Figure 7.1 COSO ERM Framework

1. Figure 7.1COSO ERM Framework Source: Enterprise Risk Management – Integrated Framework: Executive Summary, Committee of Sponsoring Organizations of the Treadway Commission, September 2004, p. 5

2. TABLE 7.1 IDENTIFICATION OF BUSINESS RISKS

3. FIGURE 7.2 ETHICS RISK & OPPORTUNITY IDENTIFICATION & ASSESSMENT (ERISA) PHASE 3 Reports by • Stakeholder group • Product or service • Corporate objective • Hypernorm value • Reputation driver PHASE 2 Compare activities to expectations to identify ethics risks and opportunities PHASE 1 Develop a projected, ranked understanding of stakeholder interests/expectations Reputation Driver: Trustworthiness, credibility, reliability, responsibility Identify Confirmation Hypernorm: Honesty, fairness, compassion, integrity, predictability, responsibility Rank: Urgency, power, legitimacy Dynamic analysis Performance: Inputs, outputs, quality

4. TABLE 7.2ETHICS RISKS Ethics Risks exist when the ethical expectations of stakeholders are not met: • Resulting in loss of reputation and stakeholder support. • Preventing full and/or efficient achievement of strategic objectives. Important Ethics Risks: • Organizational culture risks exist when an organization’s culture fails to provide sufficient support and guidance to ensure a culture of integrity. • Mindset risks exist when decision makers, employees, and agents are: • improperly motivated, or • use ethically unsound rationales for their decisions. • Systemic risks often originate outside an organization and affect an entire system of activity.

5. Figure 7.3Fraud Triangle Motive Greed, Ego, Status, etc. Usual Focus of Risk Management 7 Basic Rationales Opportunity Rationalization D.L. Crumbley et al, 2005, p. 3-131 – comments in yellow added Prof. Len Brooks, Rotman School of Management, University of Toronto, September 2011

6. Table 7.3Seven Common Rationalizations of Immoral Decisions • Denial of responsibility • Denial of injury • Denial of the victim • Condemnation of the condemners • Appeal to higher loyalties • Everyone else is doing it • Entitlement Red Flags "Business Ethics and Moral Motivation: A Criminological Perspective", Joseph Heath, Journal of Business Ethics, (2008), 83:595-614 Prof. Len Brooks, Rotman School of Management, University of Toronto, September 2011

7. FIGURE 7.4 DIAGNOSTIC TYPOLOGY OF ORGANIZATIONAL STAKEHOLDERS STAKEHOLDER’S POTENTIAL FOR THREAT High Low Type 4 Mixed Blessing Type 1 Supportive High Strategy Collaborate Strategy Involve STAKEHOLDER’S POTENTIAL FOR COOPERATION Type3 Nonsupportive Type 2 Marginal Low Strategy Defend Strategy Monitor SOURCE: G. Savage et al, “Strategies for assessing and managing organizational shareholders”, The Executive, Vol. 5, no. 2, May 1991, 65.

8. Sustainability Ethics - Corporate Social Responsibility/Sustainability 2015 TABLE 7.4GRI G4 DISCLOSURES See https://www.globalreporting.org/resourcelibrary/GRIG4-Part1-Reporting-Principles-and-Standard-Disclosures.pdf GENERAL STANDARD DISCLOSURES SPECIFIC STANDARD DISCLOSURES Management Approach Indicators Economic Environmental Social Labor Practices & Decent Work Human Rights Society Product Responsibility Strategy & Analysis Organizational Profile Material Aspects & Boundaries Stakeholder Engagement Report Profile Governance Ethics & Integrity

9. Figure 7.5GRI G4 Decision Process Choose Core or Comprehensive Option Choose Reporting Principles General Standard (Background) Disclosures Specific Standard Disclosures

10. Sustainability Ethics - Corporate Social Responsibility/Sustainability 2015 TABLE 7.6GRI G4 Boundary & Quality Decisions See https://www.globalreporting.org/resourcelibrary/GRIG4-Part1-Reporting-Principles-and-Standard-Disclosures.pdf PRINCIPLES FOR DEFINING Report Quality Balance Comparability Accuracy Timeliness Clarity Reliability Report Content Stakeholder Inclusiveness Sustainability Context Materiality Completeness

11. Sustainability Ethics - Corporate Social Responsibility/Sustainability 2015 TABLE 7.7GRI G4 TABLE 5: CATEGORIES & ASPECTS IN THE GUIDELINES See https://www.globalreporting.org/resourcelibrary/GRIG4-Part1-Reporting-Principles-and-Standard-Disclosures.pdf Paste in Table 5 from p. 44

12. TABLE 7.8UN Global Compact’s ten principles Human Rights • Businesses should support and respect the protection of internationally proclaimed human rights; and • Make sure that they are not complicit in human rights abuses. Labour • Businesses should uphold the freedom of association and the effective recognition of the right to collective bargaining; • The elimination of all forms of forced and compulsory labour; • The effective abolition of child labour; and • The elimination of discrimination in respect of employment and occupation. Environment7. Businesses should support a precautionary approach to environmental challenges; 8. Undertake initiatives to promote greater environmental responsibility; and 9. Encourage the development and diffusion of environmentally friendly technologies. Anti-Corruption10. Businesses should work against corruption in all its forms, including extortion and bribery. Source: https://www.unglobalcompact.org/what-is-gc/mission/principles

13. Clause/Topic 1. Scope 2. Terms, definitions 3. Understanding Social Responsibility 4. Principles of Social Responsibility Accountability Transparency Ethical behaviour Respect for: Stakeholder interests The rule of law International norms of behavior Human rights 5. Fundamental Practices of Social Responsibility Recognizing Social Responsibility Stakeholder identification & engagement Clause/Topic 6. Social Responsibility Core Subjects Organizational governance Human rights Labour practices Environment – rationale, core issues Fair operating practices Consumer issues Community involvement & development 7. Integrating Social Responsibility (SR) throughout an organization Understanding organization’s SR Voluntary initiatives for SR Enhancing credibility re SR Reviewing & improving actions & practices re SR Communication on SR Relationship of organization’s characteristics to SR TABLE 7.9ISO 26000 Guidance on Social Responsibility - Overview Source: ISO 26000 Guidance on Social Responsibility, First Edition 2010-11-01, Figure 1,www.iso.org

14. Figure 7.6Schematic Overview of ISO 26000: Guidance on social responsibility

15. TABLE 7.10Techniques for the Measurement of Ethical Processes & Performance Written objectives Existence - broad, specific by function Content – comprehensive set of values, clarity of coverage, relevance Date of most recent revision Annual sign off – yes/no, minimal, involving reporting responsibility Guidance given to directors, management, employees Process - training sessions, workshops, and employees Consultation with ombudsperson, others Comprehensiveness of coverage (e.g., new employees) Frequency, currency – board review, dissemination Understanding of issues Rating developed by persons responsible for ethics program for each level of employee Tests are available (e.g., defining issues, stage of moral reasoning) Inclusion of ethical concerns Evaluation by management in decision making In “the development of plans, setting of goals, search of opportunities, allocation of resources, gathering and communication of information, measurement of performance, and promotion and advancement of personnel” Frequency of coverage as agenda item Commitment by all levels to the organization's ethical values Rating by ombudsperson Reports of ethical problems - fraud, customer and employee complaints Visible encouragement by top management Achievement of ethical objectives Combination of - existence, stage of completion of plans, number of events, dollars spent, numbers experienced Monitoring and continuous improvement Identification of person(s) responsible Adequacy of resources allocated Periodic reports to senior management and Board Evident action based on feedback Effectiveness of reporting Existence - internal, external Impact analysis on employees and external stakeholders Effectiveness analysis by researchers Favourable/unfavourable mentions in the media

16. TABLE 7.11AA1000 Accountability Assurance Standard Summary Purpose, Sustainability Reporting and Assurance: • The AA1000 Assurance Standard is a generally applicable standard for assessing, attesting to, and strengthening the credibility and quality of a reporting organizations’ sustainability reporting, and its underlying processes, systems and competencies. It provides guidance on key elements of the assurance process (is a standard guiding the audit of sustainability reporting). • The AA1000 Assurance Standard is primarily intended for use by assurance providers in guiding the manner in which their assurance assignments are designed and implemented. • Assurance should provide confidence in the report’s underlying information to the reporting organization’s stakeholders, particularly the direct users of the report. Assurance of sustainability reporting prepared in accordance with generally accepted standards: • The AA1000 Assurance Standard supports assurance (whether made public or not) of reporting that adheres to specific standards and guidelines, and is customised by the reporting organisation. It is specifically designed to be consistent with, and to enhance, the Global Reporting Initiative Sustainability Reporting Guidelines, as well as other related standards. Commitment by reporting organizations: • Reporting organizations commit to (1) identify and understand their environment, (2) respond to their stakeholders’ aspirations, and (3) provide an account to their stakeholders regarding the organization’s decisions, actions and impacts. Assurance principles: • Materiality: the assurance provider must evaluate if the report contain all the important information about the reporting organization’s sustainability performance required by the organization’s stakeholders for making informed judgements, decisions and actions. • Completeness: the assurance provider must evaluate the extent to which the reporting organization has not omitted any material aspects of its performance. • Responsiveness: the assurance provider must evaluate whether the reporting organization has responded to stakeholders’ concerns, policies, and relevant standards; and adequately communicated these responses in the report. Evidence (supporting the reported figures and disclosures): • The assurance provider must evaluate whether the reporting organization has provided adequate evidence to support the information contained in the report. Assurance statement (i.e. auditor’s opinion): • The assurance statement should address the credibility of the report and the underlying systems, processes, and competencies that deliver the relevant information, and underpin the reporting organization’s performance. • Elements of the assurance statement (i.e. auditor’s report):statement on use of AA1000;description of work performed; conclusion on the quality of the report and; underlying organizational processes, systems, and competencies;Additionalcomments if necessary Assurance provider standards (i.e. auditor’s independence and competencies): • The credibility of a report’s assurance relies on the assurance provider’s competencies, independence, and impartiality. • The assurance provider should be independent of the reporting organization and impartial with respect to the organisation’s stakeholders. Any interests that detract from this independence and impartiality need to be transparently declared by the assurance provider. • The assurance provider must be impartial in its dealings with the reporting organization’s stakeholders. • Assurance providers and the reporting organization must ensure that the individuals involved in any specific assurance process are demonstrably competent. • The organisations through which individuals provide assurance must be able to demonstrate adequate institutional competencies. * For a full version of the AA1000 Assurance Standard, 2008, is downloadable from http://www.accountability.org/images/content/0/5/056/AA1000AS%202008.pdf

17. TABLE 7.12 Employee Rights Themes In North America

18. FIGURE 7.7 MASLOW’S HIERARCHY OF NEEDS Self-actualization, Fulfillment Ego Esteem, Respect Love, Affinity Social Safety Physical Physiological

19. TABLE 7.13 HEATH’S SEVEN RATIONALIZATIONS OF UNETHICAL ACTIONS • Denial of responsibility. • Denial of injury. • Denial of the victim. • Condemnation of the condemners. • Appeal to higher loyalties. • Everyone else is doing it. • Entitlement. Source: “7 Neutralization/Rationalization Techniques”, a speech by Joseph Heath at the Centre for Ethics at the University of Toronto, April 9, 2007, later published as “Business Ethics and Moral Motivation: A Criminological Perspective,” Journal of Business Ethics, 83 (2008): 595-614.

20. Figure 7.8Anti-bribery Developments: 1975-2016 Scandal, New Legislation or Development Lockheed Bribery Scandal Foreign Corrupt Practices Act (U.S.) [FCPA] – bribes, facilitating payments, fines Transparency International Founded [TI] – corruption ratings, www.transparency .com OECD Anti-bribery Convention Corruption of Foreign Officials Act (Canada) [CFPOA] United Nations Convention Against Corruption Siemen’s Bribery settled for $1.6 billion to U.S. & German governments Bribery Act (U.K.) &Daimler Bribery Scandal (U.S. FCPA/German Co.) Niko Resources (Canada’s first significant case) To 1976 1977 1993 1997-9 1999 2003 2008 2010 2011 Unfettered U.S. only Other countries join U.S. first prosecution for extra-territorial actions Focus on bribing foreign officials only U.K. goes after bribes to foreign officials , & to business as well as non for-profit people, & facilitates extra-territorial reach Focus of Regulation

21. Table 7.14 Comparison of U.S. FCPA and U.K. Bribery ActSource: http://www.transparency-usa.org/documents/FCPAvsBriberyAct.pdf Reprinted with permission from Transparency International – USA. See text in insert

22. FIGURE 7.9 PHASES OF A CRISIS Unanticipated Crisis Anticipated Crisis CostTo Organization ContinuingReputationalImpact Post-CrisisState Reached ControlBegins Time Controlled Phases Pre-crisis ReputationRestoration Uncontrolled

23. TABLE 7.15 HOW TO INCORPORATE ETHICS INTO CRISIS MANAGEMENT