WIXLIB

Questions, comments, feedbackIf you have any questions or comments, please contact content@sedexglobal.com.SEDEX SUPPLIER W ORKBOOK · PART 4: BUSINESS ETHICSx

SEDEX SUPPLIER WORKBOOKChapter 4.1BUSINESS ETHICSMANAGEMENTSYSTEMS

Business Ethics ManagementSystemsBenefitsWhy should you do it?What does it mean?Building responsibility for business ethics into yourbusiness management system will help you staywithin the law, avoid penalties and meet yourcustomers’ requirements.A Business Ethics Management System is the setof interdependent policies, processes, andprocedures that a company uses to conduct itsoperations legally, ethically and consistent with itsvalues.There can also be business benefits, such as:a) Improving your company’s image andreputation.b) Achieving both your business and socialresponsibility objectives.A management system also serves to continuouslyimprove key business processes and outcomes tomeet core strategic goals. A Business EthicsManagement System is how a company effectivelycontrols risks of bribery, corruption, collusion andother business conduct issues.c) Building and maintaining customer trust.d) Avoiding ethical dilemmas.e) Cost savings through improvements in systemefficiency.Conducting your business in an ethical manner isan important social responsibility objective and aregulatory requirement. An effective BusinessEthics Management System balances theserequirements with running a successful business.Advantages of a Management Systemapproach to Business EthicsTo be successful in this approach, we: Effective management systems strengthenyour company’s ability to:Describe the possible unintended ‘businessethics’ outcomes of policies and proceduresthat are meant to achieve businessobjectives. Develop suitable policies, plans andobjectives. Implement the appropriate businessprocess controls. Identify operational controls to manage oravoid these unwanted outcomes. Identify the necessary human andfinancial resources. Show how to monitor and measure theeffectiveness of your controls to ensure youmeet standards. Measure and continually improveperformance.This section will help you check whether there is arisk of not maintaining essential managementsystem elements in your current businessoperations, and if so, how to put controls in placeto make sure you meet standards.Note: The approach described in this chapter is similar tothose described in Labour Management Systems,Environmental Management Systems, and Health & SafetyManagement Systems.2

Other International Standards and Guidelines:Requirements ISO 26000 (2010), Section 6.6, Fair OperatingWhat do you need to do?Practices, contains specific guidance on howcompanies can manage business practicesrisks:There are no ETI Base CodeClauses that address businessethics. However, business ethicsis an essential component ofcorporate responsibility and socialcompliance. As such, Sedexrecommends member companiesto use a management systemsapproach to control businessethics risks like bribery, corruption, legal compliance,protecting sensitive information and whistleblowerprotection.Fair operating practices concern ethicalconduct in an organisation's dealings withother organisations. These includerelationships between organisations andgovernment agencies, as well as betweenorganisations and their partners, suppliers,contractors, customers, competitors, and theassociations of which they are members.Fair operating practice issues arise in theareas of anti-corruption, responsibleinvolvement with public officials, faircompetition, socially responsible behaviour,relations with other organisations and respectfor property rights.ETI Principles of ImplementationAlthough developed primarily to improve conditions forworkers, the ETI Principles of Implementation provideuseful guidance for suppliers who would like tointegrate ethical business practices into their businessmanagement system.1.Commitment (policy, communication,resources, strategy).2.Integration with core business practices(supplier selection, terms of agreements,internal buy-in).3.Capacity Building (worker awareness, effectiveindustrial relations).4.Identifying problems in the supply chain (riskassessing and sharing, monitoring andevaluation, worker complaint mechanisms).5.Improvement actions (enabling remediation,time-bound remediation, tackling root causes).6.Transparency (fair and accurate reporting,response to violations). FCPA – Foreign Corrupt Practices Act(1998) requires:— Due diligence on customers, the natureof their business and the types offinancial transactions they undertake.Relevant ILO ConventionsAll of the ILO core conventions are essential forcompliance to good business ethics, as well asimportant considerations in supply chainmanagement.— Conducting senior managementmeetings where the risks of bribery and3

corruption are reviewed, discussed andrecorded. There is no damage to company reputation asa result of fraudulent or unfair businesspractice. The same business ethics issues do not occurrepeatedly. Workers, supervisors and managers areproperly trained on ethical business practicesand responsibilities. There is a process to protect the confidentialityof supplier and employee whistleblowers.— Staff training.— Independent monitoring. Sarbanes-Oxley Act (2002) requirescompanies ‘to protect investors by improvingthe accuracy and reliability of corporatedisclosures made pursuant to the securitieslaws.’ UK Bribery Act (2010) creates the followingoffences:It is important that you also regularly monitor yourprocesses and controls to make sure they areworking.— Active bribery: promising or giving afinancial or other advantage.— Passive bribery: agreeing to receiveor accepting a financial or otheradvantage.A systems approach is ‘selfcorrecting.’ It will enable to youmake sure that all requirementsare being consistently met.— Bribery of foreign public officials.— The failure of commercialorganisations to prevent bribery byan associated person (corporateoffence).PoliciesAchieving and MaintainingStandards(rules)How do you do it?Your company should have a business ethics policy orcode that includes the following:You can best meet standards by using a systemsapproach. In other words, you add controls to theprocesses you already use to run your business. Andyou make sure your policies and procedures aredesigned to ensure that: You are aware of legal and customerrequirements. There is a company or facility policy onbusiness ethics. You know the risks in current business ethicsthat could lead to compliance issues. There is a process in place to verify thatworkers and management are workingaccording to legal and customer requirements. A written statement that clearly defines yourcompany’s approach to conducting business in afair and ethical manner. This should includecommitments to: Compliance with applicable local andinternational laws and regulations. Adhering to all customer requirements,including customer-specific codes ofconduct. Continual improvement in ethical businessperformance. The scope of the policy should include, at aminimum, all of the following business ethicstopics:4

Prohibiting bribery, corruption andextortion. Giving and receiving gifts. Protection of company and customerintellectual property and information. Fair business practices (anti-collusion,advertising). Protection of identity (whistleblowerprotection). Protecting privacy of personalinformation. Accuracy of financial records andreports.allegation reporting process to make sure thatalleged business conduct issues are addressed. Monitoring and following up on all concerns andissues related to the implementation of businessconduct policies and procedures. Performing an annual review of yourmanagement system to make sure it is effectiveand achieving your objectives, and to make anyrequired adjustments. A formal process for workers, managers,supervisors, suppliers, and customers toanonymously report any concerns regarding theimplementation of business ethics policies.Your business ethics and other business functionprocedures should include:Please refer to the Anti-Corruption chapter thatprovides more details on these topics. Ways to track and understand business ethics The policy should be signed by the most seniorlaws, regulations, and customer requirements.manager of the company. A process to identify the risks in the way youconduct business that could lead to violations ofbusiness ethics standards.Procedures A procedure that limits the amount and frequency(practices)of business gifts that employees can give orreceive from suppliers and customers.Management should assign a responsible person(or department) with documented roles,responsibilities and authority to make sure yourpolicy commitments are achieved, that regulatorycompliance is maintained and that business ethicsstandards are met. This includes: A formal process to screen and select yoursuppliers based on their ability to meet yourpolicies and business ethics laws and regulations. A process describing how the company records,discloses and reports its business activities andfinancial performance. Communicating your policies to all managers,supervisors, and workers. A procedure that describes how the company Making sure that all managers and employees ofprotects its own intellectual property and that ofits suppliers and customers.the company have clearly defined roles andresponsibilities for carrying out your businessethics policies. Meeting regularly with managers and supervisorsresponsible for sales, supplier and vendormanagement, advertising, finance, and otherfunctions, to oversee the implementation of yourbusiness ethics programmes and procedures. Working with the individual or departmentresponsible for the company’s business ethics5

The ways in which the company protects theCommunication and Trainingprivacy of personal information of every personyou do business with.You should use the following methods to make sureyour employees are aware of your business ethicspolicies and procedures: A formal process for workers, managers,suppliers and customers to anonymously reportany concerns about the implementation of yourcompany’s policies. The process should detail theway your company investigates and resolvesreported allegations. Provide training programmes for new managers,supervisors, and newly hired workers on yourcompany’s business ethics policies andprocedures. A disciplinary procedure for company employees All employees must be provided with on-goingand managers who are found to have violatedcompany business conduct policies andstandards.training and information on the business ethicsissues associated with their jobs using classroomtraining, team and department meetings, writtenmaterials, and work area postings.The Anti-Corruption chapter in this workbook describesin more detail the procedures needed for specificbusiness ethics issue areas. Make sure the training covers all applicablebusiness ethics laws and regulations. Use scenarios in the training that are tailored toThe Headline Testlocal issues and culture.Before making a businessdecision, consider how it wouldlook on the front page of thenewspaper or as the lead story onthe evening news. Display business ethics policies and local legalrequirements in areas where all employees willsee them and in a language they understand. Communicate the company’s business ethicsrequirements, as well as the laws and standards,to the company’s suppliers using your website, incontract terms and conditions, and during periodicmeetings. Communicate the company’s allegation reportingprocedures and explain how to report concernsrelated to how the company conducts itsbusiness.6

The topic-specific documents listed in the Anti-Living Up to Your Company’sValues Corruption chapter of this workbook.Always do the right thing in businessdealings with customers, suppliersor governments, even with pressureor incentive to do otherwise. However, do not put yourself indanger. Report any incidents ofthreats or pressure to violatebusiness ethics policies to yourcompany’s responsible manager. Remember that your company’sreputation is your most valuableasset but can be easily lost.MonitoringYou will need to check if your business ethics policiesare being followed and that the controls to make sureyour company is meeting code and legal requirementsare effective. The following steps can be used toevaluate and improve the effectiveness of yourprograms:1. Audit your system to identify actual and potentialproblems meeting laws and standards. Audits canbe performed by trained and qualified internal staffor by external auditors—including from your owncustomers. Self-audits, including ‘spot’ audits, should beperformed regularly to determine if you aremeeting internal standards and both legal andcustomer requirements.Documentation and Records Any audit issues should be evaluated todetermine their underlying cause(s) andaction plans established to put in placecorrective and preventive actions.Meeting standards requires proper documentation.You will need to keep the following on file on yourcompany premises: The person or department that oversees Copies of your business ethics policy signed bymatters related to ethical business practicesshould also be assigned to monitor issuetrends. This person can then identify and/oranticipate problems and coordinate with othermanagers or departments to developsolutions that address concerns and preventthem from recurring.senior management. Copies of all applicable laws and the facility’slegal responsibilities for business ethics. Copies of key business conduct procedures, suchas anti-bribery, fair advertising, gifts, reportingallegations of misconduct, and others asdescribed in the chapter that follows.What Are Examples of Conflicts ofInterest? Management and Board of Directors meetingminutes, action items, and attendance records. Company employee has outsideemployment or receives compensationfrom a supplier, customer or competitor. Officer or owner of the company has amajor financial interest in a supplier,customer or competitor. Conducting business with a companywhen someone in your family has amajor role in that company. Copies of internal and third party business andfinancial audit reports, and inspection reports byregulatory agencies. Records of allegations of business misconduct. Business ethics corrective action plans andreports, including documented evidence ofimprovements made.7

More than one functional department is oftenresponsible for business conduct issues.Solutions to problems may involve, forexample:2. Establish and track key performance indicators(KPIs) to measure how well your businessmanagement processes and procedures areworking on an on-going basis. Procurement staff who managecontracts with sub-contractors, on-sitecontractors and other suppliers. Finance staff for the practices ofreporting business and financialperformance. Internal auditors who monitor problems. Supervisors to monitor theimplementation of policies every day. Regularly survey workers to measure theirsatisfaction with the implementation of yourbusiness conduct policies and practices. Track the number and type of reportedallegations of business misconduct. Establishgoals and metrics for issue areas that may bein need of improvement. Measure training effectiveness and learningWhen identifying a solution to a businessethics problem, work with all departments andpersonnel involved.retention by testing employees immediatelyafter training, and using follow-upquestionnaires three to six months aftertraining.Best Practice3. Investigate problems and analyse why theyoccurred. When a situation arises that indicatesthe existence of non-conformance with companybusiness ethics policies and customer code(s) ofconduct, the company should investigate thecauses, not just the condition, and what can bedone to address them.Cooperate with Internal Investigations Make sure that everyone in your companycooperates with investigations of allegedmisconduct. Be sure to answer any questions frominvestigators or regulators openly andhonestly. Every allegation and incident is anopportunity to improve your procedures andother controls. Every reported issue shouldbe investigated to find the underlying causesand develop action plans to makeimprovements that will prevent a recurrence.Actions should also aim to prevent similarincidents throughout the business. Preserve all documents and records that maybe requested as part of an investigation oraudit. If your internal audit finds the same or similarbusiness ethics issues repeatedly, it couldmean that your process to identify and assignresponsibility for putting in place correctiveand preventive actions is not working. Similarly, if you have taken action but are stillnot meeting standards, it could mean that thecorrective actions (controls) themselves arenot effective and need to be improved.4. Work with other departments to identifyreasonable solutions. Take care to developsolutions so that the problem does not recur andthe solution itself does not create other problems.8

must be at least detailed enough to meet thoserequirements.Common Audit Non-compliances fromthe Sedex DatabaseAs for records, you only need to maintain items thatare needed to verify that you are meeting standards,such as financial records, copies of non-disclosureagreements, and records of allegations of misconductand how they were investigated and resolved.The following are the most common noncompliances against this issue. If properlyimplemented, the guidance in this chapter canhelp reduce the incidence of these problems:My company has a certified Quality ManagementSystem. Can we use this system for businessethics? Inadequate code and systemimplementation. Inconsistent recordkeeping.Yes. In fact, any company that has a fo

business practices. Through a secure online platform, Sedex members can share and manage information related to Labour Standards, Health & Safety, The Environment and Business Ethics. Members also have access to a range of resources and reports, including industry specific questio