A policy is only as good as the willingness of people to raise a problem, and the willingness of the company to hear it. This procedure sets out how.

---

[Company name]: Speak-Up and Investigation Procedure

1. Purpose

To give everyone who works for us, or with us, a safe way to raise a concern about bribery, corruption, hidden commissions or any breach of our policies, and to make sure every concern is taken seriously, investigated fairly and closed properly.

2. Who can raise a concern

Employees, directors, temporary staff, freelancers, agents, suppliers, customers and anyone else with a genuine concern. You do not need proof. You need a reasonable belief.

3. What to raise

A request or offer of a bribe or hidden benefit. Pressure to keep a commission secret. A payment that does not look right. A breach of the gifts or hospitality rules. A conflict of interest not declared. Retaliation against someone who raised a concern. Anything you think is contrary to the anti-bribery policy or the law.

4. How to raise it

Choose whichever route you are most comfortable with:

1. [Policy owner]: [contact].
2. A director: [name and contact].
3. An outside adviser: [name and contact], who will keep your identity confidential unless the law requires otherwise.
4. In writing, anonymously if you prefer, to [address or secure form]. Please give enough detail for us to act.
5. To an external body. You may always report to the relevant authority. Some countries give additional protection when you do. See the supplement for your country.

5. Our promises

• We will acknowledge your concern within [three] working days.
• We will treat it as confidential. We will tell only those who need to know, and never reveal your identity without your consent, unless the law requires it.
• We will not retaliate and will not allow retaliation. That includes dismissal, demotion, loss of work or orders, threats, harassment or less favourable treatment. Retaliation is a disciplinary offence.
• We will investigate fairly, promptly and proportionately.
• We will tell you what we can about the outcome, within the limits of confidentiality and the law.

6. Investigation

1. Triage (within five working days). The policy owner, or a director if the concern involves the policy owner, decides who will investigate, whether outside help is needed, and whether urgent steps are needed (for example, protecting records or stopping a payment).
2. Independence. The investigator must not be involved in the matter or report to anyone involved.
3. Evidence. Collect and secure documents, emails, payments and registers. Interview witnesses. Give the person concerned a fair chance to respond.
4. Record. Keep a written record of what was done and why.
5. Findings (target: within [30] days). The investigator reports to the directors with findings and recommendations.
6. Outcome. The directors decide: no case to answer, further training or controls, disciplinary action, termination of a contract, or a report to the authorities. The person who raised the concern is told the outcome as far as possible.
7. Review. What went wrong, and what do we change to make it less likely?

7. If a law may have been broken

The directors take legal advice, preserve evidence, and decide whether to report to the authorities. We cooperate fully with any official investigation. Nobody may destroy, alter or conceal evidence.

8. Records

We keep a confidential log of concerns, investigations and outcomes, with dates, for at least [seven] years, and review it once a year for patterns.

9. Local law

Where local law gives additional rights, channels or protections to people who report (for example, rules on internal reporting channels for companies above a certain size), we comply with them. The country supplements to our policy say what applies.

---

General information, not legal advice.