Conflict Minerals Reporting - Bitly

Best Practices

Conflict Minerals Reporting A Comprehensive Guide to Understanding Your Supply Chain

Source Intelligence

+1 877.916.6337

1921 Palomar Oaks Way Suite 205

www.sourceintelligence.com

Carlsbad, CA 92008

[email protected]

Copyright © 2016 Source Intelligence

Source Intelligence

Highlights Dodd-Frank 1502 Overview Product Filtering Tracing Conflict Minerals Engaging Your Suppliers Verifying Your Smelters Preparing for An Audit Frequently Asked Questions

02

CO N F L I C T M I N E R A L S R E P O R T I N G

S O U R C E I N T E L L I G E N C E .CO M

4 7 12 20 24 29 34



03

Source Intelligence

Overview

regulatory applicability.

Dodd-Frank 1502

Conflict Minerals Rule On August 22, 2012, the U.S. Securities and Exchange Commission adopted Rule 13p-1 under the Exchange Act, which is known as the “Conflict Minerals Rule.” The rule requires certain companies to disclose their use of conflict minerals if those minerals are “necessary to the functionality or production of a product” manufactured by those companies. Under the Act, those minerals are tantalum, tin, tungsten or gold (3TG).

04



"The rule" is intended to reduce a significant source of funding for armed groups that are committing human rights abuses in the eastern Democratic Republic of the Congo (DRC) and specific adjoining countries (Angola, Burundi, Central African Republic, Congo Republic [a different nation than DRC], Rwanda, Sudan, Tanzania, Uganda, and Zambia). Broadly, the regulation requires companies to investigate their supply chains and publicly disclose the origin of the conflict minerals used in their products on their 10-K, 20-F and 40-F filings, as well as on their websites. To fall under the rule requirements, conflict minerals must be “necessary to the functionality” or “necessary to the production” of a product manufactured or contracted to be manufactured by a SEC issuer. Although the final rule does not explicitly define these terms, it does provide additional guidance for issuers to consider when determining

Dodd-Frank Wall Street Reform and Consumer Protection Act, Section 1502 - "Conflict Minerals Rule" Regulatory Body Companies Affected Date Adopted First Filing Date

SEC

In determining whether a conflict mineral is “necessary to the functionality” of a product, an issuer should consider: (1) whether the conflict mineral is intentionally added to the product or any component of the product and is not a naturally-occurring by-product; (2) whether the conflict mineral is necessary to the product’s generally expected function, use or purpose; and (3) if the conflict mineral is incorporated for purposes of ornamentation, decoration, or embellishment, whether the primary purpose of the product is ornamentation or decoration. In determining whether a conflict mineral is “necessary to the production” of a product, an issuer should consider: (1) whether the conflict mineral is intentionally included in the product’s production process; (2) whether the conflict mineral is included in the product; and (3) whether the conflict mineral is necessary to produce the product.

US Publicly Traded and Upstream Companies

2012 May 2014

It is important to note the final rule guidance on “necessary to the production,” which states that the conflict mineral must be both contained in the product and necessary to its production. Thus, the SEC does not consider a conflict mineral used as a catalyst, or in a similar manner in another process, in scope if it is not contained in the final product, even if the mineral was necessary to produce the product.



05

Conflict Minerals Reporting

Product Filtering A Critical First Step Once a company determines which products are in scope based on manufacturing influence, these products should be reviewed for possible presence of 3TG.

Where do we start? Many companies are currently asking themselves this question when it comes to complying with the U.S. regulation on conflict minerals. For companies that manufacture thousands of products—such as retailers with name brands—the requirement to publicly disclose the origin of gold, tin, tantalum and tungsten (3TG) used in these products is especially challenging. The prospect of surveying and requesting data from every tier 1 supplier is daunting and inefficient. However, evidence of sufficient due diligence on product mineral origins is an essential requirement for compliance. The process of product filtering is thus a critical first step. Product filtering can help companies achieve regulatory compliance efficiently by eliminating from the Reasonable Country of Origin Inquiry (RCOI) and Due Diligence processes those products that are out of scope. The goal of filtering is to reduce the effort required for compliance by only querying suppliers whose products are in scope. For companies, particularly retailers, with thousands of products that need to be considered, effective filtering can help

06





07

Conflict Minerals Reporting Before screening for 3TG, a clear boundary should be drawn around which products are in scope based on the company’s degree of influence over their manufacture. reduce the compliance burden and the number of data collection inquiries passed up the supply chain. However, the desire for minimizing the work required to comply must be balanced with risk management. A manufacturing process involving the use of 3TG can occur several layers up the supply chain and may not be known to downstream companies utilizing a given component or part in a final assembly. Thus, any product for which 3TG may be necessary to functionality or production should be investigated. Define a clear boundary Before screening for 3TG, a clear boundary should be drawn around which products are in scope based on the company’s degree of influence over their manufacture. Directly manufactured products are clearly in scope; however, the contract to manufacture criterion is less clear. Per the regulation, whether a product is considered to be

08

contracted for manufacture depends on the degree of influence the company exercises over the materials, parts, ingredients or components included in any product that contains conflict minerals or their derivatives. Although the regulation does not explicitly define the “degree of influence” required, it does provide certain cases where this threshold would not be triggered. For example, if a company is solely affixing its brand, marks, logo, or label to a generic product manufactured by a third party, it would not be considered to be contracting the manufacture of that product. There is some debate with regard to whether taking additional actions beyond fixing a label, for example by specifying color or other aesthetic attributes, is enough to trigger the threshold. Review product list Once a company determines which

Step 1

Step 2

Step 3

Define a clear boundary

Review product list

Filter products



Step 4 Seek supplier declarations

products are in scope based on manufacturing influence, these products should be reviewed for possible presence of 3TG. The more information a company is able to gather about its products, the easier and more effective its filtering process will be. If a Bill of Materials is available, then the presence of 3TG can be detected relatively easily. When this is not available, it is best to cast a wide net to reduce the risk of overlooking a product that should be investigated. Something as simple as a product description or a categorization can offer useful hints into the product’s material composition. All products that clearly contain 3TG based on the Bill of Materials can move to the RCOI and Due Diligence step. An initial data quality review is also advisable at this point. When the filtering process includes thousands of products, completeness and accuracy of the product data are vital to a successful filtering outcome. Seek supplier declarations Flagged products are then moved to a group where further investigation is required to understand whether they contain 3TG or not. The suppliers of these products should be queried and ideally asked to provide a declaration stating that the product does not contain 3TG. If the supplier confirms the presence of 3TG or a declaration is not forthcoming, then the product should be moved into the RCOI and Due Diligence phase. Beginning the RCOI and Due Diligence processes with a focused list is important, as supply chains can rapidly expand depending on the complexity of the product. In our experience, the filtering process



09

Product Filtering can reduce the number of products requiring tracing by 10-50%, depending on the industry. Tracking and organizing communications and resulting data generated during supply chain tracing are decisive, as they must comprise an auditable record of the company’s due diligence effort. Source Intelligence® uses a cloud-based platform to facilitate the tracing process and organize the archiving of supplier communications up the supply chain. Surveys are electronically distributed to targeted suppliers who can then login to the platform to respond and upload Electronic Industry Citizenship Coalition and Global e-Sustainability Initiative templates and other requested information. Electronic mail and telephone conversations can also be recorded and uploaded into the system. Communications in multiple languages are provided as needed, and our multi-lingual Supplier Engagement Team and 24-hour Compliance Call Center provide support to follow-up on missing data and questions. Once all data are collected and quality assured, the platform provides tools for data visualization: supply chain tree maps, supplier tracer maps and conflict mineral risk metrics at the supplier and/or product level. Finally, reporting tools are provided for generating the regulatory-required Form SD and Conflict Minerals Report. 3TG Use Variability It is certain the U.S. conflict minerals regulation is far-reaching in terms of the number of organizations that have to comply. Although targeted to SEC issuers, private companies are impacted as well by inquiries for supply chain information by their customers. Despite this wide reach, the regulation is performance-based rather than prescriptive on actions required to comply. An organization’s risk position will thus shape due diligence efforts, with such efforts likely

010



10-50%

Reduction in number of products requring tracing if filtering done first

Product filtering can help uncover risk areas in your product lines that should be approached with a higher level of scrutiny.

Focusing your product list on the front end will result in a more efficient tracing process and reduce the reporting burden on your suppliers. determine whether or not the products are in scope. With a product list that has been quality reviewed and flagged for risk of 3TG presence, companies can confidently move forward in the conflict minerals compliance process.

to evolve over time. There has already been much discussion around grey areas, such as packaging, catalyst residues and ancillary (non-functional, decorative) uses of conflict minerals in products. In terms of conflict minerals used in packaging, such as for food or pharmaceuticals, one needs to consider whether such packaging is necessary to the functionality of the given product. Beginning your conflict minerals compliance process with product filtering can help uncover risk areas in your product lines that should be approached with a higher level of scrutiny. Product filtering is a critical first step for companies faced with the task of assessing the origin of conflict minerals for thousands of products. Focusing your product list on the front end will result in a more efficient tracing process and reduce the reporting burden on your suppliers. The process can also highlight areas of uncertainty (i.e. packaging or catalysts) that should be carefully reviewed to



011

Tracing Conflict Minerals Regulatory Definition Once you have a focused list from product filtering, you are now ready to initiate a Reasonable Country of Origin Inquiry (RCOI) by working with companies throughout your supply chain. Depending on the number of products requiring investigation and the complexity of the associated supply chains, a RCOI could involve hundreds or even thousands of telephone and email inquiries, data requests, data files and other supporting documents. To effectively highlight areas of risk and provide auditable evidence of your due diligence process, these efforts and the resulting data must be well-organized, and continuously reviewed and assessed. Key issues to consider throughout the process are supplier response rates and requests for confidentiality, missing and erroneous data, and discovery of red flags, which warrant further investigation.

012



The Final Rule does not explicitly state which actions and outcomes are needed to satisfy the RCOI requirement, arguing that such a determination depends on each SEC issuer’s particular facts and circumstances. Per the SEC, the RCOI process can differ depending on an issuer’s size, products, relationships with suppliers, or other factors and will evolve over time depending on available infrastructure. However, per the general standards provided in the Final Rule, the RCOI must be reasonably designed to determine whether the issuer’s conflict minerals did originate in the Covered Countries, or did come from recycled or scrap sources, and it must be performed in good faith. More specifically, the RCOI requirement is satisfied if the issuer seeks and obtains reasonably reliable representations indicating the facility at which its conflict minerals were processed, and demonstrating that those conflict minerals did not originate in the Covered

Countries or came from recycled or scrap sources. These representations could come either directly from that facility or indirectly through the issuer’s immediate suppliers, but the issuer must have a reason to believe these representations are true given the facts and circumstances surrounding those representations. Put more simply, organizations must trace the origin of necessary conflict minerals in their products back to the smelter or processing facility and must document the results of this trace. If an issuer learns through its RCOI that its products have conflict minerals which are necessary, and that originated in the Covered Countries and did not come from recycled or scrap sources, they must proceed to the next step in the compliance process, Due Diligence. Additionally, if an issuer has reason to believe that its necessary conflict minerals may have

originated in the Covered Countries (and may not have come from recycled or scrap sources) based on the RCOI, the Due Diligence process is triggered. Below we cover practical steps organizations may take to fulfill the RCOI requirements.

RCOI Process The goal of the RCOI is to trace the origins of necessary conflict minerals in your products and gather intelligence as to whether these minerals came from the DRC or adjoining countries. The essential elements of a RCOI are: identifying and engaging relevant suppliers; data collection, management, and quality assurance; and assessment to determine whether further Due Diligence is required.



013

Tracing Conflict Minerals

RCOI: Essential Elements Identifying Supplier Contacts Based on your list of products requiring 3TG tracing, contact information for the relevant individuals at your Tier One suppliers should be assembled (names, telephone numbers and email addresses). Although this may seem like a simple step, our experience indicates fairly extensive contacts may be required to pinpoint the best person within an organization to engage on conflict minerals and to establish effective lines of communication. Most companies only have a contact that acts as an account manager, so the work of tracking down the proper contact could take some time and effort. Discrepancies in part numbers (e.g., typographic errors, discontinued parts, inaccurate crosswalks between internal and supplier unique IDs) can also complicate the process. If

possible, communications should include both your own internal P/N as well as the P/N of your supplier so that cross-referencing later on will be easier. It is prudent to build additional lead-time into the compliance process to account for these potential initial roadblocks.

Engaging Suppliers Once appropriate points of contact within Tier One suppliers are identified, a good practice is to provide background information on the Conflict Minerals regulation itself. Depending on your industry and products, some or even many of your suppliers may have limited or no knowledge of the regulation and its provisions (e.g., private companies and those located outside the U.S.). In addition to telephone and email communications, Source Intelligence uses its on-line platform to house information on Rule requirements that suppliers can access

Tin

Tungsten

throughout the data collection process if they have questions. It is also useful to provide an overview of your compliance program and its goals and requirements. The importance of receiving timely and accurate information should be stressed, for example, by including a letter from a senior executive within your organization in your initial communications and data requests. Suppliers may be at first reticent to provide information they consider confidential and critical to their business advantage and success. It will be important therefore to include mechanisms in your program to allow for supplier confidentiality, anonymity and potentially the execution of Non-Disclosure Agreements (NDAs). Defining an escalation process is also recommended to address non-responders. No matter who at your organization, or

Tantalum

third-party service provider, is handling the program, the first introduction should come from a person with whom the supplier is familiar. Seeing a name they know will increase the likelihood that a supplier will read the email, and respond.

Data Collection and Management Once your program has been introduced to your suppliers and lines of communication established, data collection can begin. The Electronic Citizenship Coalition (EICC) and the Global e-Sustainability Initiative (GeSI) Conflict Minerals Reporting Template is the current industry standard for collecting conflict minerals information up the supply

Gold

Tracing Conflict Minerals

Verifying responses and obtaining additional information may require several iterations of follow-up just within the first tier of your supply chain.

chain, but it is not the only solution for data collection. Regardless of the method or platform used, key information to obtain includes: the location of the facility or facilities that are associated with the production or storage of the products being traced; a list of materials that are included in the products which may contain conflict minerals or where conflict minerals may be necessary in the production process; and contact information for the companies supplying the materials that meet the criteria above. This process should continue until the smelters or refiners of recycled or scrap materials have been identified. It should be expected that multiple telephone and/or email contacts will be required to complete the data collection process with a given supplier, and that communications, surveys and templates will need to be provided in multiple languages. Meetings and telephone contacts to follow-up on missing data and questions will need to be scheduled appropriately based on time zones.

016



Data Assurance and Assessment Although successfully engaging suppliers and obtaining required data may be one of the biggest challenges you face throughout the compliance process, you will also need procedures for data quality and control. Completed templates and surveys need to be reviewed for reasonableness and missing data. Verifying responses and obtaining additional information may require several iterations of follow-up just within the first tier of your supply chain. At a minimum you should expect to spend an hour to 90 minutes of time per supplier to collect the required information. Remember, you will also likely need to follow up with suppliers on a regular basis, such as each quarter, to understand if there have been any changes in their supply chains. Though this time commitment is spread out over the course of the year when dealing with very large supply chains it may quickly become a very significant use of human resources.

You will also need mechanisms to track the outcomes of your telephone and email queries so you can easily determine which items are closed and which still need to be addressed. Building these tracking systems after the data collection has begun will not be as efficient as having them ready to go from day one.

smelters and processing facilities associated with your 3TG products, and that your steps were performed in good faith. Since the substance and outcome of your RCOI will be part of your SEC reporting, public perception of your efforts – or lack thereof – should be a critical risk management decision within your organization.

One area where we experience a significant need for fact checking is in identification of smelters and refiners noted in templates. We have found that as high as 40% of smelters noted for a given component are in fact other types of companies such as semiconductor fabricators, solder manufactures, or metal traders. In addition, the names of smelters as provided by your suppliers will vary as much as the spelling of words before MerriamWebster. Having a robust database of smelter aliases, both known smelters and known non-smelters, will expedite this process. On average you can expect five or six different spellings of each smelter provided. Verifying the veracity of smelter information may thus also include multiple telephone and email communications across locations worldwide, in addition to internet research.

Depending on the complexity of your supply chain, you may interact with hundreds, or even thousands, of suppliers. Our experience shows it is not unreasonable to find a 50:1 ratio of sub-suppliers to a primary supplier. As such, managing the resulting email and telephone communications, surveys, and templates will require an agile data system. Being able to easily analyze supplier data is also imperative to capitalize on redundancies, for example by sending a single data request to a supplier acting in separate supply chains associated with your products. Strong data management is also an essential requirement for auditable evidence in the case of supply chains being moved forward to the Due Diligence process. Since this will include 3TG products for which you are unable to rule out the possibility of a DRC-origin of conflict minerals during the RCOI, it could potentially include a significant amount of products and suppliers in this first year of compliance activities.

Moving Up the Supply Chain While the RCOI essential elements described above require a significant input of resources, unfortunately, this is just the beginning. These steps will have to be repeated up your supply chain until you feel you have enough information and documentation to support your stance that your RCOI was reasonably designed to determine the location of the

On average you can expect five or six different spellings of each smelter provided.



017

Depending on the complexity of your supply chain, you may interact with hundreds, or even thousands, of suppliers.

The RCOI conducted by your organization will be a cornerstone of your conflict minerals compliance program. Not only will it require a significant amount of labor and other resources, but it should be viewed as your “first pass” at identifying conflict minerals risks hidden within your supply chain. Successfully identifying these risks will require a thorough, well-organized system of data collection, and reasoned review of the collected information. The number of products and suppliers passed to the Due Diligence process will subsequently impact the level of work required in auditing and reporting, highlighting the criticality of a RCOI done right the first time.

018


Due Diligence If after the RCOI, your company knows that its conflict minerals may have originated in the DRC and did not come from scrap or recycled sources, the subsequent Conflict Minerals Report must include a description of the measures you took to exercise due diligence on the source and chainof-custody of those minerals. As such, it will be very important to ensure you have a strategic process for due diligence that can be documented and verified. The description of the due diligence process implemented should be

based on your specific facts and circumstances. Just remember, the SEC may determine that a company’s due diligence process was unreliable and hence any Conflict Minerals Report that relied on that due diligence process would not meet statutory requirements. This is why it is important to identify the due diligence process you will be implementing and document the results associated with the implementation of that process.



019

Conflict Minerals Reporting Engaging suppliers is an ongoing and strategic effort over the lifecycle of a conflict minerals program. Issuers can only move as fast as their slowest supplier.

Engaging Suppliers due diligence process. Supplier engagement What other types of actions and follow up are key to collecting data far up the constitute due diligence that meet the intent of the supply chain. Final Rule? Is it sufficient to survey or otherwise query Mineral supply chains only your Tier 1 suppliers can run wide and deep for the presence of conflict – especially when minerals in their supply considering their handling, chain? If you have ever had trading and transportation the pleasure of distributing routes. While you may a survey, you’ll know have good visibility of that response rates are Tier 1 and 2 suppliers, it typically low and can vary is likely there is limited significantly in terms of transparency to suppliers completeness. This results that are Tier 3 and higher. in findings and data that are Furthermore, companies less than accurate. must often overcome the contractual obligations to obtain required The OECD Pilot Project information. In many Report notes that prioritizing Tier 1 suppliers cases, tracing the source of minerals back to the is a good way to start the Supplier Engagement

020



Reasonably Reliable Representations

smelters may be impossible for a company to do itself; at the very least, this will require additional resources. There is also a balance that must be struck between maintaining a relationship with a supplier base while also extracting information from it. It can take years to build reliable and financially favorable relationships with suppliers. How hard a company presses becomes a question of how much risk it is willing to assume.

You should think about what “reasonable representation” from your suppliers means with respect to your due diligence. Is written communication via email sufficient or will you only accept a documented conflict-free certification signed by a senior executive of the company? You will need to actively engage your suppliers to obtain the necessary information, in the format required. Active engagement will also increase the likelihood you obtain the information in the first place. Be aware that passive supplier engagement may not be sufficient to obtain the accurate information your company requires to demonstrate due diligence. Merely distributing a mass email to suppliers requesting information will likely not generate reasonable representation from your suppliers.

Overcoming Supplier Resistance Timely supplier responsiveness is a key enabler for conflict minerals compliance. Across core steps in the compliance process, determining the chain of custody of minerals requires a significant amount of supplier engagement. For 2013 compliance, this proved to be extremely time-consuming as requests for information had to be passed through multiple tiers in the supply chain. Delays in collecting responses were exacerbated by resistant suppliers who lacked awareness and understanding of the Dodd-Frank Section 1502 conflict minerals disclosure regulation. During the 2013 reporting year, Source Intelligence found that suppliers can take as long as 180 days to respond to a reporting company’s (issuer) conflict minerals inquiry. In some cases, issuers who started compliance programs late in the year found it difficult to engage enough



021

Engaging Suppliers

Critical Considerations for Supplier Responsiveness

suppliers to make a determination for the first year’s filings with the Securities Exchange Commission (SEC), due May 31, 2014. In order to maximize the completeness of compliance programs, issuers must both improve the timeliness of supplier responses through education and allow sufficient lead time to account for laggards and resistors. The Source Intelligence Conflict Minerals Resource Center (CMRC) was launched, in part, to help issuers overcome the challenges associated with engaging unknowing suppliers about a regulation as nascent as Dodd-Frank Section 1502. The CMRC is a training and resource center to educate and inform companies who are directly or indirectly impacted by the regulation. Members of the CMRC have access to up-to-date news and analysis, sample documents, and training videos. Issuers can only move as fast as their slowest supplier, so having access to educational resources will help suppliers navigate the complexities of the regulation to avoid delays in delivering the necessary information.

SUPPLIER EDUC ATION Easily accessible tools and resources for suppliers increases awareness and understanding of regulatory requirements and will lead to better cooperation and faster response times.

What does the data say? Our database includes suppliers serving the Apparel, Electronics, Manufacturing, Oil & Gas, and Retail industries. In 2013 each customer had, on average, 1336 in-scope suppliers in Tier 1 alone, and as tiers deepened that number of suppliers grew significantly. Some customers required suppliers to use the CMRC as part of their compliance programs, and those suppliers were able respond faster to requests for information. In a comparison among manufacturing customers (averaging 985 Tier 1 suppliers each) there was a 44% faster response rate for suppliers required to use the CMRC than those not using it. Additionally, the time required for all CMRC educated suppliers to respond was 60 days less compared to suppliers who weren’t CMRC-educated, further highlighting that education is an accelerator for supplier response times.

022



QUALIT Y OF SUPPLIER CONTAC T DATA Identifying the right supplier point of contact to address conflict minerals can be challenging. Utilizing a database that is continuously refined to disambiguate unstructured supplier contact data will expedite supplier engagement.

TIME & RESOURCES

The breadth and depth of a supply chain is global and complex. Supplier engagement teams utilizing a database of linked suppliers, smelters, and mine locations will save you time.

44% Faster Responses There was a 44% faster response rate for suppliers required to use the Conflict Minerals Resource Center than those not using it.

ENGAGEMENT STRATEGIES Email data requests alone are not adequate. Building the trust and willingness of suppliers to provide detailed information is essential. Multi-lingual supplier support specialists and a 24/7 call center will yield the best results.

SUPPLY CHAIN COMPLE XIT Y

ISSUER COMMITMENT

The breadth and depth of a supply chain is global and complex. Supplier engagement teams utilizing a database of linked suppliers, smelters, and mine locations will provide visibility upstream through to smelters.

An issuer’s own commitment to the success of a compliance program reinforces the expectation that failure for suppliers to respond is not an option.



023


Verifying Your Smelters Once RCOI is complete, what is next? The Final Rule states that the end goal is to understand the smelter or refiner from which a supplier sources their 3TG. Once this information is provided, RCOI is complete and companies move to a data validation and due diligence process. To maintain a stream of quality information despite uncertain information and

data discrepancies requires a solution of manageable and detailed resources. This can be incredibly difficult for companies, as they do not have the resources to obtain this information or the ability to communicate with those that have the answers to these questions.

Smelters contained within supplierprovided CMRTs must first be consolidated to account for duplicate information. Smelter Verification Challenges Verifying supplier-provided smelter information is an ongoing effort conducted throughout a Conflict Minerals Reporting Year. After the 2013 reporting deadline, the press coverage of those issuers listing an entity in North Korea as a smelter underscored not only the visibility of this data but also the need for a thorough system of controls on reported smelter information. As a result, issuers feel growing pressure internally from legal and internal auditors for in accurate smelter information. Achieving this type of clarity is time and resource-intensive. For the 2014 reporting year, Source Intelligence saw supplier-provided templates averaging just over 60 smelters per template, but some had as many as 1000 supplier provided smelters. In total, these smelter entries can add up, presenting a challenge to companies seeking to consolidate duplicates and reconcile aliases with known smelter data. In industries such as Electronics, Manufacturing and Oil

024



& Gas, we’ve seen anywhere from 25000 to almost 50000 supplier smelter entries. Smelters contained within supplier-provided CMRTs must first be consolidated to account for duplicate information.

Consolidating and Matching to Known Smelter Lists Source Intelligence’s Smelter Database uses an extensive list of recognized aliases to consolidate duplicate supplier-provided smelter entries into a manageable list of smelters. The official smelter name is then matched with lists of verified smelters from three well-known sources, Organization for Economic Cooperation and Development (OECD), Conflict Free Sourcing Initiative (CFSI) and the Department of Commerce (DoC). Creating a process to consolidate duplicates allows companies to take thousands of smelter entries and reduce them to a manageable list of a couple hundred verified smelters.



025

Smelter Verification

Verifying supplier-provided smelter information is an ongoing effort conducted throughout a Conflict Minerals Reporting Year.

60 Average smelters per template in 2014

Creating a process to consolidate duplicates allows companies to take thousands of smelter entries and reduce them to a manageable list of a couple hundred verified smelters.

Smelter Database

Enagement Team

Match official smelter name with

Conduct native language outreach to

Conduct research to understand

lists of verified smelters from three

verify smelter information and obtain

and map smelter facility locations

well-known sources: OECD, CFSI and

additional details on sourcing.

and review provided information for

DoC.

026

Smelter Research


1000 Smelters per template can be this high

10-50% Uncertified smelters of consolidated verified smelters

Consolidate and cross check against verified smelter information

Compile and match certification information

Conduct research and outreach for smelter information

Review for indications of problematic sourcing

indications of problematic sourcing.




027

Verifying Smelters Those tasked with implementing Conflict Minerals programs face challenges reconciling several disparate sources of information on known processors to understand whether a specific Covered Countries, therefore issuers must conduct smelter processes 3TG. The Source Intelligence Smelter Database reconciles and consolidates all due diligence on all smelters suppliers indicating that source from a covered country. From a risk current publicly-available information. management perspective, however, conducting additional research and outreach for all smelters without a conflict-free certification is also an important component of a successful conflict minerals program. The number of uncertified smelters can be anywhere from 15-50% of consolidated verified smelters, which presents a The London Bullion Market Association (LBMA), challenge to issuers without the internal resources Responsible Jewelry Council (RJC) and Conflict-free to accomplish such extensive engagement. Sourcing Initiative (CFSI) run smelter certification programs based on the OECD Due Diligence Source Intelligence’s multilingual Smelter Research Guidelines, which provide an important resource for companies seeking to understand the conflict and Engagement Team conducts native language outreach to verify smelter information and status of the smelters reported in their supply obtain additional details on sourcing and due chain. A successful smelter verification program diligence practices. A large part of these outreach will match recognized smelter names with the efforts center on verifying and gaining additional frequently updated lists on each respective information about the mines from which each organization’s website to pinpoint smelters for smelter obtains 3TG. Implementing a successful additional research and engagement. due diligence process is predicated on accurate mine of origin information. The Smelter Research Team also conducts research to understand and map smelter facility locations and review provided information for indications of problematic sourcing. Sourcing of concern includes not only sourcing from a covered country but also sourcing Section 1502 requires additional due diligence if an issuer knows or has reason to believe that 3TG from an OECD level 2 country or a country with no known 3TG reserves. in their supply chain is being sourced from the

Assess Conflict-Free Certification Status

Conduct Research and Engagement

028



To Audit or Not To Audit? Whether you conduct an Independent Private Sector Audit (IPSA) this reporting year will be influenced by several factors. The ambiguity primarily revolves around the court decision and the continuing stay of the mandatory IPSA requirement. We are seeing that most companies are taking a proactive approach by preparing and committing resources for an IPSA.

Who Can Audit? The SEC rule allows an auditor other than a certified public accountant (CPA) to perform an IPSA as long as they meet the requirements under the Yellow Book. Your financial auditor may conduct your IPSA if the Board of Directors pre-approves since the IPSA is treated as a non-audit service. The Yellow Book states auditors are permitted to use either the provisions of Attestation Engagements or Performance Audits. While Attestation Engagements require auditors to be licensed CPAs, Performance Audits may be performed by non-CPAs as long as the auditor meets the stated requirements. We recommend you utilize an auditor with a strong understanding of the Conflict Minerals Rule and IPSA requirements. In screening candidates for your IPSA auditor, ask issuers who have been through an IPSA for their recommendations and interview potential candidates to be sure you are comfortable with the approach proposed. You can also review the IPSA reports themselves on the SEC EDGAR database to gain additional information about the auditor’s approach, qualifications and reporting format.

Audit Scope The scope of the IPSA centers on information provided in the CMR and the issuer’s due diligence framework. Reasonable Country of Origin Inquiry (RCOI) activities are not covered by the IPSA unless the company specifically includes the RCOI in their written description of due diligence. Under the rule, the RCOI is a distinct step separate from – and preceding - the due diligence process. So, you should expect your auditor to express an opinion or conclusion with regard to two things: 1) does the design of due diligence measures, as presented in the CMR, conform with a nationally or internationally recognized framework, and 2) is the description of due diligence measures performed consistent with the due diligence process implemented.



029


Expert Opinion Write Your CMR with IPSA Effort in Mind.

The CMR language provides the audit criteria, so you have a significant amount of control over the associated audit effort and cost. It isn’t difficult to thoughtfully craft language that meets the disclosure requirements without resulting in unnecessarily high IPSA costs. But you may face other pressures (such as being targeted by NGOs) that cause you to intentionally describe due diligence more broadly. In these cases, be prepared to accept a higher IPSA cost.

L AW RE N CE HE IM

Independent Private Sector Audits The CMR’s structure and content has important implications for the breadth and depth of your IPSA. Keep it focused but with sufficient detail so an auditor can form an appropriate opinion. Write your CMR such that RCOI activities are clearly separate and distinct from due diligence measures undertaken.

030



Managing Director Elm Sustainability Partners, LLC

Separate RCOI and Due Diligence.

Create separate headings in the CMR for RCOI activities and results, design of due diligence framework, due diligence measures undertaken, and results of the due diligence. Doing so makes clear what sections of the CMR the auditor should review and audit.

Audit Readiness/Pre-Audits.

Because of the specific IPSA objectives, there are few situations where it is worth paying a third party to perform audit readiness assessments or pre-audits in our view. Using your IPSA auditor to also do preparation work (beyond standard audit planning) creates impairments to auditor independence and should be avoided altogether. Instead, consider training your Internal Audit staff on the IPSA specifics and have them help prepare you.

Ensure Documentation is Available.

Make sure documentation is available that clearly demonstrates that the due diligence measures described were conducted.

Engage Your Auditor Now. A total of six IPSAs were conducted for RY2014, only three by US auditors. With actual IPSA experience extremely scarce, engage an experienced auditor now to ensure you are locked into their schedule early. If you are concerned about the uncertainty of the IPSA for CY2015, structure the engagement terms to convert it to a consulting engagement where that is possible. Or make sure you fully understand what costs you will incur should you cancel the IPSA engagement.



031

Most companies still have significant work to do fleshing out and tightening up their program design documentation to support the first audit objective under the Rule.

Expert Opinion

MI CH A E L L I T T E NB E R G Partner Schulte Roth & Zabel LLP

It is unlikely that an IPSA will be required for calendar 2015. At press time, the April 29, 2014 Statement by the SEC continues in effect. (In that Statement, the SEC indicated, among other things, that, pending further action, an IPSA will not be required unless a company voluntarily elects to describe a product as “DRC conflict free” in its Conflict Minerals Report.) Although the D.C. Circuit Court of Appeals declined to conduct an en banc review of the panel decision that the requirement to describe products as having “not been found to be DRC conflict free” is compelled speech that violates the First Amendment, the litigation is not yet over. The case has been remanded to the District Court to take action consistent with the appellate court decision. The SEC also has until early February 2016 to seek to have the decision revisited by the Supreme Court. The audit stay is likely to remain in effect at least until the litigation is closer to resolution, and more likely until the litigation has run its course. In any case, the SEC also has informally acknowledged that issuers would need advance notice of a change in existing staff guidance. Notwithstanding the appellate court's decision and the continuing stay of the mandatory IPSA requirement, given the potential for an audit, most of my clients are continuing to prepare for one, albeit at a measured pace. Most companies still have significant work to do fleshing out and tightening up their program design documentation to support the first audit objective under the Rule. This should be job one in preparing for an audit. As part of this exercise, any deficiencies in program design also should be identified and remediated. Even in the absence of an audit, this is a useful exercise, since a well-documented program will make it easier to measure performance and transition the compliance function internally. The exercise of documenting program design also requires a critical look at the compliance program, which will enhance program effectiveness and efficiency. With almost 6 months until the next filing is due, most companies are not yet spending much time thinking about their calendar 2015 filing. However, with a view to continuing to move disclosure towards an auditable format and testing the effectiveness of documentation procedures, there is benefit to giving some thought now to the description of the due diligence measures performed for the year that will be included in the CMR, which are the subject of the second IPSA audit objective. There is flexibility in the description.

032



It is not premature to develop an auditor strategy.

The art to this disclosure for many companies will be including enough detail to demonstrate a credible due diligence process and address at least some NGO and socially responsible investor concerns (and in some cases customer expectations), while at the same time managing audit scope and cost if and when an IPSA is required.

of an audit, this somewhat mechanical exercise will better align disclosure with emerging market practice and NGO expectations.

In my view, given the appellate court's decision and the continuing uncertainty around the IPSA requirement, it is premature for companies to retain an auditor. However, it is not premature to In addition, for this year’s filing, continue develop an auditor strategy. Many of my clients intend to interview between moving other CMR disclosure toward three and five audit firms, typically an audit-ready format. If not done last their existing financial statement year, plan on compartmentalizing the CMR so that the portions that are within auditor, a Big 4 and/or a national or the scope of the IPSA are separate from regional non-Big 4 CPA firm that does other disclosures, such as the discussion not perform their financial statement of the RCOI, in-scope product categories, audit, and one or two non-CPA firms that could provide an IPSA under the smelter and refiner information and planned activities to mitigate risk. Com- performance audit standard. Meeting with multiple audit firms will provide partmentalization of CMR disclosure greater visibility on both price and was fairly widespread for calendar audit process, which will differ among 2014, although not universal, and was audit firms since this continues to be much more common than for the prior an evolving area. It also will enable a year. However, even for companies quicker auditor selection if and when an that compartmentalized disclosure for calendar 2014, there is usually room for audit is required. further refinement. Even in the absence



033

Conflict Minerals FAQ Publicly Held Companies What is considered sufficient due diligence to meet Dodd-Frank 1502? The SEC rule Dodd-Frank 1502 and associated guidance is not particularly prescriptive in nature. Rather it just simply specifies one must use a nationally or internationally recognized framework for due diligence. This offers a bit of flexibility in terms of selection and implementation of due diligence actions. You can pick and choose based on what is most appropriate given the characteristics of your supply chain and what is most likely to succeed given your company’s business culture. What is the difference between company level and product level reporting? Company-level reporting should cover all the information a company has collected from its supply chain. For product-level, the response would cover a specific product

034



or set of products, all which have the same metal content and origin. For example, if a company sold two products, one containing Tin and one without, their company-level conflict minerals reporting template (CMRT) would say yes to question one and question two. Their product-level CMRT would be two separate documents, one for the product containing Tin and the other answering no to question one and question two.

and component numbers as suppliers are identified further upstream. Building off your existing relationships with your suppliers will be important so that you can trace to the product level. How often should we be verifying smelter information with our factories? How can we verify the information that we are given from our factories is correct? For example, if our factory purchases several components independently to make one component, how can the information be verified as correct with so many companies involved? We’d recommend that the information be verified at least before each new Conflict Minerals Reporting Template (CMRT) is prepared/submitted. The situation you describe is also a good example of why having an electronic or web-based solution for data collection makes this process significantly more manageable.

Source Intelligence has an expansive data warehouse of supplier declarations and public, non-public smelter/refiner information. Do we need annual certifications from each in-scope supplier? This really depends on how much risk your company is willing to assume. Supply chains are not static in nature. Suppliers are constantly changing, manufacturers are constantly looking for process improvements to make production more effective, and design engineers are always looking for ways to improve upon product performance and everybody wants to cut costs. Slight modifications to product design or production could impact scope applicability. Unless you can be sure that nothing has changed within a supply chain, your safest bet is to renew supplier conformance to policies and certifications on at least an annual basis.

How do we trace conflict minerals to the product level? Traceability will become more challenging as more detailed information is required of your suppliers. What your suppliers call products are what you may call parts or components, and you may refer to them in different ways than your suppliers. The same is true all throughout the supply chain. This is where having a robust data management system will be invaluable. Being able to match reference numbers to products, parts and the suppliers associated with each will be necessary for productlevel tracing. There are details that have to be worked out such as the ability to link part



035

Conflict Minerals FAQ When I asked my factory for supplier information, they gave me the name of the local supplier they buy material from, but it is just their local supplier. More than likely they will not be able to get any information as to where their local supplier gets material. How do I report this? This is a common problem. In many cases, local suppliers or even distributors do not have the data or information necessary for reporting - whether you are reporting to the SEC or a customer. Further engagement is necessary to determine the ultimate source of the materials regardless of the supply chain tier. Third party software that engages with thousands of suppliers may already have the information or could track down the data needed. Remember that for reporting year 2014 you can still file as Undeterminable so identifying the country of origin does not have the same sense of urgency as it will next year. Once you have a chance to catch your breath from all the work needed to complete your paperwork, it will be a good idea to understand what gaps exist in your processes. These gaps might prevent you from identifying all of your smelters, and more importantly knowing who is not certified as Conflict Free, and where they are sourcing. What are the core elements and issues to consider in extending the conflict minerals regulation into an integrated, comprehensive, product regulatory compliance process and applications suite? (e.g. conflict minerals, REACH, RoHS, etc). Some of the core elements include data collection, data validation, risk assessment and reporting. One of the primary core issues

is the ability to link regulated materials to suppliers at multiple tiers within a supply chain. A challenge we have found is that part / product nomenclature varies as a material travels up and down a supply chain, which makes traceability tricky. When a supplier says they do not know their smelters and refuses to provide further information, what can a brand do can do? The key with suppliers is persistence and education. 1. Explain the need 2. Why it is important to your brand 3. Educate around the policy and science of the issue. We have found consistently that education and awareness improve supplier response rates and quality of data. Also keep it simple. If you make the process simple for suppliers to comply - that helps too. Click a button and upload. Or fill out the template once and push out to numerous customers. For each of your suppliers, it helps to find the right point of contact. The person that you reach out to when it is time to place a new order of widgets is probably not the same person you want to talk to when it comes to finding out where the tantalum in that widget comes from. Just as within our organizations there is a go to person for each type of question, the same is true of your suppliers.

Should we list actual Smelter names used in Form SD? In reviewing the filings from last year, there was a bit of variation in terms of what should be included on the Form SD and what should go in the CMR. Over 70% did not submit any smelter information, however, these companies have recently taken some heat from articles in the New York Times as well as from Amnesty International. The one thing we would emphasize is to keep your due diligence actions separate from the RCOI actions because it is the only due diligence information contained in your CMR that is subject to the IPSA. So, if you want to keep your audit scope small, and your costs low, then keep the information separate.

Privately Held Companies What are our obligations as a small, privately held company? Fortunately for you, you are not required to prepare documents that must be filed with the SEC. However, you may have customers that do have to file conflict

minerals Form SD or CMRs with the SEC, which means those customers may come to your company for information about the use and origin of 3TG in the products you supply. This is a common challenge. Even though you do not legally have to comply, your customer does and it requires you to get up close and personal with your supply chain. As a privately held supplier, what options exist aside from full template/ smelter reporting and what is required to provide those? As a privately held supplier, you are likely receiving requests from customers that are publicly traded. Unfortunately the Conflict Minerals Reporting Template (CMRT) developed by the Conflict-Free Sourcing Initiative is the gold standard for conflict minerals reporting. It is used pretty much used exclusively by public and private companies. What you can do however is find a way to automate the use and population of your template. For instance, if you are collecting multiple templates from suppliers you then want to roll-up into a template for your customer, find a computer-based or cloud-based tool, such as Source Intelligence to help you do that. It will save a ton of time and money.

Conflict Minerals FAQ

My suppliers do not have to comply with Dodd-Frank 1502 so they say they do not intentionally do anything wrong, but will not tell me their smelters. I also do not have to comply, but I have customers that do. What do I tell them? If you have customers that have to comply with Dodd-Frank 1502, it means that they will come to you for information. That means you will have to provide the information yourself. If you do not have it - such as smelter data - you will have to reach out into your supply chain for the data. If you are have having trouble engaging you suppliers, try using an outside party to help with engagement efforts. Engagement can be very time consuming so you may need additional resources to help successfully engage to get the data you need to report back to you customers.

038



As distributor of many products, what am I required to provide my customers? If you are a privately held supplier, you are not required to prepare documents that must be filed with the SEC. However, you may have customers that do have to file conflict minerals Form SD or CMRs with the SEC, which means those customers may come to your company for information about the use of 3TG in the products you supply. As a distributor you likely manage a large volume of products, but are not involved in the manufacture of those products. As a result, you may need to go back to the suppliers of those parts and products to obtain the information needed.

Source Intelligence

+1 877.916.6337

1921 Palomar Oaks Way Suite 205

www.sourceintelligence.com

Carlsbad, CA 92008

[email protected]

Copyright © 2016 Source Intelligence