About EthicsPoint and IntegrityVoice

Reporting – General

Reporting Security & Confidentiality

Tips & Best Practices

About EthicsPoint and IntegrityVoice

What is EthicsPoint?

EthicsPoint is a comprehensive and confidential reporting tool created by NAVEX that enables management and employees to work together to address fraud, abuse, and other misconduct in the workplace while cultivating a positive work environment. Knorr-Bremse has partnered with NAVEX to deploy EthicsPoint for IntegrityVoice.

Why do we need a system like EthicsPoint?

• Our employees are our most important asset. By creating open channels of communication, we promote a positive work environment and maximize productivity.
• An effective reporting system augments our other efforts to foster a culture of integrity and ethical decision-making.

Reporting – General

I do not work at Knorr-Bremse – can I report a concern?

Yes, absolutely. We welcome reports from external parties. In accordance with the EU Whistleblower Directive and other applicable laws, we offer reporting to employees and managers, freelance workers, contractors, subcontractors, suppliers, shareholders, former employees, and volunteers and trainees, whether paid or unpaid. Even if you are unsure whether you fall under the mentioned categories of the directive, we encourage you to contact us.

I am worried that I might face resentment or adverse consequences for reporting a matter. How am I protected as a reporting person?

Knorr-Bremse’s internal policies protect people who make a report on reasonable grounds, or in good faith. Such reporting persons may not be retaliated against in any way. If you believe you have faced intimidation for reporting or attempting to report your concerns or actual or attempted retaliation, please report it to the IntegrityVoice, so that we can initiate a review.

May I report using either the Internet or the telephone?

Yes. IntegrityVoice enables you to file a confidential, anonymous report via either the telephone or the Internet.

What types of situations should I report?

The IntegrityVoice system allows employees to report any potential violation of laws, regulations, Code of Conduct, or policies, or any other concerns you may have.

If I see a violation, shouldn't I just report it to my manager, security, or human resources and let them deal with it?

When you observe behavior that you believe violates our code of conduct, we expect you to report it. Ideally, you should bring any concerns forward to your direct manager or other member of our management team. We recognize, however, that there may be circumstances when you are not comfortable reporting the issue in this manner. It is for such circumstances that we have partnered with NAVEX to establish IntegrityVoice. Rather than you keep the information to yourself, you report through an independent channel directly to the Compliance team.

Should I file my report anonymously or reveal my identity?

This is entirely in your discretion. We, however, ask that you refrain from purporting to be someone that you are not, as it does not help the investigation. We will undertake reasonable efforts to protect your identity, in line with legal requirements.

When making your choice, consider that it is a lot easier for us to successfully investigate the matter if we can get in touch with you to clarify questions. We sometimes have follow-up questions. Although you are not legally obliged to respond to those, we appreciate your willingness to further support our investigation. Hence, please think of a way we can contact you, such as an incognito e-mail account which you check regularly.

Even if you chose anonymous reporting, sometimes the facts of the matter may lead to your identity. You may consider leaving out certain pieces of information to protect your identity. However, it can hamper our ability to adequately investigate the matter if we do not have all available facts.

If you are concerned about adverse consequences of revealing your name or your being associated with the report, please be assured that Knorr-Bremse is fully committed to protect reporting persons. We have a zero-tolerance policy against retaliation. Your concerns can be discussed and addressed.

Why should I report what I know? What is in it for me?

We all have the right to work in a positive environment and with that right comes the responsibility of acting in an ethical manner and letting the appropriate people know if someone is not acting appropriately. By working together, we can maintain a healthy and productive environment. Corporate misconduct can threaten the very existence of an entire company.

Does management really want me to report?

We certainly do. In fact, we need you to report. You know what is going on in our company - both good and bad. You may have initial knowledge of an activity that may be cause for concern. Your reporting can minimize the potential negative impact on the company and our people. Also, offering positive input may help identify issues that can improve corporate culture and performance.

Where do these reports go? Who can access them?

Reports are entered directly on the IntegrityVoice secure server. IntegrityVoice makes these reports available only to specific individuals from the Compliance Team who are charged with evaluating the report. Each of these report recipients has had training in keeping these reports in the utmost confidence. Depending on the nature of the concerns, these reports or its extracts may then be shared with specific individuals to determine the facts of the incidence or address the concerns.

Isn’t this system just an example of someone watching over me?

No. IntegrityVoice is a positive aspect of our overall philosophy that allows us to ensure a safe, secure, and ethical workplace. You are encouraged to seek guidance on ethical dilemmas, provide positive suggestions, or communicate a concern. Effective communication is critical in today’s workplace, and this is a great tool to enhance that communication.

We have carefully chosen the best reporting tool to meet our compliance obligations while maintaining a positive reporting environment.

Reporting Security & Confidentiality

It is my understanding that any report I send from a company computer generates a server log that shows every website that my PC connects with. Won’t this log identify me as the report originator?

NAVEX does not generate or maintain any internal connection logs with IP addresses, so no information linking your PC to IntegrityVoice is available.

If you feel uncomfortable making a report on your work PC, you have the option of using a PC outside our work environment (such as one located at an Internet café or at a friend’s house) through the IntegrityVoice secure website. Many people choose this option, as NAVEX data shows that fewer than 12% of reports are generated during business hours.

Can I file a report from home and still remain anonymous?

A report from home, a neighbor’s computer, or any Internet portal will remain secure and anonymous. An Internet portal never identifies a visitor by screen name and the IntegrityVoice system strips away Internet addresses so that anonymity is totally maintained. If you feel uncomfortable making a report on your home or work PC, you have the option of using a PC outside your work or home environment.

I am concerned that the information I provide IntegrityVoice will ultimately reveal my identity. How can you assure me that will not happen?

The IntegrityVoice system protects your anonymity. However, if you wish to remain anonymous, you - as a reporting party - need to ensure that the body of the report does not reveal your identity by accident. For example: “From my cube next to Jan Smith…” or “In my 33 years of career…”.

We appreciate if you can keep the details of the report confidential by not sharing it with colleagues or reported parties, which can hamper our ability to adequately investigate the matter and reveal your identity to others. You are encouraged to reach out to the Compliance Team to discuss your concerns.

Is the telephone toll-free hot line confidential and anonymous too?

Yes. You will be asked to provide the same information that you would provide in an Internet-based report and an interviewer will type your responses into the IntegrityVoice Web site. These reports have the same security and confidentiality measures applied to them during delivery.

What if I want to be identified with my report?

There is a section in the report to identify yourself if you wish. It is a lot easier for us to successfully investigate the matter if we can get in touch with you to clarify questions.

We sometimes have follow-up questions. Although you are not legally obliged to respond to those, we appreciate your willingness to further support our investigation. Knorr-Bremse is fully committed to protect reporting persons. We have a zero-tolerance policy against retaliation. Your concerns can be discussed and addressed.

Tips & Best Practices

I am aware of some individuals acting unethically, but it does not affect me. Why should I bother reporting it?

Our company promotes ethical behavior. All unethical conduct, at any level, ultimately hurts the company and all employees, including you. You only have to consider what happened in recent corporate scandals to see the disastrous effects that a lapse in ethics can have on an otherwise healthy company. If you know of any incidents of misconduct or ethical violations, consider it your duty to yourself and your coworkers to report it.

I am not sure if what I have observed or heard is a violation of company policy, or involves unethical conduct, but it just does not look right to me. What should I do?

File a report. NAVEX can help you prepare and file your report so it can be properly understood. We would rather you report a situation that turns out to be harmless than let possible unethical behavior go unchecked.

What if my boss or other managers are involved in a violation? Won’t they get the report and start a cover-up?

The IntegrityVoice system and report distribution ensure that implicated parties are not notified or granted access to reports in which they have been named. If you have any additional concerns in the regard, please reach out to Corporate Compliance.

What if I remember something important about the incident after I file the report? Or what if the company has further questions for me concerning my report?

When you file a report at the IntegrityVoice Web site or through the IntegrityVoice Helpline, you receive a unique, randomized number called a “Report Key” and are asked to choose a password. You can return to the EthicsPoint system again either by Internet or telephone and access the original report to add more detail or answer questions posed by a company representative. We strongly suggest that you return to the site in the time specified to answer company questions. You and the company now have entered an “anonymous dialogue,” where situations are not only identified, but can also be resolved, no matter how complex.

Are these follow-ups on reports as secure as the first one?

All IntegrityVoice correspondences are held in the same strict confidence as the initial report, continuing under the umbrella of anonymity.

What if I lose my Report Key or forget the Password I created?

To ensure that security and confidentiality is maintained, if you lose your report key or password, you will need to file a new report. Mention in the new report that it is related to a report or question you previously submitted.

Can I still file a report if I do not have access to the Internet?

You can file an IntegrityVoice report from any computer that can access the Internet. You can file from home. Many public locations, including the public library, have Internet computers. If you do not have access to or are uncomfortable using a computer, you can call the IntegrityVoice Helpline, which is available 24 hours a day, 365 days a year. An interpreter may be called in to assist in the translation process. The agent will take notes of your described impressions and observations in order to draft a short report, so that the matter can be further dealt with in a qualified way. To this end, you may be asked to provide more details on your observations or, if necessary, provide additional documentation. At the end of your call, the agent will agree with you on the suitable options for a future contact with you, if you wish to.