LawNet, Inc. Conference - August 2004

1. Corporate Compliance & Ethics Programs Leveraging Technology, Best Practices and Outcomes in Execution LawNet, Inc. Conference - August 2004

2. Today’s Outline • What isn’t eLearning (and what is) • Driving forces behind adoption • How it works • Execution issues and 10 case studies

3. GOOD vs. BAD

4. Why compliance/ethics programs? The 3 Driving Factors… • Improve behavior & work environment • Reduce risk/avoid liability • Align with Federal Sentencing Guidelines

5. Improving Behavior – Stats to Consider • 46% observe one or more specific types of misconduct • 44% don’t report misconduct due to belief: • (1) no corrective action will be taken; • (2) information not be confidential • 1 in 3 say employees show respect for fellow employees whose success is based on questionable ethics practices • Newer and younger employees 2x less likely to report misconduct… yet experience 2x greatest pressure to engage in misconduct Source: National Business Ethics Survey, 2003, Ethics Resource Center

6. ROI Benefits of an Effective Program Where effective program in place, employees more likely to: • Trust the actions of top management. • Have a higher level of job satisfaction overall (lower turnover, more productive) • Report misconduct; believe those who violate are held accountable • Feel less pressure to commit misconduct • Safeguard company brand and reputation • Focus on sustainable long term business performance contributions as opposed to looking for short-term gain • Weather transition (mergers/acquisitions/layoffs) more easily • National Business Ethics Survey, 2003, Ethics Resource Center

7. Reduced Risk/Avoided Liability • Compliance is expensive ($$$) • Electronic discovery, disruption, legal expenses • Litigation, settlements and claims are even more • PLI-Corpedia solutions recognized by insurance industry for risk reduction • Lower D&O, EPL, E&O rates • Consider a different LH outcome… • Some Numbers… • $20b spent by regulatory agencies • $850b spent by corporations to comply • $850b reduction in market cap due to scandals • $200b - $565b in white collar crime • $$$b in litigation / penalties / fees

8. “An organization shall exercise due diligence to prevent and detect criminal conduct and…” “Otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law. - US Sentencing Commission “When determining whether to charge a corporation criminally for the acts of employees, “prosecutors should determine whether the corporation’s employees are adequately informed about the compliance program and are convinced of the corporation’s commitment to it.” - Larry D. Thompson, Deputy Attorney General Federal Sentencing Guidelines New guidelines in effect as of Nov 1. 2004

9. Sentencing Guidelines Overview • Establish standards & procedures • Assign high-level authority • Not bestow authority to unethical executives • Communicate & educate • Monitor, audit & evaluate • Implement anonymous reporting systems • Apply consistent incentives & discipline • Respond, correct & modify

10. What do we have to do?

11. Types of Topics Covered 200+ Topics Include • Sarbanes-Oxley Code of Conduct • Financial Integrity & Assurance • Ethical Decision • Intellectual Property • Information Security • Harassment • Record Keeping & Destruction • Health & Safety • Anti-Money Laundering • Conflicts of Interest • Insider Trading • Gifts & Gratuities • Illegal Business Practices • Antitrust • OSHA • etc..

12. How does “an effective compliance program” appear to an organization? 99% Workforce Penetration Proof of Employee Comprehension Proof of Employee Comprehension

13. How does “an effective compliance program” appear to employees? Step 1: Open Registration Email Step 2: Access Training Menu Step 3: View CEO Introduction Step 4: Take Course

14. Legal concept-based Reinforcing story-based scenarios Customized to client organization Testing for comprehension Learning Methodology Compliance and ethics situations vary Teach the underlying concept FIRST… Use cases to reinforce Result: More effective decision making vs. imitative learning

15. Best Practices Q: Can we define the practices of leading corporations? A1: Process-based Practices: Open Compliance & Ethics Group (www.oceg.org) A2: Principle-based Practices: The 5:8 Principles

16. OCEG Nonprofit Initiative (www.oceg.org) Ernst & Young EthicsPoint Ethics Resource Center (ERC) Fleetwood Retail Frank B. Friedman and Associates Foley Hoag LLP General Dynamics General Electric General Electric Aircraft Engines Gilbert and Associates Governmental Insurance Exchange Goodwin Procter, LLP Grant Thornton Groupo Nuevo Gulf Insurance Harris, Wiltshire & Grannis, LLP Holland & Knight, LLP Honeywell Howrey, Simon LLP Institute of Business Ethics Institute of Internal Auditors (IIA) Intel ISS IRRC KPMG Akin Gump, Strauss Hauer and Feld LLP American Bar Association (ABA) American Corporate Counsel Association (ACCA) American Institute of CPAs (AICPA) American Insurance Group (AIG) American Society of Corporate Secretaries (ASCS) Arent Fox, LLP Blackboard Bridge Associates Bryan Cave, LLP CalPERS Corpedia Education Corporate Integrity Services Center for Applied Business Ethics Debevoise & Plimpton Dechert LLP Deloitte & Touche Deutche Bank doubleDrum Capital, LLC DuPont de Nemours Kaye Scholer, LLP Kraft Foods Latham & Watkins, LLP Lehman Bros. Littler Mendelson, LLP Louisiana Pacific Marsh, Inc. Mathews and Green, LLC McKenna Long & Aldridge, LLP Michelin North America Microsoft NCS Pearson New York City Pension Funds Orrick Herrington and Sutcliffe, LLP Practising Law Institute (PLI) Professional Liability Underwriting Society (PLUS) Pfizer Proskauer Rose, LLP PricewaterhouseCoopers Skadden, Arp LLP Swidler Berlin, LLP Walgreen Winstead Sechrest & Minick, LLP Zurich Financial Services 200+ individuals 100+ organizations since January 2003

17. The 5 Principles • Start with compliance and move to integrity • Effective programs are not built overnight • Model ethical behavior expectations • Living out the words • Test for impact and measure against peers • Focus on the frontline • Younger & newer employees are most vulnerable • Systems awareness is not the same as credibility • 44% don’t report misconduct due to lack of system credibility

18. The 8 Practices • Titled officer with board-level exposure • Make available & educate on multiple reporting channels • Distribute & test entire workforce on “Code” • Integrate to job and provide case study decision-support tools • Communicate CEO’s message & personal ethics experience • Survey for impact & benchmark a minimum of every 2 years • Internally visible reward & discipline as reasonable/feasible • Educate by core functional area within 30, 60, 120 DFH rule* * Days From Hire: 30 for “Code”; 60 for sales, finance & purchasing; 120 for general management

19. Case Study (1):Lockheed Martin & Norm Augustine • “Nobody will follow you if they can’t trust you… And when they see a leader that doesn’t cut corners, they say, ‘Oh, that’s the way it’s done around here.’ ” • “My advice would be that I think the only thing in the world more important than your health is your reputation” • Case Studies • Firing the “Dumpster Diver” • The Jack Welch Handshake Innovative Way to Instill Believability & “Tone from the Top”

20. No Computers. Uses kiosk system (Airline) Paper-based w/tests entered by managers into HRIS (Medical) No Regular Internet Access. Run locally, upload when email is accessed (Pharma Reps) No Email. Tracks training by employee ID# (Retail Chain) No Land. CD-ROM based with satellite uplink (Oil Rigs) Case Studies (2-6):Distributing & Testing on the Code “Will” creates “Way” – Innovative Internal and External Drivers

21. Case Study (7): Testing/Surveying for Feedback on the Code • Company:Major Energy Producer • Surveying Segment:Conflicts of Interest • Sample Quote: • “My brother works for MCI and they are our company’s telecom provider. Is there a problem?” You want this type of dialogue to take place

22. Case Study (8): Building Credibility to Report Channels • Company: Heavy Equipment Manufacturer • Original Reporting System: • Developed In-House • Specific Individual to Call • Revised Reporting System • Augmented by Externally-Based Online & Offline Versions • Invested in education –provided relevant case study how it works 44% of employees who witness misconduct but don’t report it 42% don’t believe corrective action will be taken

23. Case Study 9:Internally Visible Reward & Discipline • Case Study: High-Technology Company • Problem: Unauthorized Use of Resources; Violation of Company Policies • Action: Termination of 35 employees – announcement to the rest of the workforce Difficult yet possible to reward behavior without being condescending... but failing to publicize discipline may undermine system confidence

24. Case Study 10: 30, 60, 120 DFH Rule • Company: Consumer Products • Former Training: Ad Hoc & In-Person • Revised Training: 30, 60, 120 DFH via eLearning • Impact: • No systemic problems discovered; 50%+ expense reduction • Institutionalized repeatable system • Focused on the frontline risks Newer and younger employees 2x less likely to report misconduct… yet experience 2x greatest pressure to engage in misconduct

25. Other Outcomes Not everything is measurable… but good examples exist • Reduced Cost of Risk • Companies achieving 15-30% reduction in E&O, EPL and D&O insurance • Witnessed Misconduct Reduced by 75% Across Board • When senior managers demonstrate “illustrative behavior”*, misconduct witnessed drops to 15% from 56% * (1) Talk about importance; (2) Model behavior; (3) Inform employees; (4) Keep promises

26. Other Leading Practices Observed… • Planning Practices • CEO buy-in at outset • Temporary cross-functional teams with EVP-level “TieBreaker” • Design Practices • Invest in quality & customization - less expensive than you think • Instructional methodologies vary by type of workforce • Implementation Practices • Respect employees’ existing knowledge & time • Vendor Contracting • Demand disclosure of possible conflicts of interest • Get copies of the software code & records • Due diligence on financials & commitment to industry