About EthicsPoint

Reporting – General

Reporting - Security & Confidentiality

Report tips & guidance

About EthicsPoint

• What is EthicsPoint?

  EthicsPoint is a confidential reporting tool created by NAVEX that enables Aviva’s (our) management and employees to work together to address fraud, bribery and corruption, and other misconduct in the workplace while cultivating a positive work environment.

  EthicsPoint allows you to report on certain matters related to suspected breaches of law or company policies, as well as other concerns you may have, to Aviva.

• Why does Aviva need a system like EthicsPoint?

  While Aviva has several internal channels to report concerns, we understand that there may be occasions when reporting a concern internally is not appropriate or doesn’t feel like the right approach. For such occasions EthicsPoint provides a free 24-hour service which operates seven days a week offering the facility to report in your local language.

  An effective reporting system augments our efforts to foster a culture of integrity and ethical decision-making and behaviour.

• Use of this service

  Please be aware that the information you supply about yourself, your colleagues, or any aspect of Aviva’s operations may result in decisions that affect others.

  Therefore, we ask that you only provide information that you believe is true. You will not be subject to retaliation from Aviva for any report of a suspected breach that is made in good faith, even if it later turns out to be factually incorrect.

  Please be aware, however, that knowingly providing false or misleading information will not be tolerated – the submission of malicious reports can result in disciplinary action, up to and including dismissal.

  The information you submit will be treated confidentially and your identity protected except in cases where this is not possible because of legal requirements or in order to conduct an investigation, in which case the information will be handled sensitively.

Reporting – General

• How can I report via EthicsPoint?

  EthicsPoint enables you to file a confidential (and anonymous should you chose) report via either the hotline, mobile device app or via the internet.

  Please be alert to your surroundings when submitting a report - ensure that you can do so without any confidential information being seen or overheard.

• What types of situations should I report?

  The EthicsPoint system allows employees to report any known or suspected breach of the Aviva Business Ethics Code (and/or underlying policies and standards) and/or breaches of laws and regulations.

  If your concern relates to a People Function (PF)/Human Resources (HR) type issue such as a complaint about something that affects you personally (e.g., alleged bullying and/or harassment) or your individual employment contract, Aviva has procedures and processes in place to address these – details of which, including how to report, can be found on your local PF/HR intranet pages and/or from your local PF/HR contact.

• I am aware of some individuals acting unethically and/or in contravention of the Aviva Business Ethics Code, but it doesn't affect me. Why should I bother reporting it?

  We all have a role in reporting concerns about behaviour or decisions which could be unethical. Doing the right thing and acting ethically must be core to how we work, how we act, and how we deliver our strategy – this includes reporting genuine concerns of improper behaviour or suspected wrongdoing.

• I am not sure if what I have observed or heard is a breach of the Aviva Business Ethics Code, or involves unethical conduct, but it just does not look right to me. What should I do?

  Any member of the Speak Up or Group Investigations team can be contacted to discuss concerns and obtain guidance.

  Alternatively, file a report. NAVEX can help you prepare and file your report so it can be properly understood. We'd rather you report a genuine concern that turns out to be unsubstantiated than let possible unethical behavior go unchecked.

• If I see a breach, shouldn't I just report it to my manager/leader, security team, or PF/HR team and let them deal with it?

  If you have a legitimate concern about improper behaviour in the workplace (by Aviva employees or third parties) which you feel is, or may be, a breach of our Business Ethics Code or appears illegal, criminal, or unethical you are required to uphold Aviva’s values and report it.

  Where you feel comfortable and if appropriate in the circumstances, we encourage you to report any known or suspected wrongdoing directly to your manager/leader or other senior leaders in your business area or your PF/HR team.

  However, there may be circumstances where you are not comfortable (for example, where the concern is about your leader) or if you have already raised your concern internally and you feel that no appropriate action has been taken. In such instances, the EthicsPoint reporting tool provides an alternative confidential channel to report your concerns.

• Why should I report what I know? What’s in it for me?

  We all have a role in reporting concerns about behaviour or decisions which could be unethical. Anyone with a genuine concern should report it. Even if it means we lose business. We will never tolerate any retaliation against anyone who speaks up with what they believe to be a genuine concern. Our business will be stronger, more trusted and more able to deliver for our customers if we all take accountability for doing the right thing.

• Does management really want me to report?

  Yes. In fact, they need and encourage you to report. Often it is only through individuals speaking up that information comes to light that allows us to address the issue(s) or problem(s) before any serious damage is done and/or helps us to contain a situation.

  If you don’t speak up it means that we may not address certain issues that are going wrong in the business.

  And remember - if the reported concern(s) is not substantiated, the important thing is that you have acted on a genuinely held concern. If you have acted in good faith in reporting your concern, it doesn’t matter if you are mistaken.

• Where do these reports go? Who can access them?

  Reports are entered directly on the EthicsPoint secure server. NAVEX makes these reports available via secure means to Aviva’s specially trained Speak Up team. No other team within Aviva is granted direct access.

• What happens with my report?

  All concerns received are passed through an assessment and triage process by the Speak Up team to determine next steps, including investigation as appropriate. The Speak Up team will make a decision, in consultation with relevant stakeholders as appropriate (e.g. the People Function, Legal, Corporate Security etc.), as to which area will progress the matter: Group Investigations, People Function, or another team.

  To the extent any reports are shared by the Speak Up team, it is on a strictly confidential, redacted as appropriate, and need-to-know basis (e.g., with the team assigned to investigate the matter and/or to meet any legal or regulatory obligations).

• Isn’t this system just an example of someone watching over me?

  No.

  EthicsPoint is a positive aspect of our approach to provide a safe, secure, and ethical workplace. We have chosen the EthicsPoint reporting tool not simply to meet our compliance obligations, but to foster a positive reporting culture.

Reporting Security & Confidentiality

• What’s the difference between reporting a concern confidentially or anonymously?

  All reports are confidential, but not all reports are raised anonymously.

  A concern is raised confidentially where the individual reporting the concern gives their name on the understanding that it is shared only on a strictly need-to-know basis. We make every effort to protect your identity, however, you should be aware that there may be times when the Speak Up team is unable to resolve a concern without revealing your identity, for example where your personal evidence is required. Where this is the case, the Speak Up team will make every effort to obtain your agreement prior to any such disclosure, subject to our legal obligations.

  An anonymous report is where the individual raising the concern does not provide their name or identity. An anonymous concern can make it much more difficult for us to investigate the matter, protect your position, or to provide you with feedback on the outcome. However, we would rather you raised your concern anonymously than not at all.

• Can I report anonymously?

  Yes, you are given the option to report anonymously should you wish. This option is available whether you report via the EthicsPoint hotline, mobile device app or the Internet.

  If you make a report via the EthicsPoint telephone hotline, you will be asked to provide the same information that you would provide in an Internet/app-based report and a call handler will type your responses into the EthicsPoint website. These reports have the same security and confidentiality measures applied to them during delivery.

• What if I want to/am comfortable to be identified in my report?

  There is a section in the report to identify yourself.

• It is my understanding that any report I send from a company computer generates a server log that shows every website that my PC/laptop/device connects with. Won’t this log identify me as the report originator?

  NAVEX does not generate or maintain any internal connection logs with IP addresses, so no information linking your PC/laptop/device to EthicsPoint is available.

  An internet portal never identifies a visitor by screen name and the EthicsPoint system strips away internet addresses so that anonymity is maintained.

• I am concerned that the information I provide EthicsPoint will ultimately reveal my identity. How can you assure me that will not happen?

  The EthicsPoint system protects your anonymity. However, if you wish to remain anonymous, - as a reporting party – you need to ensure that the body of the report does not reveal your identity by accident. For example, if your reports contain statements that would likely identify you such as “From my cube next to Jan Smith…” or “I am the only female in the Claims call centre…”.

Report Tips & Guidance

• How do I ensure my report contains sufficient information?

  To assist the Speak Up team to triage your report (and for any relevant team to investigate) as efficiently and effectively as possible, be as specific as you can in your report. Remember; where you wish to remain anonymous when submitting your report think about any information that may identify you.

  Where known, information should include:

  • Who: Provide names and roles of individuals/companies, including (but not limited to) those you believe are subject to the alleged wrongdoing, witnesses, and any other relevant individuals/companies including the context in which you are naming them.
  • What: Define your concern(s), the situation or the issue(s). What is it about, where is it happening? If known, name the policy, law or regulation that you believe has been breached.
    What information or evidence is available to support your concerns and where can it be found/obtained?
  • When – When did the incident(s) occur, is it still occurring? If known, provide dates or an approximate time frame.
  • Why and how – If known, why and how has it happened/is it happening? Are there control issues, if so, what?
• What if I remember something important about the incident after I file the report? Or what if the Speak Up team has further questions for me concerning my report?

  When you file a report on the EthicsPoint website or through the EthicsPoint app or hotline, you receive a unique, randomised number called a “Report Key” and are asked to choose a password.

  You can return to the EthicsPoint system again either by internet or telephone and access the original report to add more detail, answer questions, and/or respond to requests for further information/points of clarification from the Speak Up team.

  The Speak Up team will also use the secure EthicsPoint system to provide you with updates and feedback on the outcome (within the confines of our legal and confidentiality obligations) of your report.

  We strongly recommend that you return to the EthicsPoint site to check the feedback section of your report. The feedback section allows for an “anonymous dialogue” between you and the Speak Up team that can help move the matter forward more efficiently and effectively.

• Are these follow-ups on reports as secure as the first one?

  All EthicsPoint correspondences are held in the same strict confidence as the initial report, continuing under the umbrella of anonymity (where selected).

• What if I lose my Report Key or forget the Password I created?

  To ensure that security and confidentiality is maintained, if you lose your report key or password, you will need to file a new report.

  To the extent this happens, please ensure that you mention in the new report that it is related to a report you previously submitted and have lost your report key or password. Further, please mention the date (or approximate date) of the initial report.

• Can I still file a report if I don’t have access to the Internet?

  If you don’t have access to or are uncomfortable using a computer, you can call the EthicsPoint toll-free hotline, which is available 24 hours a day, 365 days a year.

  Please be alert to your surroundings when submitting a report - ensure that you can do so without any confidential information being seen or overheard.

• What if my boss or other managers are involved in the alleged wrongdoing? Won’t they get the report and start a cover-up?

  The EthicsPoint system and report distribution ensure that reports are restricted to the Speak Up team, who only share reports on a strictly confidential, redacted as appropriate, and need-to-know basis (e.g., with the team assigned to investigate the matter and/or to meet any legal or regulatory obligations).

  Any implicated parties are not notified or granted access to reports in which they have been named.

  Patrick Flynn, Chair of the Group Audit Committee and Senior Independent Director, is Aviva’s Whistleblowing Champion and is responsible for the independence, autonomy and effectiveness of Aviva’s policies and procedures on Whistleblowing.

  The Whistleblowing Champion delegates day-to-day responsibility to the Speak Up team who are responsible for the operation of Aviva’s Speak Up service. The Speak Up team is part of Group Investigations within the Legal function and report into Aviva’s Group General Counsel.