PwC

1. Whistleblowing in the Private Sector 12 November 2008 Lee Coles PwC

2. Agenda Overview of the purpose and benefits Where does this come from? - Legislation Key aspects which are consistent across legislation Public Sector/Private Sector What is the situation in the Czech Republic? Data protection issues Means by which was fraud originally detected Selected control measures instituted Real life examples of learning points Suggested best practice

3. Whistleblowing in the Private Sector • Overview of the purpose and benefits • A mechanism by which an allegation or suspicion of potential wrongdoing or misconduct can be communicated; • A tool to aid transparency, corporate governance and to encourage proper behaviour; • Give stakeholders, both internal and potentially external, an opportunity to voice concerns; • Provide additional opportunities to uncover wrong doing, not limited to external/internal audit.

4. 2) Where does this come from? - Legislation Australia: Public Interest Disclosure Act, 1994 Aiimed at public sector employees China: Article 41 of the Chinese Constitution Whistleblower protection as a constitutional right for all citizens. It empowers all citizens to report misconduct and forbids retaliation. European Union: Whistleblowers’ Charter, 1999 The Charter establishes the Anti-Fraud Office in the European Commission (EU). It also creates procedures that require EU employees to report misconduct and guarantees due process and protection of the whistleblower if they report misconduct internally. Employees must exercise all internal avenues for reporting misconduct before they can blow the whistle externally and qualify for protection. United Kingdom: Public Interest Disclosure Act, 1998 The Act protects employees in all sectors from dismissal and other forms of retaliation. In a case where a whistleblower receives notice of termination, the burden of proof falls on the employer to show that the dismissal was unrelated to whistleblowing. United States of America: Whistleblower Protection Act, 1998Public sector employees receive protection from retaliation when disclosing information. The Patriot Act of 2001 infringes on some of these protections in cases of national security. United States of America: Sarbanes-Oxley Act, 2002Section 301 (“Public Company Audit Committees”) of Title III of the Sarbanes-Oxley Act of 2002 expands the area, including establishing the following whistleblowers in the private sector. establishing procedures for (a) the receipt, retention and treatment of complaints received by the issuer regarding accounting, internal accounting controls or auditing matters, and (b) the confidential, anonymous submission by employees of the issuer of concerns regarding questionable accounting or auditing matters. Whistleblowing in the Private Sector

5. Whistleblowing in the Private Sector • 3) Key aspects which are consistent across legislation • Filter point – a Qualifying disclosure not a malicious complaint; • Protection of whistleblowers/Anonymity considerations; - Time and calendar considerations/restrictions; • Correct process in place and followed.

6. Whistleblowing in the Private Sector • 4) Public Sector/Private Sector • Traditionally Public Sector rather than Private linked to whistleblowing by legislation; • Most recent legislation/best practice does not differ across sectors; • Changed after Sarbanes Oxley 2002.

7. Whistleblowing in the Private Sector • 5) Current Situation in the Czech Republic • Implementation of the employees protection into the labour law – new Labour Code (Act No. 262/2006 Coll.) form 2006 – but no special protection is included; • Czechs are not obliged to report foreign bribery to competent authorities - Section 168 of the Criminal Code requires all individuals to report certain crimes (the list does not include domestic or foreign corruption; • New draft law is being prepared – replacing Public Service Act (Act No. 218/2002, actually never in force) and the Act on Officials of Local Self-Government Units (Act No. 312/2002 Coll.) – it will include provisions on reporting suspicions of corruption and the protection of whistleblowers; • In 2006, TI reported that “whistleblower protection need to be substantially improved in …Czech Republic, Denmark, Germany, Italy, the Netherlands, Norway, Poland, Spain, Sweden and Switzerland”; • Studies, reports and feedback have suggested that whistleblowing is considered to be undesirable in Czech culture (occurs very rarely); • 2007 - GRECO urges Czech authorities to speed up their effort to provide the whistleblower protection.

8. Whistleblowing in the Private Sector • 6) Data Protection issues • Judgements in France, Germany and Belgium – 2005 verdicts set precedent that whistleblowing procedures were illegal, mainly due to data protection issues; • Recommendations of the EC Article 29 Working Party, Working paper 117.

9. Whistleblowing in the Private Sector 7) Means by which fraud was originally detected Source:PwC Global Economy Crime Survey

10. Whistleblowing in the Private Sector 8) Selected control measures instituted Source:PwC Global Economy Crime Survey

11. Whistleblowing in the Private Sector 8) Selected control measures instituted(cont’d) Only 2.5% of Czech companies surveyed did not implementany measures for detection and prevention of fraud …and Czech companies have 7 control measures in place on average … and the number of companies that implemented a whistle-blowing system has doubled (22% in 2005 vs. 44% in 2007).

12. Whistleblowing in the Private Sector • 9) Real life examples of learning points • Lack of protection for employees – disciplinary action, tribunals; • Lack of proper investigation – timing, expertise etc; • Little consideration for languages or suitability of the system; • Little communication or support training; • No evidence of support from Senior personnel (“tone from the top”); • Inconsistent approach – which can lead to accusations of favouritism.

13. Whistleblowing in the Private Sector • 10) Suggested best practice • Detailed planning of the process in advance, link to code of conduct, appropriate data protection; • Documented, consistent approach clearly outlining responsibilities and actions; • Consideration of the appropriate form of communication for the system; • Link into internal audit, audit committees, HR, external audit or other stakeholders; • Appropriate training and communication to staff; • Performance monitoring; • Anonymity considerations; • Expect the worst and be prepared by devising a robust fraud response plan.

14. © 2008 PricewaterhouseCoopers. All rights reserved. “PricewaterhouseCoopers” refers to the network of member firms of PricewaterhouseCoopers International Limited, each of which is a separate and independent legal entity. *connectedthinking is a trademark of PricewaterhouseCoopers LLP (US). PwC Contact Lee Coles Senior Manager +420 251 151 288 lee.coles@cz.pwc.com www.pwc.com/crimesurvey