DM. Management System

Code 7.0

Participants shall adopt or establish a management system with a scope that is related to the content of this Code. The management system shall be designed to ensure: (a) compliance with applicable laws, regulations and customer requirements related to the Participant's operations and products; (b) conformance with this Code; and (c) identification and mitigation of operational risks related to this Code. It shall also facilitate continual improvement.

At RBA Code of Conduct 7.0, this is a single generic management system (Appendix Section E, Management Accountability through Documentation and Records). It is assessed across each component — A) Labor, B) Health & Safety, C) Environment and D) Ethics. The text below presents the requirements as they apply to the Ethics component. (At VAP 7.1.2 this generic system was split into discipline-specific systems; the ethics-scoped requirements became the D.M Ethics Management System criterion.)

NOTE: If a component has a valid third-party certification, that is considered conformance for that component (e.g. a valid ISO 14001 certificate satisfies the Environmental Management System). Conformance-section training and communications must always be completed even where a valid systems certificate is available.

Elements to Demonstrate Compliance to RBA Code

1. Policy

A management system, endorsed by senior management, is established with a scope related to the content of the RBA Code as it applies to ethics, designed to ensure compliance with applicable laws, regulations and customer requirements, conformance with the Code, and identification and mitigation of operational risks, and to facilitate continual improvement. The system includes:

• a. Management Accountability and Responsibility (E2). A senior representative is assigned responsibility and authority for implementing the programs needed to ensure compliance with laws and regulations and the requirements of the RBA, and to implement programs, procedures and corrective actions as needed for regulatory compliance and RBA conformance.
• b. Ethics policies aligned with law, the RBA Code of Conduct and facility policy statements, covering at minimum: upholding the highest standards of integrity in all business interactions; no improper advantage (bribery, corruption, extortion, embezzlement); intellectual property protection; fair business, advertising and competition; non-retaliation and protection of identity; and protection against unauthorized disclosure of personal information.

2. Procedures & Practices

Procedures & Practices are in place such that:

• a. Legal and Customer Requirements (E3). An adequate and effective quarterly compliance process maintains a current understanding of applicable legal and customer requirements pertaining to ethics, that can: identify, track, assess, integrate, implement, and record.
• b. Risk Assessment and Risk Management (E4). An adequate and effective risk assessment process (using the hierarchy of controls or equivalent) identifies the most significant ethics risks, including applicable legal and customer requirements. The risk assessment is updated when there is a Significant Change; any identified risk has an action plan, procedural controls and/or improvement objective; and the effectiveness of controls is evaluated on a regular basis. For ethics, the risk assessment considers business circumstances (country/region of operations, stakeholders, …) and covers at minimum honesty, integrity, intellectual property protection, bribery, corruption, fraud/embezzlement, extortion, legal, ethical, fair business/marketing practices, reporting violations, whistleblower protection, kickbacks, bribes, privacy and unlawful payments.
• c. Improvement Objectives (E5). An adequate and effective annual performance management process sets formal, communicated indicators, objectives and targets for ethics; develops and implements improvement plans; regularly reviews progress; and makes appropriate adjustments, including additional action plans where an indicator, objective or target is off track. Scope considers risk-assessment results, legal and regulatory requirements and company standards, with owners, implementation plans, completion dates and communication of objectives to workers as appropriate, clearly designed to achieve continual improvement.
• d. Training (E6). An adequate and effective training process is established for all managers/workers covering ethics policies, procedures, job-related aspects and performance targets, including a new-employee orientation plan, training-needs analysis, training plan, materials, records, frequency and effectiveness verification. The minimum ethics training topics are: upholding the highest standards of integrity in all business interactions; obtaining undue or improper advantage being promised, offered, authorized, given or accepted; intellectual property protection; fair business, advertising and competition; non-retaliation or protection of identity; and unauthorized disclosure of personal information. Training programs are evaluated on a regular basis not exceeding 3 years or sooner if there is a Significant Change.
• e. Communication (E7). An adequate and effective worker/manager, Supplier and customer communication/reporting process for ethics policies, practices and performance is established, covering correspondence to Supplier management and contract terms requiring Suppliers to conform to the RBA Code, communication of ethics practices and performance to customers, and the minimum communication topics to workers/managers. Communication programs are evaluated on a regular basis not exceeding 3 years or sooner if there is a Significant Change.
  • i. Submitting the SAQ to customers does not qualify as disclosure/communication to customers.
• f. Worker Feedback, Participation and Grievance (E8).
  • i. An adequate and effective grievance/complaint process allows work-related and Code-related grievances to be confidentially communicated without fear of reprisal or intimidation, internal (workers and staff) and external (workers of suppliers, local community or interested actors and Whistleblowers). Grievances are promptly investigated and prompt remedial action is taken where valid; the identity of all who file is protected, with a no-reprisal approach. Grievance and complaint channels are clearly communicated, in workers' native language(s) and visible.
  • ii. An adequate and effective process solicits and encourages worker participation, input and feedback for improvement (worker surveys, suggestion boxes, focus groups, joint worker-management committees, worker/union representatives, process-improvement teams). Input/feedback is promptly evaluated and acted upon where valid. Feedback channels are clearly communicated and visible.
• g. Audits and Assessments (E9). An adequate and effective self-audit process periodically assesses conformance with applicable regulatory requirements, RBA Code requirements, the facility's own policies, standards and management system, and other requirements to which the facility subscribes. Audit findings are reviewed by senior management. Audit scope covers all areas of the facility, all processes, physical conditions and work practices, review of documents and records, and interviews with individuals responsible for social and environmental responsibility.
• h. Corrective Action Process (E10). An adequate and effective corrective action process rectifies and closes non-conformances, including corrective action reports/plans and tracking tables (root-cause analysis, specific corrective actions, owners, due dates), additional actions when a corrective action is off track, a demonstrated link between the CAP and performance-management objectives and targets, and closure of action items confirmed by a management representative after verification by the appropriate person.
• i. Management Review and Continuous Improvement (E2.2). An adequate and effective annual management-system review and continuous-improvement process for ethics performance and management systems is established.

3. Controls & Monitoring

Controls & Monitoring should include:

• a. Responsibilities and authority of each organizational level are documented in position plans, job descriptions and/or the facility's management system documentation, for normal situations and for emergency situations.
• b. Conformance to the management system is regularly monitored, including management review of the status of the management systems on a regular basis.
• c. Appropriate investigation process when there is an alleged ethics violation, including misrepresentation by workers, managers and their agents, and appropriate sanctions and a preventive action plan when a violation is confirmed.
• d. Cascade of the RBA Code requirements to Suppliers with monitoring of Supplier compliance.

4. Records

Records are maintained including:

• a. Documentation and Records (E11). An adequate and effective documentation and records process with appropriate retention (on and off site) and appropriate levels of access to ensure privacy, conforming to regulatory (including record-retention) requirements. A listing/table of documents and records retained is available for review.
• b. Compliance register and a compliance calendar/reminders; summaries of applicable laws, regulations and key customer requirements; and new/changed operations/policies/procedures resulting from the review process.
• c. Risk assessment reports and corrective/preventive action plans for identified risks.
• d. Formal target, indicator and objective tracking; regular progress reporting; system-review meeting minutes; and management review presentation materials/analysis/data.
• e. Training records (including verification of effectiveness), training evaluation reports and educational materials.
• f. Communication records (including verification of effectiveness) and presentations to Suppliers and customers.
• g. Grievance/complaint records and input/feedback records, retained for at least 12 months, and written information to workers on how to report grievances and provide input/feedback.
• h. Self-audit reports and resulting corrective action plans; records documenting each non-conformance, corrective action plans, progress reports and closure verification reports (with management confirmation); and copies of any regulatory citations/violation notices received in the past three years, including communications with the agencies.

5. Serious conditions that will result in a severe finding

• A confirmed grievance or complaint that has not been investigated, or for which no corrective action plan has been put in place.
• No action taken or recorded for a grievance/complaint for 3 months.
• No identified management representative authorized to implement the management system for the ethics component.
• Senior management does not assess the management system and performance at least annually.
• No self-audits carried out, or audit scope does not include regulatory compliance.
• One or more unaddressed regulatory actions or penalties.

1.0.0 (2021-01-01)

Changed

• Initial historical baseline — the 7.0.0 generic Management System (RBA Code of Conduct 7.0), scoped to ethics: Earliest imported version of the management-system lineage. At RBA Code of Conduct 7.0 there was one generic Management System (Appendix Section E): E2 Management Accountability and Responsibility (incl. annual management review and continuous improvement), E3 Legal and Customer Requirements (quarterly compliance process), E4 Risk Assessment and Risk Management, E5 Improvement Objectives (annual performance management), E6 Training, E7 Communication, E8 Worker Feedback, Participation and Grievance, E9 Audits and Assessments (self-audit), E10 Corrective Action Process, and E11 Documentation and Records. The single system was assessed across all four components (Labor, Health & Safety, Environment, Ethics); this version presents those requirements scoped to the Ethics component. At VAP 7.1.2 the generic system was split into discipline-specific systems and this is the shared 7.0.0 ancestor of the D.M Ethics Management System.