Grievance and investigations

Our SpeakUp! grievance mechanism offers employees, business partners and members of the general public a confidential environment in which they can raise concerns relating to compliance with our Code of Conduct. We offer anonymous reporting and apply strict principles of confidentiality and non-retaliation. As an example of our non-retaliation principle, in 2018, a manager was dismissed for inappropriate behavior towards one of his employees after she had filed a SpeakUp! report against him.

SpeakUp! reports are investigated on their merits, in accordance with investigation procedures that are available to everyone on our internal and external websites. The investigations are conducted or managed by dedicated resources supervised by the Head of Investigations.

Reports are categorized into: Category 1 (matters with a potential financial impact of >€0.5 million, or involving senior management or relating to competition law, export control or anti-bribery); and Category 2 (other matters). Category 1 SpeakUp! reports are decided by the Corporate Compliance Committee. Category 2 reports are decided by the business or function’s Risk, Compliance and Control Committee.

In 2018, we developed a comprehensive investigation protocol and reporting templates to further improve the quality, efficiency and consistency of investigations. In 2018, 104 SpeakUp! reports were received, 21 of which were Category 1 and 83 were Category 2. In total, 14 of the 104 SpeakUp! reports were substantiated, leading to five dismissals.

Potential Code of Conduct violations that are reported to the Compliance function, other than through the formal SpeakUp! channels, are also logged in the company’s Code of Conduct violation report database and follow a similar investigation procedure. In 2018, 134 of these so-called non-SpeakUp! reports were logged and investigated.

Alongside the SpeakUp! grievance mechanism, we have a data breach reporting procedure. This procedure facilitates the reporting, assessment and follow-up of potential breaches of personal data. In 2018, we received 19 personal data breach reports. While relatively small in scale and without direct material impact to individuals, three reports were of such a nature that the authorities had to be notified. In relation to another report, a service provider had caused a breach and notified the authorities. In all instances, repair actions were taken immediately.