1) Background and outline of contents
2) Who does this policy apply to?
3) Who can the whistleblower talk to?
4) What sort of concerns can be raised with the Compliance Department
5) How ‘big’ should the issue be before it is raised with the Compliance Department
6) What evidence is needed before the Compliance Department can investigate?
7) Can disclosures be made anonymously?
8) What happens after a disclosure is made?
9) What happens after a disclosure is made?
10) What happens to the whistleblower?
11) Protecting the identity of a whistleblower
12) Does it matter why a person contacts the Compliance Department
13) General reporting
14) Reporting non-compliance to persons outside ABAC Certification
15) Review of the whistleblowing program and this policy
16) Structure of Compliance Department

1) Background and outline of contents

ABAC Certification whistleblower program is an integral part of its compliance program. The program is intended to satisfy whistle-blower needs in all countries in which ABAC Certification operates.
ABAC Certification recognizes that an effective whistleblower program:
• Is a strong indicator that ABAC Certification is complying with its legal and ethical obligations;
• Enables individuals to feel that the company is properly addressing their concerns; and
• Does not penalize employees for fulfilling their obligation to ensure that ABAC Certification’s conduct meets its policies on compliance and ethics.
The policy covers, in general terms, the following:
1) Who does this policy apply to? (part 2)
2) Who can the whistleblower talk to and what sort of concerns can be raised? (parts 3 to 7)
3) The process after disclosure and the protection of the whistleblower (parts 8 and 9)
4) What happens to the whistleblower, protecting the identity of the whistleblower and reasons for whistleblowing (parts 10 to 12).
5) Reporting and review (parts 13 to 15).

2) Who does this policy apply to?

Three categories of people covered by the policy. ABAC Certification is committed to making this whistleblowing policy available for concerns affecting the company’s activities held by the following:
1) Employees and officers of the ABAC Certification, whether full-time, part-time or casual, at any level of seniority and wherever employed;
2) A person who has a contract to supply services or goods to the ABAC Certification; and
3) An employee of a person who has a contract to supply services or goods to the ABAC Certification.
Employees obliged to ensure all company conduct complies with law and company policy. Employees and officers are reminded that under the terms of their employment, they are obliged to ensure that they comply with the law and company policy.

3) Who can the whistleblower talk to?

Raise initial concerns with supervisor or usual contact officer. Employees of the ABAC Certification should initially (and promptly) discuss any concerns with their supervisors. In most cases, this should satisfactorily address the concern.
Other people should first raise concerns with their usual contact officer within the ABAC Certification.
• For clients, they can mail concerns to Compliance Department
• For contractors, it will usually be the ABAC Certification employee who manages the account.
If not satisfied with response to initial concern, contact Compliance Department.

Role of, and reporting by, Compliance Department

• Hear all disclosures falling within this policy;
• Investigate them under this policy; and
• Where necessary, obtain specialist, independent legal and financial advice for any investigation.

The Compliance Department

• Will generally report to the Company Management directly;
• May choose to refer a matter to a representative of ABAC Center of Excellence’s Audit and Compliance Committee or report to the Audit and Compliance Committee directly; and
• Is entitled to elect to report directly to the Managing Director or the Board about major allegations of non-compliance.

4) What sort of concerns can be raised with the Compliance Department?

• Conduct or practices which are illegal or breach any law, regulation or code of conduct applying to the ABAC Certification, or significantly breach any contract binding a member of the ABAC Certification;
• Fraudulent or corrupt practices (including offering or accepting bribes or otherwise gaining advantage from a relationship with the ABAC Certification to which the ABAC Certification has not agreed);
• Continuing or regular breaches of ABAC Center of Excellence Limited’s policies or other rules of conduct;
• Coercion, harassment or discrimination by, or affecting, any member of the ABAC Certification’s staff;
• Misleading or deceptive conduct of any kind;
• Situations within the ABAC Certification’s control that pose a danger to the health or safety of any person;
• Situations within the ABAC Certification’s control that are a significant danger to the environment; and
• ABAC Certification staff behavior that could reasonably suggest ABAC Certification’s practices are not being followed

5) How ‘big’ should the issue be before it is raised with the Compliance Department?

Compliance Department can informally advise about whether or not a matter falls under this policy.

ABAC Certification requires the Compliance Department to treat all disclosures with the utmost seriousness, even though they may cost substantial time and money to investigate and can damage the career and morale of people the subject of allegations. The individual should take this into account when deciding whether a matter is sufficiently serious to formally rise with the Compliance Department. One-off, minor infringements may be most constructively dealt with without formal investigations or action.

Matters already investigated cannot be raised with Compliance Department. If all the facts of a matter have already been investigated within another complaints mechanism of ABAC Certification (such as discrimination issues through an HR Department), then depending on the circumstances it may not be appropriate to raise the same matter with the Compliance Department.

Repeated misconduct should be raised with Compliance Department even if minor or long standing. If an individual becomes aware of continuing or repeated misconduct, however minor, the matter should be pursued through the appropriate channels: small matters, when repeated, can become bigger matters. A stakeholder should also contact the COMPLIANCE DEPARTMENT even though the stakeholder has been aware of parts, or indeed all, of the non-compliant conduct for some time.

6) What evidence is needed before the Compliance Department can investigate?

For employees of the ABAC Certification, their knowledge of the practices and situation of their department is generally enough to provide the Compliance Department with sufficient evidence to start an investigation.
For other individuals, to enable the Compliance Department to start an investigation, it is desirable to have some sort of documentary evidence of the concerns. At the very least, the individual needs to be able to tell the COMPLIANCE DEPARTMENT who he or she suspects is involved in the misconduct, when it occurred and who is affected.
The more evidence provided to the Compliance Department, the more effective their investigation is likely to be. However, the individual should not delay approaching the Compliance Department once he or she is reasonably satisfied that he or she has first-hand knowledge of facts within the scope of this policy.

7) Can disclosures be made anonymously?

Disclosure may be anonymous. However, to gain protection, the individual will need to give his or her name to the COMPLIANCE DEPARTMENTHowever, the disclosure of his or her name to the Compliance Department is made on a strictly confidential basis.

8) What happens after a disclosure is made?

Compliance Departmentinforms senior management and investigates disclosure. When the Compliance Department receives any disclosure, they will immediately inform the senior management and jointly proceed with an investigation of the accuracy of the disclosure and the extent of non-compliance.
On receiving a request to undertake any investigation, the Compliance Department must take all reasonable steps to ensure that investigations into disclosures are fair and unbiased. This means that:
• Any person affected by the investigation should have the opportunity to put their case and be aware of the allegations and evidence against them;
• The investigator will obtain specialist, independent advice on matters outside the knowledge or expertise of the investigator and all employees of ABAC Certification are required to assist the investigator to the maximum possible extent in carrying out investigations; and
• Investigations will be carried out as fast as reasonably practicable and with a degree of confidentiality consistent with the seriousness of the allegations.
The investigator will keep detailed records of all interviews conducted and all records reviewed which affect the outcome of the investigation. Report to Audit and Compliance Committee. At the end of the investigation, the investigator must submit a report to the Audit and Compliance Committee. This report:
• Summarizes the conduct of the investigation and the evidence collected;
• Draws conclusions about the extent of any non-compliance; and
• Recommends action to remedy the non-compliance to prevent recurrence
• Private disclosure to Audit and Compliance Committee.

9) What happens after a disclosure is made?

The investigation may damage the career prospects and reputation of people who are the subject of serious allegations. Therefore, it will generally be inappropriate for the investigator to make reports regarding progress of the investigation to anyone other than the Audit and Compliance Committee, sitting in private.
The investigator may choose to involve the person making the disclosures in the investigation, either by seeking more information or providing feedback to the individual. However, to ensure that the investigation is fair or to protect the person making the disclosures, the investigator may exclude the person making the disclosures from the investigation.

10) What happens to the whistleblower?

ABAC Certification acknowledges that there may be substantial personal costs to a person who makes serious disclosures outside the normal lines of management. ABAC Certification is committed to minimizing those costs for the benefit of the ABAC Certification as a whole.
Consequences of disclosure;
There are 4 consequences of disclosing.
• Protection from legal consequences i.e., a protection from civil or criminal liability for making the disclosure. However, there is no protection for any civil or criminal liability committed by the whistleblower.
• Protection from victimization (discussed below).
• Compensation to victim – if there is victimization and the victim suffers loss, the victim may recover compensation from the person inflicting the loss.
• Protection of identity – the Compliance Departmentmust treat the identity of the individual as confidential, but may give the information to Police or with the consent of the whistleblower, someone else.

Protection from victimization

ABAC Certification forbids any member of staff from penalizing any person who contacts the Compliance Departmentto make disclosures within the scope of this policy. This includes any reprimand, reprisal, change in work duties, change in employment amenities, change in reporting requirements, damage to career prospects or reputation, threats to do any of these or deliberate omissions which damage the person.

A person who makes material disclosures to the Compliance Departmentis entitled to request that ABAC Certification, through the Compliance Department:
• Grant the person leave of absence during the investigation;
• Be relocated to a position of equivalent pay and seniority at a different location or in a different department; and
• Provide independent professional counselling for the distress caused by the matters which led to the disclosures.
ABAC Certification will grant such requests wherever it is reasonably practicable to do so. ABAC Certification will also take any steps reasonably requested by the person to ensure that the person is not the subject of victimization or reprisals as a result of the contact with the Compliance Department

11) Protecting the identity of a whistleblower

Confidentiality of identity: One of the key ways to protect someone making disclosures to the Compliance Departmentfrom reprisals or victimization is to keep their identity confidential. The Compliance Department is required to do everything reasonably possible to ensure that the identity of any person who has made disclosures to them is kept secret during the course of any investigation and until the outcome is made public.
Action taken if there is a risk of disclosure of identity
While ABAC Certification is committed to protecting the identity of people who contact the Compliance Departmentwherever possible, there will be rare occasions when this is not possible, for example:
• Where the investigation leads to charges being made in court;
• Where the nature of the allegations is such that the identity of the person can be deduced from the information made available to the Compliance Department; or
• Where the person is given special treatment such as leave of absence.
As soon as possible after the first contact by a person, the Compliance Departmentwill discuss the issue of confidentiality with the person and the degree of risk that their identity will become known. The Compliance Departmentwill advise the person promptly if matters change in a way that affects ABAC Certification’s ability to protect the person’s identity and will give the person as much warning as reasonably possible if it appears likely to the Compliance Department that the person’s identity will become known.

12) Does it matter why a person contacts the Compliance Department?

People can be motivated to make disclosures about non-confirmation affecting ABAC Certification for many reasons, some less admirable than others. To gain protection, the disclosure must be made in ‘good faith’. This means that the individual must make the disclosure with a genuine belief in this truth.
Where the reason for disclosure is less admirable and the purpose of the disclosure is to:
• Harm another person, or
• Avoid an issue arising from performance reviews in the normal course of business, or
• Abuse the whistleblowing policy,
The Compliance Department is entitled to discuss the person’s conduct with the HR Department for disciplinary action and otherwise limit the rights available to the whistleblower. These rights will be limited where it is necessary to protect another person, or persons, who has, or have, been a victim, or victims of the whistleblowers conduct or otherwise ensure that any improper purposes of the whistleblower are not met.
The Compliance Department’s duty to ensure a fair investigation overrides the obligation to protect the identity of the person who made disclosures.

13) General reporting

At least annually, a report is made to the ABAC Certification management summarizing the whistleblowing activities for the period. This report may be used to make general proposals to improve the compliance culture of ABAC Certification.
The management may publish a summary of ABAC Certification’s whistleblowing policy and its consequences in ABAC Certification’s annual report.

14) Reporting non-compliance to persons outside ABAC Certification

ABAC Certification aims to ensure that staff does not feel the need to discuss ABAC Certification concerns outside the group. Staff is reminded of their duty to keep confidential company information secret.
If circumstances compel an individual to consider making disclosures of non-compliance outside the Group, ABAC Certification encourages the individual to reconsider whether someone in the Group can help and recommends that, as a last resort, individuals take the matter to the police or other appropriate authority. The individual must not take the matter to the media.

15) Review of the whistleblowing program and this policy

The whistleblowing program (including this policy) is reviewed at least every 2 years by the Audit and Compliance Committee in consultation with the Compliance Departmentand the Managing Director. A report summarizing this review and proposing recommendations is made to the management. The review must address generally the efficacy of the whistleblowing program, in particular:
• The fairness of investigations undertaken;
• The actual consequences of making disclosures;
• The performance of the Compliance Department; and
• Compliance with this policy.
This policy will be available on ABAC Certification’s internet and intranet sites and a written copy will be available on request from the Company.

16) Structure of Compliance Department

Huma Khalid
Scheme Manager ABAC/ Sr. Compliance Officer
Huma.k@abacgroup.com

Signed,

KANWAL ZAFAR

Managing Director ABAC Center of Excellence Limited

CRI-POL-009, Rev. 1.0, Date 04-10-2018