subject to regular review. There is also evidence that high-level audit findings are presented to the board, with clear ownership assigned to units for planned updates and improvements to the anti-bribery and corruption programme.

However, the company receives a score of ‘1’ because it does not does not clearly specify that the entire programme is audited to ensure that it is consistent with high standards of best practice and the business risks facing the company.

There is evidence that the company publicly commits to investigating incidents, and the company has a specific procedure in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step. The process covers the investigation from receipt to outcome and is held by an independent team.

However, the company receives a score of ‘1’ because there is no evidence that it commits to provide whistleblowers with updates on the outcome of investigations. In addition, there is no evidence that information from each investigation is documented or that summary information is reviewed by a central body.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is some evidence that the company commits to report material findings of bribery and corruption from investigations to the relevant authorities if necessary.

However, the company receives a score of ‘1’ because there is no clear evidence that an appropriate senior individual is responsible for ensuring that the disclosure of material findings to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company employed an expert individual to conduct a bribery risk assessment of its anti-bribery and corruption systems in 2017. The company indicates that the purpose of this evaluation was to monitor the systems and identify areas for improvement.

However, the company receives a score of ‘1’ because it is not clear from publicly available information that the company has a procedure in place to conduct bribery and corruption risk assessments on a regular basis or that the results of risk assessments are reviewed at board level.

Based on publicly available information, there is no clear evidence that the company’s anti-bribery and corruption programme is subject to audit or review. The company indicates that it conducted audits to identify fraud risks in certain operating sites, however it is not clear from publicly available information that the company conducts specific anti-corruption audits of its compliance programme on a regular basis, nor that the results are reviewed by the board or used to make improvements to the programme.

There is evidence that the company publicly commits to investigating incidents and that there is a procedure in place to deal with whistleblowing cases, which is overseen by external lawyers. There is evidence that the company’s Compliance Committee Secretariat conducts investigations.

However, the company receives a score of ‘1’ because it does not provide further publicly available information on the whole investigation process from receipt to final outcome. In addition, there is no clear evidence to indicate that the company takes steps to ensure the independence of investigations, nor that a central body reviews summary information on all investigations on at least an annual basis. There is also no clear publicly available evidence that the company commits to providing whistleblowers with updates on the outcome of investigations.

There is no publicly available evidence that the company assures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

There is no publicly available evidence that the company publicly commits to report material findings from its investigations to the board or to relevant authorities if necessary.

There is evidence that the company publishes high-level data on an annual basis regarding ethical or bribery and corruption-related incidents and investigations involving company employees at all levels. The company provides information on the number of reports received, including the number received through whistleblowing channels, the number of investigations launched, and the number of disciplinary actions as a result of investigation findings.

There is no evidence that the company has a formal risk assessment procedure that is used to inform the company’s anti-bribery and corruption programme.

There is no clear evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is evidence that the company commits to investigate incidents raised through its ethics hotline. However, the company does not provide information specific procedures in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step.

There is some evidence that the company assures itself of the quality of its investigations by specifying that where employees feel their complaint was mishandled, they may contact a confidential hotline.

However, there is no evidence that the company assures itself of the quality of both incident investigations and whistleblowing cases, there is no evidence that staff conducting investigations are properly trained, and it is unclear who is responsible for handling complaints about the investigation process itself. There is also no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

There is no evidence that the company has an investigative procedure which includes a commitment to report material findings to the board.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal risk assessment procedure that includes anti-bribery and corruption risks, and informs the design of the compliance programme. The company states that this process is conducted continuously and there is evidence that the board reviews the results of these risk assessments on an annual basis (or more frequently if necessary). Although the company does not explicitly state that the results of such assessments are used to develop tailored mitigation plans, there is sufficient evidence that the programme is updated on this basis and so the company receives a score of ‘2’.

Based on publicly available information, there is evidence that the company’s compliance program – which includes anti-bribery and corruption – is subject to a regular audit or ‘assessment’ process. There is evidence that this includes provisions for continuous improvement, supplemented by an independent or external review every three years. The company also states that findings and recommendations are presented to the Group Management Team and the Board on an annual basis.

Based on publicly available information, there is evidence that the company has a system for tracking, investigating and responding to allegations or incidents of bribery and corruption. The company publicly commits to investigating incidents promptly and there is evidence that the company has a procedure in place that stipulates documentation and actions to be taken at each step of the process. There is evidence that the company ensures the independence of its investigations, by involving the independent Ethics and Integrity Council (EIC) in the process and by noting that conflict of interest considerations are taken into account when establishing an investigation response team.

In addition, although the company does not explicitly state that a central body within the organisation receives and reviews summary information on all cases on a regular basis, there is sufficient evidence to indicate that the Chief Compliance Officer and EIC fulfil this role in the process, so the company receives a ‘2’.

There is no publicly available evidence that the company has appropriate arrangements in place to assure the quality of its internal investigations. There is no evidence that staff tasked with conducting investigations are properly qualified or trained to perform the function, nor does the company provide any information on how it handles complaints or concerns about the investigative procedure. Moreover, there is no evidence that the investigations procedure is subject to review at least every three years or in response to any relevant changes in the regulatory environment.

Based on publicly available information, there is evidence that the company’s investigative procedure includes a commitment to report material findings to the board and to relevant authorities, if necessary. The company indicates that the CCO – the main individual responsible for receiving allegations or incidents – provides information on compliance matters to the board on a monthly basis. There is also evidence that the company commits to report findings to relevant authorities if necessary, and based on the company’s reporting and investigative structure it is clear that the CCO is responsible for this process.

There is evidence that the company publishes high-level data on its ethical and bribery-related incidents and investigations involving company employees. The company provides information on the number of reports received and the number of investigations launched, as well as stating that no concerns or legal proceedings were raised relating to bribery or corruption. There is evidence that this data is published on at least an annual basis, to cover cases from the most recently reported financial year.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-corruption and bribery programme and is overseen by the Audit, Accounts and Risks Committee.

The company states clearly that its entire anti-bribery and corruption programme is subject to a regular assurance process to ensure the programme is consistent with best practice and the business risks facing the company. This explicitly includes provisions for continuous improvement, supplemented by an external audit every year and regular internal audits. There is also evidence that high-level audit findings are presented to the board, with clear ownership assigned to units and/or individuals for planned updates and improvements to the anti-bribery and corruption programme.

The company publicly commits to investigating incidents promptly, independently and objectively. Investigations are managed by the Committee for Ethics and Corporate Social Responsibility (‘CERSE’) to ensure independence. The company provides some information about reporting procedures and processes. For whistleblowing cases, there is a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome. The company commits to inform whistleblowers of the outcome, if they so wish.

However, it is not clear whether the company commits to reporting investigative findings to senior management and the board. It is also not clear whether summary information of all incidents is reviewed by a senior central body on a regular basis.

There is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels. The company explicitly states that staff tasked with conducting investigations are properly qualified and trained to perform the function. There is evidence of how complaints and investigations are managed and there is a procedure for the escalation of complaints.

However, there is no publicly available evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment. There is also no information about how complaints about the investigation process itself are handled or who is responsible for doing so.

There is evidence that the company commits to report material findings of bribery and corruption to board level Audit, Accounts and Risks Committee. In its publicly available investigation procedures it is implied that members of CERSE evaluate whether to instigate legal proceedings.

However, it is unclear whether this suggests the company will inform relevant authorities in case of material findings of bribery and corruption.

The company does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-bribery and corruption programme. There is evidence that the company uses the results of risk assessments to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme. Although it is not explicitly clear that the board reviews the results of risk assessments, there is evidence that the Compliance Committee conducts reviews on at least an annual basis of medium and high risk operational areas, and that this committee submits an Annual Report to the board.

There is evidence that the company’s anti-bribery and corruption programme is subject to a regular review process to ensure the programme is consistent with best practice and the business risks facing the company. There is evidence that this includes provisions for continuous improvement, supplemented by audit procedures. There is also evidence that high-level audit findings are presented to the board, with clear ownership for any updates and improvements to the anti-bribery and corruption programme. Although it is not explicitly clear that such audits or reviews are conducted at least every two years, the company refers to ‘annual audit plans’ and so the evidence is deemed sufficient for a score of ‘2’.

There is evidence that the company commits to investigating allegations and incidents of bribery and corruption objectively and independently. There is evidence that the company has a specific procedure in place to deal with whistleblowing cases, which includes informing whistleblowers of the outcome of the investigation, and stipulates documentation and actions to be taken at each step. A senior central body of the company – the Compliance Committee – receives and reviews summary information of all incidents and their status in the organisation on a quarterly basis.

There is some evidence that the company assures itself of the quality of its internal investigations. It states that staff tasked with conducting investigations are properly qualified and trained to perform the function.

However, the company receives a score of ‘1’ because the company does not provide any details about how it handles complaints about the handling of concerns and investigations. There is also no evidence that it reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

There is evidence that the company’s Compliance Committee is responsible for ensuring that the disclosure of criminal offences to the relevant authorities is evaluated and acted upon if found necessary.

The company receives a score of ‘1’ because while there is evidence that material findings of bribery and corruption from investigations are reported to the Compliance Committee, there is no clear evidence that the company commits to report material findings to the board.

The company publishes some high-level data on its compliance-related incidents and investigations involving company employees. The data includes the number of reports received through its complaints channel, and the number of disciplinary actions as a result of investigation findings. There is evidence that this information is published on an annual basis covering cases from the past 12 months.

However, the company receives a score of ‘1’ because the data provided does not include information on the number of investigations launched. Furthermore, the data is not disaggregated to specifically show the number anti-bribery and corruption-related incidents and investigations.

Based on public information, there is some evidence that the company has a formal risk assessment that informs the design of its anti-bribery and corruption policy. There is evidence that the results of risk assessments are reviewed annually at board level and that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is no clear evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

Based on public evidence, the company commits to investigating incidents and there is a specific procedure in place to deal with whistleblowing cases.

However, there is no evidence that the procedure covers the whole investigation from receipt to outcome, or that investigations are handled by an independent team which reports to an independent board member. There is also no evidence of a commitment to providing whistleblowers with updates on the outcome of investigations or that each investigation is documented, with summary information reviewed by a central body.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company has an investigative procedure which includes a commitment to report material findings to the board or relevant authorities.

The company publishes some high-level information on its ethics and compliance-related incidents and investigations involving company employees. The data covers the number of reports received and is updated on an annual basis.

However, the information that the company publishes does not cover the number of investigations launched, and the number of disciplinary actions as a result of investigation findings. It is also unclear whether the information applies to employees at all levels, i.e. board members or other executives.

There is evidence that the company has a bribery and corruption risk assessment procedure that informs the design of its anti-corruption and bribery programme.

However, it is unclear how frequently risk assessments are undertaken and there is no evidence that the results are reviewed at board level.

The company states that its compliance programme is subject to review by its internal audit team, and there is evidence that the results of these reviews are used to update the programme.

However, it is not clear how frequently audits are undertaken, the company does not explicitly state that the entire anti-corruption programme is audited to ensure it is consistent with best practice and the business risks facing the company. There is also no evidence that audit findings are presented to the board.

The company publicly commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases.

However, this procedure does not cover the whole investigation process from receipt to final outcome, it is unclear whether investigations are handled by an independent team and/or report to an independent board member, and the company does not indicate whether information on each investigation is documented and if a central body reviews summary information on the status of investigations on a regular or annual basis.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company’s investigative procedure includes a commitment to report material findings to the board or the relevant authorities.

The company does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure in place that informs the design of its anti-corruption and bribery programme. The company indicates that these assessments are reviewed by the board-level Audit Committee on at least an annual basis, with the results used to develop tailored mitigation plans and to update specific parts of the company’s anti-corruption programme.

There is evidence that the company’s anti-bribery and corruption programme is subject to annual review to ensure the programme is consistent with best practice and the business risks facing the company. It is clear that ownership for planned improvements to the anti-bribery and corruption policy sits with the Chief Compliance Officer and Office of the General Counsel. There is evidence that high-level audit findings are presented to the board-level Audit Committee, which is ultimately responsible for the company’s programme.

Based on publicly available information, there is some evidence that the company commits to investigating incidents and allegations. There is evidence that it has a specific procedure in place to deal with whistleblowing cases, which stipulates some actions to be taken as part of an investigation.

However, the company receives a score of ‘1’ because it does not publish information on the whole investigation process from receipt to final outcome. There is also no evidence that the company publicly commits to informing whistleblowers of the outcome of the investigation, nor that a central body reviews the status of all investigations on at least an annual basis. It is also unclear whether the company takes steps to ensure the independence of its investigations, for example by stipulating that investigations are handled by an independent team and/or report to an independent board member.

Based on publicly available information, there is some evidence that the company assures itself of the quality of its internal investigations. The company states that a dedicated team of full-time professionals handles investigations and this team are trained in conducting interviews.

However, the company receives a score of ‘1’ because there is no publicly available evidence that it has a procedure in place to receive and handle possible complaints about the investigation process. There is also no clear evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

Based on publicly available information, there is evidence that the company commits to report material findings of bribery and corruption from investigations to the board-level Audit Committee. There is evidence that the company commits to report material findings of bribery and corruption from investigations to the relevant authorities, where necessary, and indicates that the General Counsel, as part of the law department and in cooperation with the Audit Committee, is responsible for this process.

There is evidence that the company publishes high-level data from ethical or bribery and corruption-related incidents and investigations involving its employees. This data covers the number of reports received (including the number received through whistleblowing channels), the number of substantiated allegations and the number of disciplinary actions taken as a result of investigation findings. There is evidence to indicate that this data is updated and published on an annual basis.

There is some evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-corruption and bribery programme. However, the company receives a score of ‘1’ because there is no evidence that the results of risk assessments are reviewed at board level on an annual basis.

There is evidence that the company’s anti-bribery and corruption programme is subject to audit and that the findings from such reviews are used to update the programme. However, the company receives a score of ‘0’ because there is no evidence indicating the frequency of these audits or where responsibility for this process lies.

There is insufficient public evidence that the company has a system for tracking, investigating and responding to bribery and corruption allegations or incidents. Although there is evidence that the company provides information on its whistleblowing hotline, there is no evidence that it provides any further details on how cases are handled at each step in the process. There is no evidence that the company takes steps to ensure the independence of its investigations, nor that it requires documentation of case material. There is also no evidence that the company commits to inform whistleblowers of the outcome of investigations and there is no evidence that a senior central body reviews summary information of all incidents and their status on a regular basis.

There is no publicly available evidence that the company takes steps to assure itself of the quality of its internal investigations, for example by ensuring that staff conducting investigations are properly trained and outlining a procedure to handle complaints about the reporting or investigation process.

There is no evidence that the company commits to report material findings of investigations to the board or relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is some evidence that the company has a formal risk management procedure, however there is no evidence that this is used to inform and tailor the company’s anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company has an internal auditing division that audits the state of compliance and risk management across the group’s businesses. However, there is no clear evidence that the company’s anti-bribery and corruption programme is subject to internal or external audit.

Based on publicly available information, there is evidence that the company commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases.

However, the company receives a score of ‘1’ because it does not provide information on the investigative procedure from receipt to outcome, nor is it clear that investigations are handled by an independent team that reports to an independent board member. There is no evidence that the company commits to providing whistleblowers with updates on the outcome of investigations and it is not clear that information from each case is appropriately documented. There is also no evidence that a central body reviews summary information on all open cases on a regular basis.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company’s investigative procedure includes a commitment to report material findings to the board or, if necessary, to the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption-related investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. There is evidence that the results of risk assessments are reviewed at board level, and are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

However, it is unclear whether risk assessments are reviewed at least annually or when they reveal significant findings.

Although the company’s Audit Committee provides oversight of the anti-bribery and corruption programme, there is no publicly available evidence that the company regularly audits this programme.

There is evidence that the company has a system for tracking, investigating and responding to bribery and corruption allegations or incidents. The company commits to promptly investigating incidents and there is evidence that reports and investigations are documented and received by independent teams. There is evidence that the company has a specific procedure in place to deal with whistleblowing cases, which are handled by an external party, and whistleblowers have the option to receive updates on the outcome of investigations. The Audit Committee receives reports concerning the company’s whistleblowing line and summary information investigations on a quarterly basis.

However, the company’s stated procedures do not cover the whole investigation process from receipt of the report to final outcome, and so receives a score of ‘1’.

The company states that individuals handling whistleblowing reports have received training in ensuring that the reports remain confidential. Further statements indicate that the Global Ethics and Compliance Team ensures that investigative procedures are followed. However, there is insufficient publicly available evidence that the company assures itself of the quality of its internal investigations.

The company makes a clear commitment to report material findings of bribery and corruption from investigations to the board. An appropriate senior individual, the Vice President, Chief Ethics, Compliance and Sustainability Officer, is ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

The company publishes summary data of the number of reports received on its whistleblowing service relating to violations of its Code of Conduct, including bribery and corruption incidents. The data relates to employees at all levels and is published annually.

The data, however, does not include information on the number of investigations launched, nor disciplinary action taken as a result of investigation findings.

Based on publicly available information, there is some evidence that the company has a formal risk assessment procedure which covers the ethical, bribery and corruption risks facing the company’s operations. There is evidence that the results of these assessments are reviewed at board level, with responsibility assigned to the Audit Committee.

The company receives a score of ‘1’, however, because there is no clear evidence that the results of risk assessments are used to update the company’s anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company’s entire anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. There is evidence that this explicitly includes provisions for continuous improvement, supplemented by an internal and external audit every year. There is also evidence that high-level audit findings are presented to the board, with clear ownership assigned to the Audit Committee for planned updates and improvements to the anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company commits to investigating incidents, and that serious investigations are handled by external professionals to ensure independence. There is also evidence that information on each investigation is properly recorded.

However, there is no evidence that the company publishes information covering the whole investigative process, from receipt to final outcome, nor is there evidence of a public commitment to providing whistleblowers with updates on the outcome of investigations. Although there is evidence that the Audit Committee is informed of serious cases immediately, publicly available information indicates that it receives information on other investigations biannually.

Based on publicly available information, there is evidence that the company assures itself of the quality of its internal investigations including incident investigations and whistleblowing cases. There is some evidence that staff conducting investigations are properly trained/qualified.

However, the company receives a score of ‘1’ because there is no evidence that it has a procedure in place to handle complaints about the investigation process. Furthermore, while there is evidence that the company has revised its investigations process recently, there is no evidence that the company systematically reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

Based on publicly available information, there is evidence that the company commits to report material findings of bribery and corruption from investigations to the board.

However, there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

The company makes a public statement that there were no reports, investigations or disciplinary actions relating to employees during the most recent reporting year. There is evidence that the company publishes and updated this information on an annual basis.

There is no clear evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is evidence that the Audit Committee reviews the company’s ethics and compliance programme on an annual basis. However, it does not clearly state that it audits the programme or whether the findings of its review process are used to update the programme.

There is evidence that the company commits to investigating incidents and that it has a procedure for documenting and handling whistleblower reports. The company’s Ethics and Compliance Office is responsible for conducting investigations.

However, the company does not publish details of its whole investigation process from receipt to final outcome, nor is there evidence that it commits to providing whistleblowers with updates on the outcome of investigations. While the company states that the Chief Ethics and Compliance Officer has the authority to provide information on investigations to the Audit Committee, there is no clear evidence that the committee receives summary information of all investigations relating to bribery and corruption incidents on a regular or annual basis.

There is some evidence that the company assures itself of the quality of its internal investigations, by stating that employees with concerns about the actions or decisions of the Ethics and Compliance Office may contact the General Counsel.

However, there is no evidence that the company assures itself of the quality of both incident investigations and whistleblowing cases, it is unclear whether all staff conducting investigations are properly trained or qualified, and there is no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

There is evidence indicating that the company reports material findings of bribery and corruption to the Audit Committee, a designated board committee.

However, there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes high-level results from incident investigations and disciplinary actions.

Based on publicly available information, there is no evidence that the company has a formal risk assessment procedure which is used to inform its anti-bribery and corruption programme.

Based on publicly available information, there is no evidence that the company has an anti-bribery and corruption programme which is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company has an investigative procedure which includes a commitment to report material findings to the board or, if necessary, to the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company has a formal risk assessment procedure that informs the design of the compliance programme. The evidence suggests that the results of such reviews are used to develop tailored mitigation plans.

However the company receives a score of ‘1’ because there is no clear evidence to indicate the risk assessment goes beyond legal risks facing the company.

There is some evidence that the company’s anti-bribery and corruption programme, as part of its wider compliance programme, is subject to a regular audit process, which includes provisions for continuous improvement. There is also evidence that audit findings are reviewed by the board, with responsibility for implementing changes held by the Compliance Officer.

However, the company receives a score of ‘0’ because it is not clear from publicly available evidence how frequently audits or the efficacy testing take place, nor does the company specify that the entire programme is audited beyond financial accounts.

There is evidence that the company commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases, which stipulates actions to be taken at each step. There is evidence that the company takes steps to ensure the independence of its investigations. There is evidence that the company commits to put in place remediation plans and to report investigative findings to senior management and the board.

However, the information provided does not cover the whole investigation process from receipt to final outcome and it is not clear whether information on each investigation is documented. Furthermore, there is no evidence of a commitment to providing whistleblowers with updates on the outcome of investigations.

There is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels. The company explicitly states that staff tasked with conducting investigations are properly qualified and/or trained to perform the function. Any complaints about the handling of concerns and investigations are overseen by an appropriate senior management officer.

However, there is no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

Based on publicly available information, there is evidence that the company commits to report material findings of bribery and corruption from investigations to the board and relevant authorities.

However, there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is evidence that indicates that the company publishes some information on its ethical, bribery or corruption-related incidents and investigations involving company employees, on its intranet.

However, the company receives a score of ‘0’ because this data is not made publicly available and therefore it is not clear whether this covers all of the specific measures as described in the guidance, including whether the information applies to company employees at all levels. It is also not stated how frequently this data is updated.

There is no publicly available evidence that the company has a formal risk assessment procedure that is used to inform the company’s anti-bribery and corruption programme.

There is no publicly available evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company publicly commits to report material findings of internal investigations to its board or the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that is used to improve its anti-corruption and bribery programme. This process is overseen by the Risk and CSR Committee which reports on its activities to the board. The committee reviews the company’s statements on risk exposures which are included in the Annual Report and it is stated that the bribery and corruption risk assessment is conducted at least annually. It is clear that the findings of risk assessments are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

The company states that its anti-bribery and corruption programme is subject to a regular assurance process to ensure the programme is consistent with the business risks facing the company. This explicitly includes provisions for continuous improvement, supplemented by periodic internal audits. The Group Head of Internal Audit reports regularly to the board-level Risk and CSR Committee on the operation of internal control and risk management processes which has ownership for planned updates and improvements to the anti-bribery and corruption programme.

The company publicly commits to investigating incidents. The Risk and CSR Committee, which is composed of three non-executive directors, has a mandate to conduct investigations into ethical impropriety, which can be understood to include bribery and corruption. The Audit Committee receives a summary report on issues raised through the whistleblower system and major findings of internal investigations on a regular basis. There is evidence that the company’s procedure covers the whole process from receipt to final outcome, and there is some evidence regarding how each investigation is documented. The company commits to informing whistleblowers of the outcome of the investigation, if they so wish.

However, it is not clear whether all investigations are handled independently, and it is not clear whether the company commits to establishing root causes, putting in place remediation plans as a result of the findings of its investigations. COME BACK TO THIS

There is some evidence that the company assures itself of the quality of its internal investigations annually.

However, there is no evidence that the company assures itself of the quality of both incident investigations and whistleblowing cases, there is no evidence that staff conducting investigations are properly trained, and it is unclear who is responsible for the handling of complaints about the investigative procedure itself.

The company does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

The company does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. There is evidence that suggests that the board of directors reviews the company’s risk profile – presented by the Chief Compliance Officer – on at least an annual basis. The company states that the Chief Compliance Officer determines on a yearly basis whether a new risk assessment is required, with a full assessment conducted at least every three years. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is evidence that the company’s entire anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. This includes provisions for continuous improvement, supplemented by an internal audit conducted on an annual basis. There is also evidence that high-level audit findings are presented to the board, with clear ownership assigned to the Compliance Officer for planned updates and improvements to the anti-bribery and corruption programme.

There is evidence that the company publicly commits to investigating incidents promptly and objectively, and that the company takes steps to ensure the independence of its investigations. There is evidence that the company commits to putting in place remediation plans and reporting investigative findings to senior management and the board. For whistleblowing cases, there is evidence that the company has a procedure in place which covers the investigation process from receipt to final outcome, and the company commits to ensure whistleblowers are informed of the outcome. The evidence states that a senior central body of the company receives and reviews summary information of all incidents and their status on a quarterly basis.

Based on publicly available information, there is no clear evidence that the company assures itself of the quality of its internal investigations. The company states that systems are in place and that an Internal Auditor has access to information on the process; however there is no clear evidence that staff tasked with conducting investigations are properly trained to perform the function, nor that there is a procedure in place to receive and escalate, if necessary, complaints about the investigative procedure.

There is clear evidence that the company commits to report material findings of bribery and corruption from its investigations to the board. There is evidence that an appropriate senior individual is ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if found necessary.

The company publishes some high-level information on ethics and compliance-related complaints involving its employees. This information includes the number of reports received and the number of disciplinary actions.

However, the company receives a score of ‘1’ because this information does not cover the past 12 months, nor does it cover the number of reports received through whistleblowing channels and the number of investigations launched. The company also does not explicitly state that this ethics data includes details of bribery or corruption related incidents.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-bribery and corruption programme. The company indicates that the board reviews the results of risk assessments on an annual basis. There is evidence that these results are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

Based on publicly available information, there is evidence that the company’s entire anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. This includes provisions for continuous improvement, supplemented by an internal audit every year. There is also evidence that the board reviews high-level audit findings. The company indicates that its Internal Audit department is responsible for implementing updates and improvements to the risk management procedures and, by extension, the anti-bribery and corruption programme.

There is evidence that the company publicly commits to investigating incidents and takes steps to ensure the independence of its investigations. It commits to establishing root causes, putting in place remediation plans and reporting investigative findings to senior management and the board. For whistleblowing cases, there is a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome. The company indicates that at the conclusion of investigations it provides feedback to the individual who submitted the report. There is also evidence that the Public Policy and Corporate Responsibility Committee receives summary information on investigations on at least an annual basis.

Based on publicly available information, there is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels. There is evidence indicating that the staff conducting investigations are properly qualified and the company reviews its investigation process on a biannual basis. The company indicates that it conducts regular anti-corruption self-assessments to assure itself of the proper functioning of its systems, and there is some indication that complaints about the investigation process may be submitted through the company’s multiple reporting channels.

Based on publicly available information, there is evidence that the company commits to report material findings of bribery and corruption from investigations to the Policy & Corporate Responsibility Committee of the Board of Directors. The company’s Anti-Corruption & International Agreements, Ethics and Litigation and Global Security Services departments are responsible for ensuring the disclosure of criminal offences to relevant authorities.

The company publishes high-level data from ethics-related incidents and investigations involving company employees at all levels. This includes the number of reports received, including the number received through whistleblowing channels, the number of investigations launched, and the number of disciplinary actions as a result of investigation findings. There is evidence that this data covers the most recently reported financial year.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-corruption and bribery programme. There is evidence indicating that the Chief Compliance Officer presents the results of risk assessments to the Supervisory Board’s Audit Committee and executive board as part of reporting on the company’s compliance risk management system. There is also evidence indicating that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's compliance programme.

There is evidence that the company’s entire anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. There is evidence this includes provisions for continuous improvement, supplemented by internal and external audits. There is also evidence that high-level audit findings are presented to the board, with ownership assigned to the internal audit department to monitor improvements to the anti-bribery and corruption programme. There is evidence that these audits are conducted four to five times a year.

There is evidence that the company publicly commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step, from receipt to final outcome. This includes a commitment to notifying whistleblowers on the outcome of the investigation. There is evidence indicating that investigations are conducted by the company’s compliance team and overseen by the company’s independent Ombudsman. There is evidence that information on each investigation is documented and reviewed on an ongoing basis by the company’s compliance organisation.

There is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels. Any complaints about the handling of concerns and investigations are overseen by an appropriate senior management officer and a procedure is in place to handle the escalation of complaints. There is some indication that the company reviews its procedure in response to any changes in the regulatory environment.

However, there is no evidence that the company mentions specific training for the staff conducting investigations. There is also no evidence that the company reviews its investigations procedure at least every three years.

There is evidence that the company reports material findings of bribery and corruption from investigations to the board. The company states that it will cooperate with the relevant authorities to resolve matters if necessary.

However, there is no clear evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company clearly states that its anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company has an investigative procedure which includes a commitment to report material findings.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company’s risk management system incorporates compliance risk, which includes anti-bribery and corruption factors. Compliance risk assessments are reviewed by the Safety, Ethics and Sustainability Committee (a designated board committee), while the board has overall responsibility for risk management. The company indicates that it uses the risk assessment process to update its internal control framework. There is additional evidence indicating that the results of risk assessments are reviewed by the board on at least an annual basis.

The company states clearly that its entire anti-bribery and corruption programme is subject to regular internal and external audits to ensure the programme is consistent with best practice and the business risks facing the company. This process explicitly includes provisions for continuous improvement. There is also evidence that high-level audit findings are presented to the board’s Audit Committee, with ownership on implementing planned and required changes to the company’s anti-bribery and corruption programme assigned to senior members of the ethics and compliance department or other management areas, as appropriate.

There is evidence that the company commits to investigating incidents and that there is a specific procedure in place to deal with whistleblowing cases. This procedure covers the whole investigation process from receipt to outcome, and it is clear that information on each investigation is documented. Additionally, the company states that investigations are conducted by subject matter experts or independent managers, and commits to providing feedback to whistleblowers. The Safety, Ethics and Sustainability Committee regularly receives reports on issues raised through the company’s whistleblowing line and reviews the results of investigations.

There is evidence that the company assures itself of the quality of both its internal and whistleblowing investigations. Whistleblowing reports are initially handled by an independent external party whose staff receive specialist training; reports are then passed to internal investigations teams, which are generally managed by subject matter experts or independent managers supported by human resources. The company also states that internal investigations are handled to the same standards as whistleblowing cases, and it utilises specialist in-house investigators or specialist investigators. The company’s Safety, Ethics and Sustainability Committee reviews the company’s procedures for investigations and recommends any changes to the board on an ongoing basis, at least annually. Additionally, the company has a process for handling complaints about the investigations process, which are escalated to either the company’s Head of Ethics and Compliance, General Counsel or the Chairman of the Safety, Ethics and Sustainability Committee.

There is evidence that the company’s Safety, Ethics and Sustainability Committee refers reports on potential incidents and anti-bribery and corruption issues, raised through direct and whistleblowing channels, to the board. The company additionally states that its Head of Ethics and Compliance is responsible for evaluating investigation findings and disclosing criminal offences to relevant authorities if necessary.

The company publishes high-level data on ethical or bribery and corruption-related incidents and investigations involving company employees. There is evidence that this information is published on an annual basis and covers the number of reports received through internal channels and through the company’s whistleblowing channel. The company additionally publishes data on the number of investigations launched and disciplinary actions taken related to breaches of the company’s code of conduct.

There is evidence that the company has a formal corruption risk assessment procedure that informs the design of the anti-corruption and bribery programme.

However, the company receives a score of ‘1’ because there is no evidence that risk assessments are reviewed at least annually, or that the results are reviewed at board level.

There is evidence which indicates that the anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with the requirements of anti-corruption legislation and the business risks facing the company, and that recommended updates and improvements are made based on audit findings. However, while there is some evidence that the Audit Committees of subsidiary companies review audit findings, it is not sufficiently clear based on publicly available information that audit findings are presented to the Supervisory Board, or an appropriate board-level committee.

There is evidence that the company commits to investigating incidents, and that there is a specific procedure in place to deal with whistleblowing cases, which stipulates documentation, actions to be taken at each step and a commitment to providing whistleblowers with updates on the outcome of investigations. There is evidence that information on each investigation is documented and that the company carries out a summary analysis of investigations annually and presents the results to the company’s senior management.

However, there is no evidence that investigations are handled by an independent team or report to an independent board member and there is no publicly available information indicating that a central body reviews the status of investigations on at least an annual basis.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is evidence that the company reports criminal offences to the relevant authorities. However, there is no evidence of a clear commitment to report material findings of corruption to the board and it is not evident that an appropriate senior individual is ultimately responsible for evaluating whether to pass information to law enforcement agencies.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

The company states that it periodically conducts formal bribery and corruption risk assessments that are used to inform the design of the anti-corruption and bribery programme.

However, the company receives a score of ‘1’ because there is no evidence that risk assessments are reviewed at least annually, or that the results of these assessments are reviewed at board level.

The company states that its anti-bribery and corruption programme is subject to regular audit and that its anti-corruption policies and procedures are updated according to best practice and when audits reveal weaknesses. There is also evidence that audit findings are presented to the company’s Ethics and Control Committee.

However, the company does not clearly state that the entire anti-corruption programme is regularly audited, nor does it provide details on how often audits are carried out. The ownership for implementing required changes as identified in audits is also unclear.

The company publicly commits to investigating incidents, and there is evidence that there is a specific procedure in place to deal with whistleblowing cases, stipulating documentation and actions to be taken at each step. The company states that those submitting reports may be informed of the outcome of subsequent investigations, if they so wish. In addition to its own policies in relation to investigating reports of bribery and corruption, the company also includes information regarding its parent company’s hotline and whistleblowing policy, which apply to the company’s employees as well.

However, the company receives a score of ‘1’ because there is no clear evidence as to whether investigations are handled by an independent team or report to an independent board member, or whether summary information on investigations is reviewed by a central body.

There is no evidence that the company assures itself of the quality of its internal investigations.

The company states that material findings of bribery and corruption from investigations may be reported to the board and if necessary to the appropriate external authorities. However, it does not clearly identify in publicly available information a senior individual responsible for evaluating whether to report material findings of corruption and bribery to the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure in place that informs the design of its anti-bribery and corruption programme. The company indicates that the results of risk assessments are reviewed by the board on at least an annual basis, or when the results of the risk assessments reveal significant findings. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is some evidence that the company’s anti-bribery and corruption programme is subject to regular review, including internal and external audits. The company indicates that the results of these audits are presented to the board and then used to ensure that the programme is consistent with best practice and the business risks facing the company. The company also states that it reviews and adapts all anti-corruption related processes and policies at least every three years, or as regulatory requirements demand, with the company’s compliance department holding responsibility for implementing required changes.

There is evidence that the company has a system for tracking, investigating and responding to bribery and corruption allegations or incidents, including those reported through whistleblowing channels. The company indicates that it takes steps to ensure the independence of its investigations and that it commits to ensure whistleblowers are informed of the outcome, if they so wish. For whistleblowing cases, there is evidence of a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome. There is evidence that the company’s Board of Directors, Audit Committee and Group Executive Board receive summary information of all investigations on a quarterly basis.

There is some evidence that the company assures itself of the quality of its investigations. The company states that the Vice President Compliance & Risk Management and the responsible Compliance Officer conduct investigations, with support from the General Counsel. There is evidence that the company may involve external lawyers and specialised external audit or IT forensic service providers in complex investigations. In addition, the company indicates that it reviews its investigations procedure as part of a wider periodic review of its anti-corruption programme at least every three years or in response to changes in the regulatory environment.

However, there is no evidence that the company has a procedure in place to receive or handle any complaints about the investigation process.

There is evidence that the company commits to reporting material findings of bribery and corruption from investigations to the board. In addition, there is evidence that the Vice President Compliance & Risk Management and General Counsel are ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if found necessary.

The company publishes high-level information on its ethics and compliance-related incidents and investigations, involving company employees at all levels. The company provides details on the number of reports received, including those received through whistleblowing channels, the number of investigations launched, and the number of disciplinary actions as a result of investigation findings. There is evidence to suggest that this data is updated and published on an annual basis.

Based on publicly available information, there is some evidence that the company has a bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. However, the company receives a score of ‘1’ because there is no evidence that the assessment is updated on an annual basis nor that the results are reviewed at board level.

Based on publicly available information, there is evidence that the company’s Audit Committee reviews the company’s anti-bribery and corruption programme. However, the company receives a score of ‘0’ because there is no clear evidence that the results of such reviews are used to modify and update the anti-corruption programme. It is also unclear how frequently reviews take place.

The company publicly commits to investigating incidents, and there is evidence that the company has procedures for dealing with whistleblowing cases, which stipulate documentation and actions to be taken at each step. The company indicates that its Security Directorate reviews summary data on investigations, although it is unclear how frequently such reviews are conducted.

Based on publicly available information, the company receives a score of ‘1’ because there is no evidence that investigations are handled by an independent team and/or report to an independent board member. There is also no publicly available evidence that the company commits to providing whistleblowers with updates on the outcome of investigations.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations.

Based on publicly available information, there is evidence that the company makes a commitment to report material findings of bribery and corruption from investigations to its General Director. The company indicates that the General Director is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if found necessary. However, the company scores ‘1’ as there is no evidence that it commits to reporting findings to members of the wider board.

Based on publicly available information, there is evidence that the company publishes some data on the number of reports it receives via its reporting channels, including its whistleblowing line. There is evidence indicating that the company publishes this data every six months.

However, the information that the company publishes does not cover all of the specific measures described in score ‘2’, such as the number of investigations launched or the number of disciplinary actions taken as a result of investigation findings. Based on publicly available information, it is also not clear whether the data applies to employees at all levels, including board members or other executives.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. The results of risk assessments are reviewed by the board on at least an annual basis. There is evidence that the results of such reviews are used to develop mitigation plans.

There is some evidence that the company’s anti-bribery and corruption programme is subject to internal audit and that findings are presented to the Audit Committee and the board. The company indicates that the Audit Committee is responsible for evaluating the company’s anti-corruption and that it tasks internal auditors to evaluate and update specific areas of the programme on an annual basis. There is also evidence that the company conducts regular audits on a per-country basis, with evidence suggesting that it conducts approximately three per year.

However, the company receives a score of ‘1’ because it does not specify that its entire programme is audited to ensure that it is consistent with high standards of best practice and the business risks facing the company.

There is evidence that the company has a system for tracking, investigating and responding to bribery and corruption allegations or incidents, including those reported through whistleblowing channels. There is evidence that the company takes steps to ensure the independence of its investigations, conducts a root cause analysis and reports investigative findings to the board. For whistleblowing cases, there is a procedure in place that stipulates documentation and actions to be taken at every step of the case, and the company commits to informing whistleblowers of the outcome, if they so wish. The Ethics and Compliance Board and the Board of Director’s Audit Committee receive statistics and information on investigation results on at least a quarterly basis.

There is evidence that the company assures itself of the quality of both its internal investigations and whistleblowing procedures. The company indicates that investigations are undertaken by the company’s most senior compliance officers, and it is therefore assumed that they are properly qualified and trained to undertake the investigations. There is also some evidence that the investigation team is overseen by the Ethics and Compliance Board.

However, the company makes no mention of how complaints about the investigation process might be handled or whether they are appropriately escalated. There is also no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

There is evidence that he company commits to report material findings of bribery and corruption from internal investigations to the Audit Committee, the designated board committee responsible for anti-corruption, and the Ethics and Compliance Board, a managerial-level committee. Although the company does not explicitly make reference to a senior individual responsible for ensuring the disclosure of criminal offences to relevant authorities, there is sufficient evidence to indicate that the head of the Ethics and Compliance Board – the Saab General Counsel – is responsible for this process.

There is no publicly available evidence to indicate that the company publishes data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-bribery and corruption programme. The company states that this review is conducted biannually and the results are provided to group management.

However, the company receives a score of ‘1’ because there is no evidence that these results are reviewed at board level or by a designated board committee. The company also has a broader Enterprise Risk Management system, and the results of this risk mapping are provided to the Audit and Risk Committee. However, based on publicly available information, it is not clear that the Enterprise Risk Management process includes a review of bribery and corruption risks.

There is some evidence that the company’s anti-bribery and corruption programme is subject to internal and external audit. The company’s internal audit function conducts a continuous review of the company’s trade compliance system. The company also states that its entire anti-bribery and corruption programme was audited by an external company, the Agency in charge of Providing Technological Information (“ADIT), in May 2017. This certification lasts for three years, and the company states that this reflects high standards and international best practice.

However, the company receives a score of ‘1’ because several details about its audit procedures remain unclear. For instance, it is not clear whether the trade compliance system includes the anti-bribery and corruption programme. Moreover, it is not clear that the external audit completed in May 2017 is a regular undertaking that takes place at least every two years. Ownership and responsibility for the process is also unclear and there is no publicly available evidence that audit findings are presented to the Board or a designated board committee.

There is evidence that the company commits to investigating incidents and to providing whistleblowers with updates on the outcome of investigations. The company indicates that it has a Fraud Officer tasked with undertaking internal procedures for investigations. Although the company does not specifically state that a central body receives and reviews summary information on investigations, there is evidence that the Fraud Officer reports to the Compliance, Ethics and Anti-Fraud Committee and that this group meets several times a year.

However, the company receives a score of ‘1’ because the company only provides limited information on its systems for tracking, investigating and responding to bribery and corruption allegations or incidents on its website. It does not provide information on the whole investigation process from receipt to final outcome and it is unclear whether all investigations are handled by an independent team and/or report to an independent board member.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations. There is no information provided on the qualifications or the training of the company’s Fraud Officer responsible for undertaking its investigations. Moreover, there is no publicly available information on the handling of complaints about the investigation process, such as those responsible for handling such complaints and whether that person is of an appropriately senior level or function within the company. There is also no evidence that the company reviews its investigations procedure at least every three years or in response to any changes in the regulatory environment.

There is no publicly available evidence that the company’s investigative procedure includes a commitment to report material findings to the Board. There is also no evidence that an appropriately senior individual is responsible for reporting criminal conduct to the relevant authorities.

The company does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure in place which is used to inform the company’s anti-corruption programme. The company provides some information to indicate that it conducts risk management activities, but there is no further evidence to indicate that such assessments account for bribery and corruption risks, nor that the results are used to inform and update the company’s anti-corruption programme.

There is some evidence that the company’s anti-bribery and corruption programme is subject to regular audit or review to ensure the entire programme is consistent with best practice and the business risks facing the company. There is evidence that this includes receiving reports from management’s reviews of compliance.

However, the company receives a score of ‘1’ because there is no clear evidence that its anti-bribery and corruption programme specifically is subject to a formal audit or review process, nor is it clear that such reviews take place at least every two years. There is no evidence that audit findings related to the programme are presented to the board, and ownership of the process is unclear.

There is evidence that the company publicly commits to investigating incidents, and that there is a specific procedure in place to deal with whistleblowing cases. In addition, there is evidence that the Risk Oversight Committee is responsible for overseeing and handling complaints involving executive officers and other senior individuals such as the General Counsel and independent directors.

However, the company receives a score of ‘1’ because it does not publish further information on its investigative procedures for complaints involving non-executive individuals, such as employees and management. In addition, there is no evidence that investigations are handled by an independent team, nor that evidence that information on each investigation is documented and summary information on cases shared with a central body. There is also no evidence that the company makes a commitment to providing whistleblowers with updates on the outcome of investigations.

There is no publicly available evidence that the company takes steps to ensure the quality of its internal investigations.

There is no publicly available evidence that the company’s investigative procedure includes a commitment to report material findings from internal investigations to the board or to relevant authorities, if necessary.

There is no evidence that the company publishes any data on ethical, bribery or corruption investigations or the disciplinary actions involving its employees.

Based on publicly available information, there is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the ethics programme. There is evidence indicating that the results of risk assessments are reviewed by the board on at least an annual basis. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's ethics programme.

Based on publicly available information, there is evidence that the company’s ethics programme is subject to a regular audit process to ensure the programme is consistent with the business risks facing the company. This includes provisions for continuous improvement, supplemented by an internal or external audit every year. There is also evidence that high-level audit findings are presented to the board, with clear ownership assigned to an individual for planned updates and improvements to the ethical programme.

Based on publicly available information, there is evidence that the company publicly commits to investigating incidents and there is a specific procedure in place to deal with whistleblowing cases which stipulates actions and documentation to be taken at each step. It covers the whole investigation process from receipt to final outcome and there is a commitment to providing whistleblowers with updates on the outcome of investigations.

In addition, there is evidence indicating that all investigations are handled by independent teams, and that central bodies, the company’s Corporate Responsibility Committee and Executive Committee, review the status of cases on a regular basis.

Based on publicly available information, there is evidence that the company assures itself of the quality of both its whistleblowing and internal investigations. The company provides information on how complaints about the investigation process are handled and who is responsible for handling such complaints; that person is of an appropriate senior level within the company. The company indicates that internal investigations are carried out by appropriately trained individuals. In addition, there is evidence that the company reviews its investigation procedure periodically and at least every two years.

Based on publicly available information, there is evidence that the company’s investigative procedure includes a commitment to report material findings of bribery and corruption from investigations to the board. The company also indicates that the Group General Counsel is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon, if found necessary.

Based on publicly available information, there is evidence that the company publishes some high-level information on ethics and compliance-related incidents and investigations involving its employees. This data includes the number of reports received, number of reports received through whistleblowing channels, number of investigations launched, and the number of disciplinary actions as a result of investigation findings. This data is updated on an annual basis, and there is evidence to suggest that this data includes details of bribery or corruption-related incidents, investigations and disciplinary actions.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. The company indicates that the results of risk assessments are reviewed by the board on an annual basis. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is evidence that the company’s anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company, with audit findings being presented to the board annually.

However, the company receives a score of ‘1’ because there is no evidence that the audit process includes provisions for continuous improvement, supplemented by an internal or external audit at least every two years.

Based on publicly available information, there is evidence that the company commits to investigating incidents and there is a specific procedure in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step. There is evidence that investigations are conducted independently and are overseen by the board-level Audit Committee handles the internal investigations.

However, the company receives a score of ‘1’ because it is not clear whether the policy covers the investigation process from receipt to final outcome. There is also no evidence of a commitment to provide whistle-blowers with updates on the outcome of investigations, there is no evidence that the information on each investigation is documented and no summary information is reviewed by a central body.

Based on publicly available information, there is no clear evidence that the company has procedures in place to ensure the quality of its investigations. The company indicates that the Audit Committee may review findings of internal investigations if necessary, however it is not clear that this process – or additional procedures – are in place to ensure quality as described in the question scoring criteria.

There is some evidence that the company reports material findings of bribery and corruption from investigations to the board. However, the company receives a score of ‘1’ because there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

Based on publicly available evidence, the company publishes some high-level information on its corruption-related incidents and investigations involving employees on an annual basis. This information includes the number of investigations launched and the number of confirmed incidents related to corruption.

However, the company receives a score of ‘1’ because it does not include information on the number of reports received, including the number received through whistleblowing channels.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company has an investigative procedure that includes a commitment to report material findings to the board or relevant authorities.

The company does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-corruption and bribery programme. However, there is no evidence that corruption risk assessments are reviewed on at least an annual basis, or that the results of assessments are reviewed at board level.

The company states that its anti-bribery and corruption programme is subject to a regular internal audit process to ensure the programme is consistent with best practice and the business risks facing the company. The evidence suggests that periodic external audits are also conducted. The company states that the General Director is provided with an analysis of audit findings, and that the Department of Internal Control is responsible for implementing required changes. However, it is not clear how frequently audits are conducted.

The company publicly commits to investigating incidents, and there evidence that a procedure is in place to deal with reports. There is evidence that investigations are handled by the Department of Internal Control, which reports to the General Director. Publicly available information clearly stipulates the documentation which should be provided as part of the report and some of the actions that should be taken in response.

However, the company’s description in publicly available information of its investigative procedure does not cover the whole investigation process from receipt to final outcome and there is no evidence that the company commits to providing whistleblowers with updates on the outcome of investigations. It is also not clear whether summary information of investigations is reviewed by a central body, nor whether a central body reviews the status of investigations on at least an annual basis.

There is no evidence that the company assures itself of the quality of its internal investigations.

The company makes a clear commitment to report material findings of bribery and corruption from investigations to the General Director, a member of the company’s board. The company states that the General Director is ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if found necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure that is used to inform the company’s anti-bribery and corruption programme. The company publishes some information on its risk management procedures, but it is not clear that there are any procedures to identify and reduce certain risks related to bribery or corruption.

There is some evidence that the company’s compliance systems are subject to regular internal audit, however it is not clear that this includes the company’s anti-bribery and corruption programme. The company also states that it regularly evaluates and assesses its corporate governance and risk management systems to ensure regulatory compliance, but makes no specific reference to anti-bribery or corruption.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company takes steps to assure itself of the quality of its internal investigations.

There is no evidence that the company’s investigative procedure includes a commitment to report material findings to board members and the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-corruption and bribery programme. However, the company receives a score of ‘1’ because there is no evidence that it conducts such corruption risk assessments annually, or that the results of assessments are reviewed at board level.

There is evidence that the company's anti-bribery and corruption programme is subject to regular internal review, led by the company’s HR manager, and that this individual is responsible for implementing necessary changes to the programme.

However, the company receives a score of ‘1’ because the frequency of such reviews is unclear and there is no evidence that findings are presented to the board.

The company publicly commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step. The company also states that it will provide whistleblowers with updates on the outcome of investigations.

However, the company receives a score of ‘1’ because there is no evidence that investigations are handled by an independent team or report to an independent board member. In addition, the company does not provide further information on its investigative process, from receipt to final outcome. There is also no evidence that a central body reviews summary information on investigations on at least an annual basis.

There is no publicly available evidence that the company takes steps to ensure the quality of its investigations.

There is no evidence that the company has an investigative procedure which includes a commitment to report material findings of corruption to the board of directors. The company indicates that it may report findings from investigations to relevant authorities if necessary, but there is no evidence that a senior individual is responsible for ensuring that such disclosures are evaluated and acted upon.

There is no evidence that the company publishes any data on ethical or bribery and corruption incidents, investigations or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure that is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company takes steps to assure itself of the quality of its internal investigations.

There is no evidence that the company’s investigative procedure includes a commitment to report material findings to the board or, if necessary, to relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure in place that informs the design of its anti-bribery and corruption programme. The company indicates that the results of risk assessments are reviewed by the board on at least an annual basis, or when the results of the risk assessments reveal significant findings. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is evidence that the company’s entire anti-bribery and corruption programme is subject to a regular audit process to ensure the programme is consistent with best practice and the business risks facing the company. This includes provisions for continuous improvement, supplemented by an internal audit annually. There is also evidence that high-level audit findings are presented to the board, with ownership assigned to individuals for planned updates and improvements to the anti-bribery and corruption programme.

Based on publicly available evidence, the company publicly commits to investigating incidents promptly, independently and objectively. There is evidence that the company takes steps to ensure the independence of its investigations. It commits to establishing root causes, putting in place remediation plans and reporting investigative findings to senior management and the board.

For whistleblowing cases, there is evidence that the company has a procedure in place that stipulates documentation and actions to be taken at every step of the case, from receipt to final outcome, and the company commits to ensure whistleblowers are informed of the outcome, if they so wish. A senior central body of the holding or parent company receives and reviews summary information of all incidents and their status in the organisation and its subsidiaries, on an annual basis.

There is evidence that the company assures itself of the quality of its internal investigations, including those reported through whistleblowing channels. There is evidence that the company provides specific training for the staff tasked with conducting investigations. The company indicates that any complaints about the handling of concerns and investigations are overseen by an appropriate senior management officer and that it has a procedure in place to handle the escalation of complaints. The company’s investigations procedure is subject to review at least every three years, or in response to any relevant changes in the regulatory environment.

Based on publicly available information, there is evidence that the company makes a clear commitment to report material findings of bribery and corruption from investigations to the board. There is also evidence that an appropriate senior individual is ultimately responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if found necessary.

The company makes a public statement that there were no reports, investigations or disciplinary actions relating to employees during the most recent reporting year. There is evidence that the company publishes and updated this information on an annual basis.

Based on publicly available information, there is evidence that the company conducts annual assessments of its business units based on ethics and compliance risks. There is evidence that the results of these reviews are used to develop tailored mitigation plans. There is evidence that the results of such assessments are reported to, and reviewed by, the Audit Committee, which provides oversight of the company’s compliance programme.

Based on publicly available information, there is evidence that the company’s ethics and compliance programme is subject to regular audit. There is evidence indicating that the programme is audited to ensure that it is consistent with the business risks facing the company and that the results are used to update the ethics and compliance programme. The company indicates that this process takes place as part of an annual review, and there is evidence that findings are presented to the board-level Audit Committee. There is evidence that ownership of the process to implement updates and improvements to the programme rests with the Steering Committee on Corporate Ethics and Compliance Program.

There is evidence that the company publicly commits to investigating incidents, and that there is a specific procedure in place to deal with whistleblowing cases.

However, the company receives a score of ‘1’ because publicly available information on the investigatory procedure does not describe the whole investigation process from receipt to final outcome. There is also no clear evidence that investigations are handled by an independent team or report to an independent board member. Additionally, there is no evidence that the company makes a commitment to providing whistleblowers with updates on the outcome of investigations, nor that summary information on all investigations is reviewed by a central body on at least an annual basis.

Based on publicly available information, there is no evidence that the company assures itself of the quality of its internal investigations.

Based on publicly available information, there is evidence indicating that the company commits to report material findings of bribery and corruption from investigations to Audit Committee. However, there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is no evidence that the organisation has a formal risk assessment procedure which is used to inform its anti-bribery and corruption programme.

There is no evidence that the organisation’s anti-bribery and corruption programme is subject to audit or review.

There is no publicly available evidence that the organisation has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the organisation assures itself of the quality of its internal investigations.

There is no evidence that the organisation’s investigative procedure includes a commitment to report material findings to its board or to the relevant authorities.

The organisation does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of its anti-bribery and corruption programme. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme. The company states that its risk assessment procedure is continually updated. The company states that risk assessments are conducted continuously and that the results of these assessments are reviewed by the board at least quarterly.

There is evidence that the company’s compliance programme is subject to a regular audit process to ensure that it is consistent with best practice and the business risks facing the company. This includes provisions for continuous improvement and is supplemented by external audits. The company’s annual reports show that it conducted such audits in 2017/18 and 2018/19. The company states that high level audit findings are presented to the board on at least a quarterly basis, and that ownership for implementing recommended changes is assigned to the Corporate Compliance Department.

There is some evidence that the company has a system for tracking, investigating and responding to bribery and corruption allegations or incidents, including those reported through whistleblowing channels. There is some evidence that the company documents investigations and updates whistleblowers on progress. There is evidence that investigations are handled by an independent team. The company publishes an overview of its investigations process, from receipt to final outcome.

However, there is no publicly available evidence that a central body reviews summary information on investigations on a regular or annual basis.

There is some evidence that the company assures itself of the quality of its internal investigations and that the staff conducting investigations are properly trained and qualified. The company states that its Head of the Investigation Department and Chief Compliance Officer oversee the handling of complaints about the investigations process. The company additionally states that it reviews its investigations process regularly and in response to any changes in the regulatory environment.

There is evidence that the company reports material findings of bribery and corruption from investigations to the board. The company states that its Chief Compliance Officer is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

The company publishes some high-level information on its ethics and compliance-related incident reports received, including through whistleblowing channels, and subsequent investigations involving company employees at all levels, including board members.

However, the data is insufficiently detailed, and does not include exact figures of the number of reports received, the number of investigations launched, and the number of disciplinary actions as a result of investigation findings. There is also no evidence that the company publishes this data on an annual basis.

There is no evidence that the company has a formal risk assessment procedure in place that informs the design of its anti-bribery and corruption programme. The company provides some indication that its internal processes include risk management, however it is not clear that this includes anti-bribery and corruption risk nor that the results of specific risk assessments are used to update the programme.

Based on publicly available information, there is evidence that the company conducts audits of its compliance programme on an annual basis. The company indicates that the results of such audits are presented to the board, and there is evidence to indicate that the results of audits are used to review and update compliance measures.

However, the company receives a score of ‘1’ because it is not clear which committee, team or individual holds responsibility or ownership for planned updates and improvements to the anti-bribery and corruption programme.

There is evidence that the company commits to investigate incidents and that it has a specific procedure in place to deal with whistleblowing cases. There is evidence that the company assures itself of the independence of its investigations and that in some instances the informants are informed of the status of the investigation.

However, the company receives a score of ‘1’ because there is no publicly available information on the investigation process from receipt to final outcome, nor that the company’s procedure stipulates documentation and actions to be taken at each step. There is also no clear evidence that information from investigations is properly documented, nor that whistleblowers are informed of the outcome of the investigation in every situation.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations by ensuring that staff are properly trained, implementing a system to handle complaints about the procedure, or reviewing its procedure at least every three years. The company indicates that its Audit Committee may engage attorneys or public accountants as part of investigations, but it is not clear that such expertise is present for all cases.

There is no publicly available evidence that the company has an investigative procedure in place that includes a commitment to report material findings to the board or to the relevant authorities, if necessary.

Based on publicly available information, there is some evidence that the company publishes some high-level information on its ethics and compliance-related incidents involving employees. The company publishes the number of reports received through its internal and external reporting channels, and there is evidence that it collects and publishes this information on an annual basis.

However, the company receives a score of ‘1’ because there is no evidence that it publishes further data on this subject, such as the number of investigations launched or disciplinary actions taken as a result. In addition, it is noted that there is no evidence that this data has been published annually since 2017.

There is no publicly available evidence to indicate that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is evidence that the Audit Committee reviews the company’s ethics and compliance programmes on at least an annual basis. However, there is no clear publicly available evidence that the company conducts internal or external audits of these programmes, including audits of the company’s anti-bribery and corruption programme specifically.

Based on publicly available information, there is evidence that the company commits to investigating incidents and takes steps to ensure the independence of its investigations. There is evidence of a specific procedure in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step of the case, from receipt to final outcome. There is evidence to show that details about each investigation are documented and that a listing of complaints is periodically submitted to the Chair of the Audit Committee.

However, the company scores ‘1’ as there is no evidence that the company commits to providing whistleblowers with updates on the outcome of investigations. It is also not clear whether the Chair of the Audit Committee receives summary information on investigations on at least an annual basis.

There is no publicly available evidence to indicate that the company assures itself of the quality of its internal investigations.

Based on publicly available information, there is evidence that the company commits to report material findings of bribery and corruption from investigations to the Audit Committee. However, although the company states that it may report incidents to the appropriate authorities, there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to the relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is no evidence that the company has a formal risk assessment procedure which is used to inform the company’s anti-bribery and corruption programme.

There is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company has a publicly stated investigative procedure which includes a commitment to report material findings.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence the company conducts a corruption risk assessment of its entire anti-corruption programme at least once annually. The results of assessments are reviewed by the company’s Commission for Corruption Risk Assessment, which submits a report to the General Director, who approves suggested measures to implement to reduce and eliminate identified corruption risks.

There is evidence that the company’s anti-corruption programme is subject to an external audit at least once every three years. There is evidence indicating that the audit is based on an assessment of the business risks facing the company. The company introduces changes and modifies its programme based on the results of audits and assessments.

There is evidence that the company commits to investigating incidents and has a specific procedure to deal with whistleblowing cases. The company describes the whole investigation process from receipt to final outcome, and there is evidence that all cases are documented.

However, the company receives a score of ‘1’ because there is no evidence that investigations are handled by an independent team or report to an independent board member. The company also makes no commitment in publicly available evidence to providing whistleblowers with updates on the outcome of investigations. There is additionally no evidence that summary information of investigations is reviewed by a central body.

There is no publicly available evidence that the company assures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

There is evidence that the company informs law enforcement of material findings of corruption offenses.

However, there is no evidence that material findings of bribery and corruption are reviewed by the company’s board. While findings from investigations are presented to the General Director, in publicly available evidence the company does not name an appropriate senior individual specifically responsible for reviewing the need for reporting criminal offences to authorities.

The company publishes some high-level data on the disciplinary actions resulting from corruption and bribery incidents of its employees. However, the company receives a score of ‘1’ because it is not clear that this is data updated on an annual basis and the data does not clearly include information on the number of reports received (including those received through whistleblowing channels), or the number of investigations launched.

Based on publicly available information, there is evidence that the company has an annual process for enterprise risk assessment, which appears to include assessments of bribery and corruption risks. The board exercises oversight of the company’s risk assessment procedures.

However, the company receives a score of ’1’ because there is no clear publicly available evidence that the results of risk assessments are used to update the company’s anti-bribery and corruption programme and develop tailored mitigation plans.

There is publicly available evidence that the company’s anti-bribery and corruption programme is subject to regular review to determine whether the programme is effective in combatting bribery and corruption. There is evidence indicating that the mandate of the company’s internal audit function includes reviewing the company’s anti-bribery and corruption controls. The company states that the internal audit function reviews all business units on a two or three-year cycle. It reports directly to the Audit Committee, which also conducts an annual review of the company’s anti-bribery and corruption systems.

Based on publicly available information, there is evidence that the company publicly commits to investigating incidents and there is a specific procedure in place to deal with whistleblowing cases. There is evidence that the company takes steps to ensure the independence of its investigations, by requiring that responsibility for handling whistleblower reports be held by an independent director. The company states that all reports received through its whistleblowing channel will be reviewed and receive a response.

In addition, there is evidence that the company provides whistleblowers with updates on the outcomes of investigations and that information on each investigation is documented. There is evidence that the company’s Audit Committee receives reports on non-compliance with its anti-bribery and corruption programme on an annual basis.

Based on publicly available information, there is evidence that the company assures itself of the quality of its internal investigations. The company states that its investigations procedure is subject to review on an annual basis.

However, the company receives a score of ‘1’ because there is no evidence that the staff conducting investigations are properly trained or qualified. In addition, there is no publicly available evidence that the company has a process in place to handle complaints about the investigation process.

Based on publicly available information, there is evidence that the company reports breaches of its compliance programme to its Audit Committee, a designated board committee. However, there is no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is evidence that the company publishes some high-level results about the reports received through its whistleblowing system in the past 12 months.

However, based on publicly available information, it is not clear whether this includes investigations involving company employees at all levels. In addition, there is no evidence that the company publishes information about reports received through non-whistleblowing channels and any related investigations or disciplinary actions.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-corruption and bribery programme. The company indicates that it assesses and reviews the corruption risks that it faces on a regular basis, at least once a year.

However, the company receives a score of ‘1’ because there is no evidence that the results are reviewed at board level.

There is evidence that the company’s anti-bribery and corruption programme is subject to a regular internal audit process, which is used to inform and strengthen the company’s anti-corruption programme. However, the company receives a score of ‘1’ because there is also no evidence that audit findings are presented to the board of directors. It is also not clear that the entire programme is audited to ensure that it is consistent with high standards of best practice and the business risks facing the company.

There is evidence that the company publicly commits to investigating incidents and that it has a specific procedure in place to deal with whistleblowing cases. There is also evidence that each report of corruption-related incidents is documented.

However, the company receives a score of ‘1’ because it does not provide publicly available information on the whole investigation process from receipt to final outcome, nor does it commit to providing whistleblowers with updates on the outcome of investigations if they so wish. In addition, there is no evidence that that investigations are handled by an independent team or that a central body reviews summary information on cases.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations.

There is evidence that the company commits to report material findings of bribery and corruption to the relevant authorities and to cooperate with law enforcement agencies where necessary.

However, the company receives a score of ‘1’ because there is no evidence that a dedicated senior individual is ultimately responsible for ensuring that the disclosure of criminal offences is evaluated and acted upon, if necessary. Although the company indicates that its President is responsible for deciding whether to initiate an internal investigation, there is no further evidence to indicate that this individual is responsible for reporting externally or for ensuring that material findings from investigations are reported to the board.

There is no evidence that the company publishes any data on ethical or bribery and corruption incidents, investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-bribery and corruption programme. However, the company receives a score of ‘1’ because there is no clear evidence that risk assessments are reviewed at board level or on at least an annual basis.

There is some evidence to suggest that the company’s anti-bribery and corruption programme is subject to annual review.

However, the company receives a score of ‘1’ because there is no clear evidence that the entire programme is audited to ensure that it is consistent with high standards of best practice and the business risks facing the company. The company’s publicly available information mentions external auditors and experts, but their role and the frequency of their engagement is not specified. In addition, although there is evidence that the Audit Committee evaluates the implementation of the anti-corruption program, it is not clear whether audit findings are presented to the board, nor is it clear where ownership for implementing changes resulting from audits lies.

There is evidence that the company publicly commits to investigating incidents, and that it has specific procedures in place to deal with whistleblowing cases, which are set out in a corporation-wide policy published by the company’s parent company and available on its website. These procedures stipulate documentation and actions to be taken at every step of the case, from receipt to final outcome, and the company commits to ensure whistleblowers are informed of the outcome, if they so wish.

However, the company receives a score of ‘1’ because there is no evidence that investigations are handled by an independent team and/or report to an independent board member, nor that summary information on cases is reviewed by a central body on a regular basis.

There is no publicly available evidence that the company assures itself of the quality of its internal investigations.

There is some evidence that the company commits to report any incidents of corruption to law enforcement agencies.

However, the company receives a score of ‘1’ because there is no evidence that the company commits to report findings of corruption to the board. There is also no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

There is no evidence that the company publishes any data on ethical or bribery and corruption related incidents, investigations or disciplinary actions involving its employees.

There is no evidence that the company has established its own formal risk assessment procedure which is used to inform and update its anti-bribery and corruption programme.

There is no publicly available evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is evidence that the company publishes a policy on the reporting of corruption incidents by employees to compliance officers. In addition, the company provides a link on its website to a document outlining whistleblowing procedures developed by its parent company. It is therefore understood that this policy applies to the company, despite the company not making this explicitly clear.

Based on these publicly available documents, there is evidence of that the company commits to investigating incidents and that it has is a specific procedure in place to deal with whistleblowing cases. There is evidence that this procedure stipulates documentation and actions to be taken at each step, covering the procedure from receipt of the report to final outcome. However, there is no evidence that the company makes a commitment to providing whistleblowers with updates on the outcome of investigations. There is also no evidence that investigations are handled by an independent team or that a central body reviews summary information of all ongoing cases.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is no evidence that the company’s policies include a commitment to report material findings from investigations to the board of directors. In addition, the company states that the ‘responsible official’ is responsible for deciding whether to report any material findings to the authorities, however the seniority nor specific position of this role is not clear. The company therefore receives a score of ‘0’.

There is no evidence that the company publishes data on ethical or bribery and corruption-related investigations or disciplinary actions involving its employees.

There is some evidence that the company has a formal bribery and corruption risk assessment procedure in place that informs the design of the anti-corruption and bribery programme. The company indicates that the results of major risk assessments and recommendations for updates are presented to the company’s President. There is evidence to suggest that the results of corruption-risk assessments are reviewed at board level.

However, the company receives a score of ‘1’ because it is not clear from publicly available information that such risk assessments are conducted or reviewed on an annual basis. It is also not clear that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is some evidence that the company has formal procedures in place to conduct internal audits. However, it is not clear from publicly available information that the company has specific procedures in place to conduct audits or reviews of its anti-bribery and corruption programme on a regular basis, with oversight from the board.

There is evidence that the company publicly commits to investigating incidents, and there is some information available regarding procedures to deal with whistleblowing cases. There is evidence that the company provides those who report offenses with updates on the outcome of investigations.

However, there is no evidence that the company provides publicly available details on its investigative procedure from receipt to final outcome. In addition, there is no evidence that investigations are handled by an independent team or report to an independent board member, nor is there publicly available information to indicate that information on each investigation is documented or that a central body reviews summary information on cases on a regular basis.

There is no publicly available evidence that the company assures itself of the quality of investigations, for example by indicating that staff conducting investigations are properly trained, by implementing a policy to handle complaints about the process or by reviewing the investigation process every three years.

There is evidence that the company has a system in place to inform the Board of Directors of any violations of law or breaches of the Code of Conduct, which contains rules prohibiting bribery and corruption. In addition, there is evidence that the company commits to report material findings of corruption and criminality to law enforcement and the company indicates that the Vice President of the Security Department is responsible for interacting with law enforcement in such cases.

There is some evidence that the company provides some high-level data on the number of corruption-related criminal investigations initiated in a recently reported financial year.

However, there is no publicly available evidence that the company publishes further information on the number of reports received, number of investigations launched or number of disciplinary actions taken as a result. It is not clear that the criminal investigations mentioned in publicly available information include all internal investigations, nor that this includes incidents reported through both direct and whistleblowing channels. It is also not clear from publicly available information that the company publishes this information regularly or on an annual basis.

There is evidence that the company has a formal bribery and corruption risk assessment procedure that informs the design of the anti-corruption and bribery programme. There is evidence that the results of assessments are shared at board-level on at least an annual basis and that the company’s anti-bribery and corruption programme is updated based on these risk assessments.

The company states that the Internal Audit Directorate of the company evaluates its risk management system, which includes its anti-corruption programme.

While the company indicates that the risk management system is reviewed on an annual basis by the Board of Directors, it states only that the audits themselves are conducted regularly.

Based on publicly available information, there is no clear evidence that the company has a procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports.

There is no evidence that the company assures itself of the quality of its internal investigations.

There is evidence that the company has a system in place for informing the Board of Directors of any suspected violations of the law or its Code of Ethics.

However, it is not explicitly stated that this includes material findings of bribery and corruption and there is also no evidence that an appropriate senior individual is responsible for ensuring that the disclosure of criminal offences to relevant authorities is evaluated and acted upon if necessary.

The company does not publish any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.

There is evidence that the company has a formal bribery and corruption risk assessment procedure in place that informs the design of its anti-bribery and corruption programme. The results of risk assessments are reviewed by the board on at least an annual basis. There is evidence that the results of such reviews are used to develop tailored mitigation plans and to update specific parts of the company's anti-bribery and corruption programme.

There is evidence that the company’s entire anti-bribery and corruption programme is subject to a regular audit process on at least an annual basis to ensure the programme is consistent with best practice and the business risks facing the company. This process includes provisions for continuous improvement, supplemented by internal and external audits. There is also evidence that audit findings are presented to the Audit Committee, and that the General Counsel or head of ethics and compliance is responsible for implementing any changes as a result of these findings, alongside the Legal Department.

There is evidence that the company publicly commits to investigating incidents, and there is a specific procedure in place to deal with whistleblowing cases, which stipulates documentation and actions to be taken at each step. The company provides whistleblowers with updates on the outcome of the investigation if they so wish, and there is evidence that whistleblowing reports are handled by an independent team. There is evidence to indicate that the Ethics and Compliance Review Board reviews summary information and oversees all investigations.

The company receives a score of ‘1’ because in publicly available evidence the company does not provide full details on the investigation process from receipt to final outcome. There is also no publicly available evidence that the company Ethics and Compliance Review Board meets regularly or at least on an annual basis.

There is evidence that the company assures itself of the quality of its internal and whistleblowing investigations and that staff conducting investigations are properly training and qualified. There is evidence that the Ethics and Compliance Review Board (ECRB) receives and handles any complaints about the investigative process. The company indicates that it reviews its investigations procedure on at least an annual basis.

There is evidence the company commits to report material findings of bribery and corruption from investigations to the Ethics and Compliance Review Board. This body includes the company’s General Counsel who has a direct reporting line to the board-level Audit Committee. The company states that the Legal Department holds responsibility for disclosing material findings of corruption to the relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption reports, investigations or disciplinary actions involving its employees.

Based on publicly available information, there is no evidence that the company has a formal risk assessment procedure that is used to inform its anti-bribery and corruption programme.

Based on publicly available information, there is no evidence that the company’s anti-bribery and corruption programme is subject to audit or review.

There is no evidence that the company has a publicly stated procedure for dealing with bribery and corruption allegations, incidents or whistleblowing reports, despite some indication that it provides a whistleblowing helpline. There is no evidence that the company commits to investigating reported concerns or allegations, nor does it provide information on the conduct of internal investigations, such as whether cases are handled by an independent team and/or report to an independent board member. There is no evidence that a central body reviews summary information on all ongoing investigations on a regular basis.

Based on publicly available information, there is no evidence that the company assures itself of the quality of its internal investigations, for example, by ensuring that staff conducting investigations are properly trained or by stipulating a procedure to handle complaints about the investigation process.

Based on publicly available information, there is no evidence the company’s investigative procedure includes a commitment to report material findings to the board and, if necessary, to relevant authorities.

There is no evidence that the company publishes any data on ethical or bribery and corruption investigations or disciplinary actions involving its employees.