CIF - Latin American Companies Circle - Recommendations on Ethics and Compliance

LATIN AMERICAN

COMPANIES CIRCLE Recommendations on Ethics and Compliance

In partnership with: Wichtiger HINWEIS !

Innerhalb der Schutzzone (hellblauer Rahmen) darf kein anderes Element platziert werden! Ebenso darf der Abstand zu Formatresp. Papierrand die Schutzzone nicht verletzen! Hellblauen Rahmen der Schutzzone nie drucken! Siehe auch Handbuch „Corporate Design der Schweizerischen Bundesverwaltung“ Kapitel „Grundlagen“, 1.5 / Schutzzone www . cdbund.admin.ch©2017 Copyright. All Rights Reserved This paper is one in a series by the members of the Latin American Companies Circle and intended as a thought piece to encourage debate on important corporate governance topics.The conclusions and judgments contained in this report represent the views of the authors and should not be attributed to, and do not necessarily represent the views of the IFC or its Board of Directors or the World Bank or its Executive Directors, or the countries they represent. IFC and the World Bank do not guarantee the accuracy of the data in this publication and accept no responsibility for any consequences of their use. The material in this work is protected by copyright. Copying and/or transmitting portions or all of this work may be a violation of applicable law. The Latin American Companies Circle encourages dissemination of works such as these and hereby grants permission to users of this work to copy portions for their personal, noncommercial use, without any right to resell, redistribute, or create derivative works there from. Any other copying or use of this work requires the express written permaission of the Latin American Companies Circle. For information, please contact Magdalena Rego at mregorodriguez@ifc.org About the Latin American Companies Circle The Latin American Companies Circle is a unique initiative launched in May 2005 in Sao Paulo, Brazil at the recommendation of the Latin American Corporate Governance Roundtable, a network of public officials, investors, non-governmental institutes, stock exchanges and associations as well as others interested in corporate governance

About the Latin American Companies Circle The Latin American Companies Circle is a unique initiative launched in May 2005 in Sao Paulo, Brazil at the recommendation of the Latin American Corporate Governance Roundtable, a network of public officials, investors, non-governmental institutes, stock exchanges and associations as well as others interested in corporate governance improvements in the region. The Companies Circle bring together a group of leading Latin American companies who have adopted good corporate governance practices in order to provide private sector input into the work of corporate governance regional development and to share their experiences with each other and other companies in the region and beyond. The Companies Circle is sponsored by IFC and it is supported by the Organisation for Economic Co-operation and Development (OECD). For more information, visit www.ifc.org/ companiescircleLATIN AMERICAN COMPANIES CIRCLE

TABLE OF CONTENT

I. INTRODUCTION..................................................................................1

II. ETHICAL PRINCIPLES........................................................................2 a) Code of Ethics........................................................................2 a.1) Content......................................................................2 a.2) Procedures................................................................3

III. THE COMPLIANCE FUNCTION......................................................4

a) The regulatory Environment ..............................................4 b) Responsibilities.......................................................................4 c) Rationale...................................................................................5 d) Structure...................................................................................5 d.1) Conglomerates and Subsidiaries..........................6 d.2) Independence...........................................................7

IV. EFFECTIVE COMPLIANCE PROGRAMS........................................7 a) Communication Practices.....................................................8 b) Manuals......................................................................................9 c) Awareness Evaluation............................................................10LATIN AMERICAN COMPANIES CIRCLE

1

I. INTRODUCTION This paper comprises a set of recommendations related to ethical principles and the corporate compliance function. While ethics and compliance alone do not, and cannot, constitute a comprehensive corporate governance system in a company, they do comprise two critical components of such system. This paper is based on discussions and input from, as well as on responses to a questionnaire on compliance distributed among, member companies of the Compliance and Ethics Working Group

stitute a comprehensive corporate governance system in a company, they do comprise two critical components of such system. This paper is based on discussions and input from, as well as on responses to a questionnaire on compliance distributed among, member companies of the Compliance and Ethics Working Group (the “Working Group”) of the Latin American Companies Circle (the “Companies Circle”). The Companies Circle is a group of Latin American firms that have demonstrated leadership in advocating for corporate governance improvements in companies throughout Latin America, and which seek to practice advanced corporate governance themselves. This initiative is supported by the Swiss State Secretariat of Economic Affairs (SECO) as part of the Latin America and the Caribbean (LAC) Corporate Governance Program. The Companies Circle is composed of 13 companies: Los Grobo (Argentina); Algar, CPFL Energia, Embraer, Natura, and Ultrapar (Brazil); Grupo Argos and ISA (Colombia); Florida Ice & Farm Co. (Costa Rica); Gentera (Mexico); Buenaventura, Ferreycorp, and Graña y Montero (Peru). The Working Group is chaired by Graña y Montero and its members comprise Algar, CPFL Energia, Grupo Argos, ISA, Florida Ice & Farm Co. and Ferreycorp. Drafting support for this paper was provided by Luis Mariano Enriquez, Santiago Chaher, Magdalena Rego Rodriguez and Oliver Orton from IFC. This paper is based on feedback from Working Group members and does not necessarily represent IFC’s or the World Bank Group’s views on these matters. In addition, this paper does not intend to cover all aspects related to ethics or compliance as it is solely intended to provide a general overview of suggested practices. The objective of this paper is to share a set of good practices for companies in Latin America toconsider in developing, implementing or improving their ethical guidelines and complito ethics or compliance as it is solely intended to provide a general overview of suggested practices. The objective of this paper is to share a set of good practices for companies in Latin America toconsider in developing, implementing or improving their ethical guidelines and compliance policies and practices. This paper does not assume that all Companies Circle members will follow all of these practices; nor does it suggest that all companies should follow all the suggested practices — each company is unique and needs to take into consideration its own individual situation, needs and circumstances (such as local laws and regulations, ownership patterns, history and culture, market practices, and the requirements of its relevant stakeholders (whether local or foreign, governmental or private)). The Companies Circle considers this paper as a ‘living’ document which may be updated from time to time to reflect changing realities, as well as to draw attention to developments in the corporate governance field. Ethical conduct is key to a company’s reputation and its own good standing. Unethical acts may not only tarnish the image or brands of an entire group of companies, but could also result in severe legal consequences, including the imposition of penalties and even the liquidation of the affected company. It is therefore imperative that a company ensures that its personnel abide by clear ethical guidelines and are subject to sanction in the event of non-compliance. Sound compliance programs are also highly important, not only for the purposes of adherence to applicable laws, standards and regulations, but also in assessing the effectiveness of a company’s control system, and mapping and mitigating the various risks relevant to a sustainable business operation. In certain cases, major transactions may even be cancelled, and profits reduced, as a result of compliance-related concerns and, therefore, it is in every company’s interest to pursue best practices regarding compliance. Other benefits of a sound compliance program come in the form of increased trust, credibility and reputation both within the comprofits reduced, as a result of compliance-related concerns and, therefore, it is in every company’s interest to pursue best practices regarding compliance. Other benefits of a sound compliance program come in the form of increased trust, credibility and reputation both within the company itself as well as externally, which in turn can generate additional business opportunities, and ultimately enhanced profitLATIN AMERICAN COMPANIES CIRCLE 2

II. ETHICAL PRINCIPLES a) Code of Ethics To concentrate and disseminate its ethical values and principles, the standard practice is for a company to have such values and principles documented in policies developed by the company. An effective code of ethics serves as a means to mitigate reputational and legal risks associated with misconduct within a company. The effectiveness of a code of ethics is strengthened by the existence of so-called whistleblowing and monitoring procedures to assess whether the code is in fact being complied with or not. To reflect its importance in a company as a whole and to adopt it as an internal corporate regulation, a code of ethics should be approved by the Board of Directors. Within the context of a conglomerate, all wholly-owned subsidiaries comprising a company group should follow a single code of ethics as determined by the parent company

(this code of ethics should also be approved by the Boards of each subsidiary to ensure commitment at the subsidiary level). Ultrapar stresses the need to differentiate between two approaches commonly adopted in the development of a Code of Ethics: a principles-based code and a prescriptions-based code. Principles-based codes often require complementary policies and norms while prescriptions-based codes are more directive. One advantage of principles-based codes is that they tend to encompass broader concepts, thus reducing the probability of relevant matters not being considered. In addition, through supplemental policies and norms, the company can add new concepts and specific directions more readily than in a prescriptions-based code. a.1) Content

tend to encompass broader concepts, thus reducing the probability of relevant matters not being considered. In addition, through supplemental policies and norms, the company can add new concepts and specific directions more readily than in a prescriptions-based code. a.1) Content While codes of ethics vary significantly in their scope, there are a number of common principles that should be provided for under such a code for it to effectively set forth appropriate ethical guidelines and address consequences for potential misconduct. It is recommended that a code of ethics at least encompasses the following subject-matters : (i) Compliance with Laws and Regulations – Given the material adverse effects deriving from legal or regulatory violations, any company should be clear in requiring that all its personnel act in compliance with applicable laws and regulations. No transgression should be tolerated. (ii) Respectful Conduct – It is suggested that a code of ethics expressly require the existence and maintenance of a respectful workplace environment and, conversely, it should include provisions expressly prohibiting any type of harassment and discrimination. (iii) Confidential Information – Company personnel should properly handle confidential information (particularly with respect to material non-public information in the case of listed companies), which should only be disclosed to the market in strict adherence to applicable laws and regulations. Client information should be maintained as strictly confidential. In justified instances and only when prior consent has been previously provided by the respective client, its information may be publicly disclosed (for example, when a transaction involving a client is required to be disclosed to the market as a material event). (iv) Transparency and Disclosure of Information – Employees (including management) and Board members should be required to communicate all information for public disclosure in an accurate and truthful manner. Any public disclosure of information should be coordinated within the company. Many companies have specific rules regarding communication with the media, including social media. It is suggested that the dismembers should be required to communicate all information for public disclosure in an accurate and truthful manner. Any public disclosure of information should be coordinated within the company. Many companies have specific rules regarding communication with the media, including social media. It is suggested that the disclosure of information be concentrated in a single individual, who should be responsible before investors, regulators and the market for acting as the official voice of the company. The Board is responsible, in any event, for ensuring the company has a documented information disclosure policy, and for overseeing its application. (v) Conflicts of Interests – As a general principle, employees should avoid potential conflict of interest situations and, in the event a potential conflicting situation does arise, a conflicted employee should disclose this circumstance toLATIN AMERICAN COMPANIES CIRCLE 3 the company (notice is commonly provided to a person’s immediate superior, an appointed ethics officer or an ethics committee). For reference purposes, it is standard practice to include within a code of ethics a definition of the facts and circumstances deemed to comprise a conflict of interest situation and provide a non-comprehensive set of examples of situations constituting a conflict of interest. Depending on the circumstances of the company, it may also be appropriate to include provisions dealing with relationships with competitors, including formations of cartels for example which is a crime in many jurisdictions. (vi) Government Relationships - A code of ethics is recommended to provide for an honest and transparent relationship with all levels of government (i.e. federal, state, municipal and regulatory agencies, etc.) and for these purposes, it should include clear prohibitions on bribery and corruption. (vii) Receipt and Delivery of Gifts – A code of ethics should include provisions governing both the receipt and delivery of gifts. Gifts are recommended to be rejected or avoided when their

it should include clear prohibitions on bribery and corruption. (vii) Receipt and Delivery of Gifts – A code of ethics should include provisions governing both the receipt and delivery of gifts. Gifts are recommended to be rejected or avoided when their value is such that it may have an impact on a business decision. Gifts lacking any real commercial value may be permitted. (viii) Use of Corporate Assets - The personal use of corporate assets by employees should be governed by a code of ethics, addressing at least the use of the company’s premises, automobiles, intellectual property rights and copyrights (including brands and commercial names), computers, telephone lines, and internet (in particular, e-mail accounts and other media) connections. It is also advisable for the company to clearly indicate that a responsible and exclusively company-related use should be made of all its assets. (ix) Other Commonly Found Provisions – Certain codes of ethics also include references to the management of related party transactions (although these are often dealt with in greater detail in other policies of the company), staff conduct (such as non-use of drugs and alcohol), workplace safety, respect for work-life balance, relationships with suppliers, quality of financial information and whistleblowing. a.2) Procedures A code of ethics should be disseminated among and fully read by all company personnel, from Board members to junior employees. It should also be promptly presented and explained to all new employees. All company employees should be responsible for participating in the dissemination of the code of ethics and complying (and ensuring others comply) with the company’s internal ethical rules. Ongoing orientation and training are highly recommended so as to ensure a full understanding of the company’s ethical guidelines. As best practice, it is also suggested that a company’s code of ethics be publicly disclosed by the company in order for its stakeholders and the general public to be informed as to the ethical principles to which

ed so as to ensure a full understanding of the company’s ethical guidelines. As best practice, it is also suggested that a company’s code of ethics be publicly disclosed by the company in order for its stakeholders and the general public to be informed as to the ethical principles to which the company adheres. While a sensitive issue in some markets, some companies are actively distributing their Codes of Ethics among their major clients. Whistleblower mechanisms are a means to enforce ethical principles within the company. Personnel should be made aware that anyone is entitled to file a report on a potential violation to the code of ethics. Anonymity should be assured to complainants. It is recommended that the company informs its personnel on the specific sequence of steps for submitting a complaint, including the scope of information required to be contained in a complaint and the different investigation and decision-making mechanisms. Moreover, company personnel should be made fully aware of the resulting internal disciplinary actions (and external consequences, including resulting sanctions) derived from non-compliance with the provisions set out in its code of ethics. To ensure an objective handling of complaints on potential misconduct, an independent party could be engaged to receive complaints (via face-to-face meetings, written messages, e-mail or phone) and channel these to the relevant independent function within the company (the ethics officer or internal auditor) and/or the appropriate corporate body (the ethics and auditLATIN AMERICAN COMPANIES CIRCLE 4 committees) for it to investigate and adopt the respective resolution. The Board of Directors should be informed of potential violations to the ethical requirements of the company and, if warranted by the materiality of a specific case, the Board itself should adopt the relevant resolution. Furthermore the Board should be kept informed on a regular basis of complaints and the procedures being taken by the company to investigate and address such complaints. It is recommended that the nature of the facts and

the Board itself should adopt the relevant resolution. Furthermore the Board should be kept informed on a regular basis of complaints and the procedures being taken by the company to investigate and address such complaints. It is recommended that the nature of the facts and individuals involved in a specific complaint be kept confidential. Finally, to prevent a whistleblowing procedure from being abused (particularly from being employed as a retaliatory measure), company personnel should also be informed of the resulting disciplinary actions derived from the filing of false or misleading information. Anonymity of those filing complaints should be assured.

III. THE COMPLIANCE FUNCTION a) The Regulatory Environment Companies operating in different countries and industries will be subject to varying laws and regulations. Many Latin American jurisdictions do not require the establishment of a mandatory compliance function. However, and by way of example only, specific industry regulation

(such as in the financial sector) may provide for the mandatory appointment of a qualified compliance officer. When a specific compliance function is not required by law or regulation, the decision to develop a compliance department or function is left to the individual company. In the absence of such a requirement, it is still considered best practice for companies to establish a compliance function in order to enhance standards and mitigate risks. The consensus among questionnaire respondents is that a compliance function is generally recommended regardless of whether or not a regulatory requirement exists.

b) Responsibilities Compliance can be viewed as a means of risk assessment, communication, and control. It is understood that effective compliance programs will result in improved adherence to applicable laws, external and internal regulations, policies, codes of conduct, and rules, as well as mitigation of associated non-compliance risks. In Latin America, questionnaire respondents referred to compliance as a system of controls designed to align company practices with various types of regulation. Florida Ice & Farm Co. described two levels of compliance: the first in accordance with

tion of associated non-compliance risks. In Latin America, questionnaire respondents referred to compliance as a system of controls designed to align company practices with various types of regulation. Florida Ice & Farm Co. described two levels of compliance: the first in accordance with external rules imposed on organizations, and the second based on internal structures and processes imposed in order to achieve compliance with existing external laws, rules, and regulations. A well-developed compliance department is responsible for the identification of, and alignment with, external regulations and the management of associated risks. Additionally, a compliance program may seek to prevent regulatory breaches as well as assess its own performance. Consensus among questionnaire respondents is that the core responsibilities of a compliance function include identifying risks, detecting instances of regulatory violations, and implementing controls to prevent regulatory breaches. Grupo Argos refers to the tracking and evaluation of compliance processes and the promotion of ethical company practices. In Ferreycorp, ethical dilemmas are considered first by reference to the company’s code of ethics, and the values the code represents. Managers (and directors) will frequently also review cases of possible violation. Depending on the circumstances of the case, the Ethics Committee may elevate the issue to the Audit Committee or the Board of Directors. Ultrapar considers that a dedicated Conduct Committee, with independent Chairman can be a useful addition as this can allow the company to take a proactive rather than a reactive approach to how the company deals with ethics and conduct related issues.LATIN AMERICAN COMPANIES CIRCLE 5 c) Rationale There are several reasons that should motivate companies to establish a compliance program. Among them are improved reputation, more effective use of resources, and improved information flow and communication. The reputation and credibility associated with a sound compliance system generates trust and offers potential for stronger relationships with business partners. Through alignment with regulations, the compliance function will also offer a lens

program. Among them are improved reputation, more effective use of resources, and improved information flow and communication. The reputation and credibility associated with a sound compliance system generates trust and offers potential for stronger relationships with business partners. Through alignment with regulations, the compliance function will also offer a lens through which the company can learn more about itself and develop better communication practices both internally as well as externally. Algar is of the view that business success, sustainability and business integrity go together. The pursuit of excellence is connected to individual and collective commitment, with the highest level of ethics and adherence to laws, regulations and policies relevant to the company’s activities. In this context, Algar comments that the Board of Directors and senior management must be fully engaged and lead by example (as willingness to comply equates, to some degree, to governance). The culture and high principles of the business define the enabling environment for compliance. Risk management has been described as the central, justifying reason for a compliance function, especially for the purposes of supporting long-term performance and the future sustainability of the business. In particular, ISA explained that compliance is important for companies operating in multiple countries with differing regulations. Grupo Argos’ response touched upon elements of ethics, market trust, competitive advantage, reputation, public confidence, and managerial competence as being important outcomes of successful compliance practices. CPFL Energia commented that the expected benefits of the compliance activity include: (i) vision of the portfolio of processes in the value chain; (ii) strategic action through the monitoring process with a focus on the main risks of each business unit; (iii) appropriate allocation of effort and prioritization of actions; (iv) preventative management through risk indicators in the company’s various business units; (v) opportunity for identifying routine activities and for the centralization of certain such activities; and (vi) a single evaluation platform for all areas

cation of effort and prioritization of actions; (iv) preventative management through risk indicators in the company’s various business units; (v) opportunity for identifying routine activities and for the centralization of certain such activities; and (vi) a single evaluation platform for all areas of control (risk, compliance, audit and process quality assurance). In developing a compliance function, companies should consider which factors will lead to the desired results. Company size, industry, ownership structure, business operations, geographical location, and the legal and regulatory environment all influence what a best practice compliance function might look like. Each questionnaire respondent noted the importance of tailoring compliance practices according to these factors in order to develop the optimal and most relevant programs. Grupo Argos commented that a company’s financial situation should be taken into account in the development of a compliance program. Such considerations may impact a company’s appetite for risk and, therefore, influence the decision as to whether to implement certain controls in specific areas. Algar suggested considering whether or not the benefits of a compliance practice outweigh the implementation costs, and how such decisions might affect company image. Ferreycorp noted that a culture of leading-by-example, especially on the part of senior managers, plays a critical role in developing and ‘living’ a culture and value-system based on ethical values. The company also commented that communication both within the company, as well as to external stakeholders, through official company channels, plays an important role. d) Structure When seeking to define the structure of a compliance function, it is important to consider the broader corporate structure, in particular and by way of example, whether or not the company is a large conglomerate with many branches or subsidiaries. Another key question is whether or not to separate the compliance functionLATIN AMERICAN COMPANIES CIRCLE 6 from other departments. This would most likely depend on the applicable legal and regulatory

by way of example, whether or not the company is a large conglomerate with many branches or subsidiaries. Another key question is whether or not to separate the compliance functionLATIN AMERICAN COMPANIES CIRCLE 6 from other departments. This would most likely depend on the applicable legal and regulatory environment of the company as well as its own internal policies and procedures. A compliance officer1 is suggested to be appointed in complex companies, those presenting significant levels of risk, and companies with operations in regions deemed as risky or unstable. Most questionnaire respondents agree that it is a management decision to establish the organizational structure for a company and thus to determine whether a compliance officer should be appointed or not. However, it was also suggested that in the event that the Board believes there is a need to have a compliance officer appointed, it should instruct the company’s Chief Executive Officer accordingly. On a case-by-case basis, it should be evaluated whether a compliance officer should be appointed directly by the Board itself (as this would provide sufficient stature to this position within the company). If a nomination committee has been appointed to provide Board-level support, this committee should be responsible for identifying, interviewing and selecting a candidate and then making a recommendation to the Board. Since a compliance officer requires a full understanding of applicable laws and regulations, it is commonly suggested that the appointed person be a qualified lawyer. Given the academic and professional background of lawyers, this may make them more suitable than