Purpose

• Allowing employees and third parties (those who deal with the issuer, e.g. customers and suppliers) to voice concerns.
• Safeguarding confidence and anonymity of concerns raised.
• Detecting and deterring misconduct or malpractice.

• Establishing a system of comprehensive anti-corruption measures and procedures in support of applicable anti-corruption laws and regulations.
• Providing employees and third parties with clear guidance on the issuer’s anti-corruption policy and applicable anti-corruption laws and regulations.
• Promoting anti-corruption culture within the issuers to sustain integrity management and enhance corruption prevention.

Culture / Pledge

• Referencing corporate culture / regulatory objectives and commitment to integrity.
• Encouraging a speak-up culture, where concerns on actual or suspected misconduct can be reported.
• Confirming confidence and anonymity for any reports made under the policy, and protection from retaliation.
• Confirm commitment that complaints / reports will be handled in a timely, fair and independent manner.

• Referencing corporate culture / regulatory objectives and confirming board / management commitment to integrity, zero tolerance and speak-up culture.
• Linking anti-corruption policy and procedures with other corporate governance policies and whistleblowing policy / relevant reporting channels.
• Confirming issuer’s commitment to compliance with applicable anti-corruption laws in Hong Kong and abroad, including the Prevention of Bribery Ordinance (Cap. 201 of the Laws of Hong Kong).

Personnel to which the policy applies

• Defining who can (i) make whistleblowing reports, and (ii) be subject of such reports (i.e. reporting parties and implicated parties).
  
  Note: Scope has to be wide to cover board, management, employees at all levels including subsidiaries, and external providers (e.g. suppliers, contractors) and customers (as applicable).

• Defining who is covered by policy.
  
  Note: Scope should cover the board, management and employees at all levels, including for subsidiaries, external parties doing business with the issuer and those acting in an agency or fiduciary capacity on behalf of the issuer (e.g. agents, consultants and contractors). 

Conduct / Breaches Covered

• Defining breaches or (mis)conduct that warrant reporting under policy (supported by practical examples of major and minor misconduct).
• Specifying level of substantiation and evidence expected in support of reports made under the policy.

• Defining breaches or (mis)conduct to which the policy applies (supported by practical examples).
• Confirming a prohibition of offering advantages to / soliciting or accepting advantages from any person or organisation in relation to the issuer’s business.
• Defining any exception to the above prohibition (in accordance with applicable laws) and any approval processes required.
• Defining guidelines for the avoidance of actual, perceived or potential conflicts of interest and for the declaration and management of conflicts of interest. 
• Specifying steps and processes to conduct third-party due diligence.

Implementation / Enforcement

• Providing convenient and anonymous channel(s) for reporting.
  
  Note: (i) Consider whether different channels with different mandates should be established (e.g. for different departments / different group companies / different levels of staff). (ii) While reporting channels should provide anonymity, consider to include a statement encouraging reporting person to provide name and/or contact details to facilitate subsequent follow-up actions or investigations.
  
• Confirming process of handling reports and involved departments, staff (including any external providers may be involved in certain functions under the policy).
  
  Note: Reports against senior management and the board may require handling by a designated staff member with sufficient seniority and independence.
  
• Clarifying when reports should be escalated to relevant law enforcement agencies (e.g. the ICAC for corruption-related reports).
• Setting out how reports and follow-up actions under the policy are recorded and stored (i.e. through classifying such records as “confidential” and storing them securely to avoid unauthorised access).
  
  Note: Implementation and operation of the whistleblowing policy should be monitored by the audit committee (or another committee comprising a majority of INEDs).

• Confirming process for investigating and assessing possible breaches.
• Defining disciplinary sanctions resulting from breaches.
• Identifying responsible departments / employees overseeing the policy (including any external providers may be involved in certain functions under the policy).
• Clarifying when and under which circumstances breaches / misconduct should be (i) escalated to relevant law enforcement agencies (e.g. when reporting to the ICAC is required in respect of alleged or suspected corruption) and (ii) brought to the board’s attention.
• Providing contact points if queries as to scope and application of the policy arise.
• Referencing whistleblowing channels available to report possible breaches / misconduct.
  

  Note: Issuers should ensure that their own inquiries into possible misconduct or breaches of applicable policies / law do not hinder or jeopardise investigations by law enforcement agencies. In particular, where reports have already been made to such agencies, issuers should ensure they align their inquiries with the agency or (where necessary) terminate their own inquiry in order not to impede the agency’s investigation.

Communication of policies

• Policies on integrity management, business ethics, governance and compliance, including whistleblowing and anti-corruption policy, have to be regularly communicated to staff of internal departments and external providers (as required) and should be disclosed on the issuer’s website.
• Reporting channels under the Whistleblowing Policy should be clearly communicated to staff and easy to access with the necessary level of confidentiality / anonymity.

Training / Capacity building

• Issuers should adopt a systematic approach to enhancing their corporate governance and commitment to integrity to ensure that relevant policies and procedures are implemented in the issuer’s daily operations.
• This should include periodic training on corporate governance (including on the relevant policies and procedures for anti-corruption and relevant channels for whistleblowing reports).
• Training and guidance should be tailored to requirements of different levels of staff and departments, and may be extended to third parties (e.g. customers, suppliers, affiliates, or providers).
• Directors should be encouraged to attend regular integrity training, including that offered by the ICAC.

Review and update of policies

• Regular review and update of relevant corporate governance policies, including the whistleblowing and anti-corruption policy to ensure they stay fit for purpose.