Compliance

voestalpine requires that all of its companies and its employees in all countries, where voestalpine operates, comply with all laws. For voestalpine, however, compliance is more than merely acting in accordance with the law and other external regulations. It is the expression of a corporate culture built on ethical and moral principles. The principles of this corporate culture for dealing with customers, employees, and other business partners have been explicitly set forth in the voestalpine Code of Conduct.

voestalpine likewise requires that its suppliers fully comply with all applicable laws in their respective countries and particularly respect and comply with human rights as fundamental values.

Code of Conduct

The Code of Conduct covers the following areas:

• Compliance with laws and other external and internal regulations
• Fair competition
• Corruption/bribery/acceptance of gifts
• Money laundering
• Respect and integrity
• Conflicts of interest
• Handling of corporate information/ confidentiality
• Corporate communications
• Use of the Internet and IT
• Insider information
• Reporting of misconduct

The Code of Conduct applies to all members of the Management Board, CEOs, and employees of all companies in which voestalpine AG has a direct or indirect stake of at least 50% or which it controls in any other way. With regard to all other companies, in which voestalpine AG has a direct or indirect stake of at least 25%, but which it does not control, the Code of Conduct is brought to their attention and they are requested to enforce it by way of independent recognition thereof by their decision-making bodies that are governed by corporate law.

In the event of a violation against statutory provisions, internal guidelines, regulations, and directives or against provisions of the voestalpine Code of Conduct, employees will be subject to disciplinary measures. Furthermore, violations can have consequences under criminal and/or civil law, e.g., recourse claims and claims for compensatory damages. voestalpine is pursuing the goal of having the Code of Conduct apply throughout its sphere of influence. Suppliers and consultants are required to comply with the Code of Conduct for Business Partners. Additionally, Group companies are urged to bring the Code of Conduct to the attention of their customers and to strongly encourage them to commit to compliance therewith. All of voestalpine’s business partners are also requested to promote compliance with the Code of Conduct among their own business partners along the entire supply chain.

voestalpine AG has adopted several Group guidelines to serve as a helpful tool in applying the Code of Conduct: The compliance rules and regulations associated with the voestalpine Code of Conduct are currently comprised of the following sections:

Business conduct

These guidelines are an expansion and concretization of the Code of Conduct with regard to the subjects of corruption / bribery / acceptance of gifts / conflicts of interest / and regulate, for example, permissibility of gifts, invitations and other benefits, donations, sponsoring, ancillary activities, and the private purchase of goods and services from customers and suppliers by voestalpine employees.

Furthermore, the prohibition of political contributions is set forth under “Business conduct.” Donations to politicians, political parties, organizations affiliated or associated with political parties, or political front organizations are not tolerated in the voestalpine Group. Donations to political front organizations that are devoted solely to social issues are excepted; however, they must be approved by the Management Board of voestalpine AG in each individual case.

Group Directive related to dealings with business intermediaries/brokers and consultants

This guideline provides additional information on the topics of corruption, bribery, and acceptance of gifts. It defines the procedure to be complied with prior to contracting or engaging sales representatives, representatives, or other sales consultants. An objective analysis of the prospective business partner’s business environment and scope of activities prior to establishing business relations is required, in order to ensure that the business partner can comply with all applicable laws and the voestalpine Code of Conduct.

Antitrust law

This guideline describes the prohibition of agreements restricting competition, provides rules for dealings and interaction with and in associations, professional associations, or other industry organizations, and defines concrete rules of conduct for employees of the voestalpine Group.

Additionally, handbooks have been developed on the topics of information sharing and benchmarking, buying collaborations, and supply relationships with competitors, which provide employees with information on these topics from an antitrust perspective.

Compliance Manual / Compliance Prevention Program

These rules and regulations provide information about compliance strategy, compliance structure, prevention measures, detection of and reaction to violations, sanctions, and the web-based whistle-blower system.

Code of Conduct for voestalpine Business Partners

These rules and regulations that are directed toward business intermediaries, consultants, and other business partners define the principles and requirements for doing business with voestalpine.

voestalpine requires from its business partners that they respect and comply with human rights as fundamental values in accordance with the European Convention on Human Rights and the UN Charter on Human Rights. In particular, this applies to the prohibition on child and forced labor, equal treatment of employees, and the right of employee representation and collective bargaining.

Compliance system

The management of the respective Group company is responsible for adherence to the compliance regulations. A compliance system was set up in the voestalpine Group in the business year 2011/12 to support management in meeting this responsibility and to set up the necessary processes.

In addition to a Group compliance officer, a compliance officer was appointed in each division; furthermore, additional compliance officers were appointed in certain divisional sub-units. The Group compliance officer reports directly to the Chairman of the Management Board and is independent and not bound by directives. The divisional compliance officers report to the Group compliance officer and to the respective heads of the divisions.

The compliance officers are responsible for the following areas:

• Antitrust law
• Corruption
• Capital market compliance
• Fraud (internal cases of theft, fraud, embezzlement, or breach of trust)
• Conflicts of interest
• Special issues that are assigned to the compliance officers by the Management Board of voestalpine AG (e.g., UN or EU sanctions)

All other compliance issues, e.g., environmental law, taxes, accounting, labor law, protection of employees, or data protection and privacy are not part of the compliance officer’s area of responsibility. These compliance issues are handled by the respective specialist departments.

Preventive measures

Within the scope of its compliance efforts, voestalpine places particular importance on preventive measures, including training, discussions with management, and communication. Since 2002, CEOs, sales personnel, and other employees have been sensitized to antitrust law.

Since the introduction of e-learning courses in the voestalpine Group (antitrust law since 2009; Code of Conduct since 2012), more than 30,000 employees of the voestalpine Group have completed e-learning courses on the Code of Conduct and antitrust law (including refresher course). Roll-out of an advanced course on antitrust law began in April 2016.

Completed e-learning courses since 2012

* e-learning courses on antitrust law have been offered since 2009

In addition to the e-learning courses, target-group oriented face-to-face training has been carried out Group-wide, especially for sales employees. This training is focused on compliance with the law and internal guidelines as well as corruption and antitrust law in the respective sphere of activity of the participants.

Extensive compliance training is mandatory for young executives: there are six to seven training sessions each year for up to 40 employees. Additionally, face-to-face training on the topic of capital market compliance is also provided for employees of voestalpine AG.

Furthermore, compliance is a regular topic in Group communications and is often mentioned—including by top management—at major employee events at both the Group and the divisional level.

Reporting of compliance violations

Reports of compliance violations should primarily be made openly, that is, providing the whistleblower’s name.

According to the Code of Conduct, such reports can be made to the direct supervisor, the appropriate legal or HR department, management of the respective Group company, the audit department of voestalpine AG, or one of the Group’s compliance officers. Upon request, whistleblowers are ensured of absolute confidentiality.

In 2012, a web-based whistleblower system was launched that enables employees to file anonymous reports about violations. Reports using this system can be made only in the areas of antitrust law, corruption, fraud, and conflicts of interest, in other words, only reports on these issues are processed through this system.

The system enables compliance officers to communicate with whistleblowers while maintaining absolute anonymity.