Siemens 2014 Annual Report Download - page 141

171 C. Combined Management Report 247 D. Consolidated Financial Statements 337 E. Additional Information

diligence process. The company’s compliance risk assessment
process has been further developed: Besides other improve-
ments Data Privacy has been included therein as part of our
activities to integrate Data Privacy into the Compliance System.
B.. Compliance risk management
Our Compliance Risk Assessment (CRA) process requires that
CEOs and managers in the Company – together with the
relevant Compliance Officers – systematically determine and
assess the compliance risks to their units on a regular basis.
A CRA was performed for all the Company’s operating units in
fiscal . Based on our experience to date and the analysis
of these results, the CRA process has been further developed.
Starting fiscal , the CRA is performed in two different ways:
> In even-numbered years, the CRA process is performed for
so-called top-risk countries in order to complement the anal-
yses at Lead Country / Division level with in-depth risk assess-
ments for selected countries. We will identify these countries
in advance based on an analysis of external and internal
compliance risks.
>
In odd-numbered years (starting in fiscal ), the CRA
process will be performed at Lead Country / Division level.
In fiscal , the CRA was performed for a total of  top-risk
countries. The CRA results have been incorporated into the
Group-level compliance risk analysis, which aims to determine
systematic and globally recurring compliance risks to the
Company as quickly as possible. As well as the CRA results, this
analysis of the overall Group-level compliance risks takes into
account, for example, the insights from compliance controls –
the ongoing assessment of the operation of our compliance
processes to ensure their effectiveness – and the results of
case-related investigations.
The Corporate compliance risks are derived from these consol-
idated results, which are then shared with the Company’s busi-
nesses. As in the CRA process, relevant risks are reported to
Siemens’ Enterprise Risk Management (ERM), and measures to
reduce the risks are drawn up and implemented.
The identification of compliance risks in individual Siemens
entities worldwide (CRA) and the Group-level compliance risk
analysis are complemented by an interdisciplinary exchange
during the quarterly Compliance Risk Radar meeting.
B.. Business partners and suppliers
Cooperation with third parties such as sales agents, customs
clearing agents, consultants, distributors and resellers is part
of Company operations and often essential in order to reach
certain areas of the market. At the same time, however, the
Company may be liable for the actions of these third parties.
Our mandatory process and tool for business-partner com-
pliance due diligence is designed to help all Siemens entities
conduct risk-based integrity checks of business partners.
Transparent and risk-oriented decisions about a business part-
ner relationship are based on high-quality compliance due
diligence.
The management of each Siemens unit is responsible for the
unit’s utilization of business partners. This means that busi-
ness partners must be carefully selected and appropriately
monitored and managed throughout the course of a business
relationship.
In fiscal , we carried out a project to reinforce the effective-
ness of our business-partner compliance due diligence process
and of management’s assessment of the related compliance
risks. Key outcomes of the project include the regular review of
business partner portfolios at the Lead Countries and Divisions
and on-site compliance checks for selected types of business
partners as part of due diligence. Both measures are scheduled
for implementation in fiscal . Furthermore we have
introduced a web-based compliance training program, which is
mandatory for certain business partners before they can enter
into a business relationship with our Company. Other business
partners may also take part in the training program on a volun-
tary basis.
We require our suppliers to comply with our Code of Conduct
for Siemens Suppliers, which includes compliance with all
applicable laws and, in particular, the prohibition of corrupt
activities. We also require our suppliers to support the Code’s
implementation in their own supply chains. The Code of
Conduct is based on the ten principles of the United Nations
Global Compact. Instruments such as sustainability self-assess-
ments by suppliers and sustainability audits by external audi-
tors enable us to systematically identify potential risks in our
supply chain and to monitor whether our suppliers are in com-
pliance with the Code’s requirements.