Compliance

voestalpine requires its companies and all its employees to comply with all laws in all the countries in which it operates. However, for voestalpine compliance is more than merely acting legally and in accordance with other external regulations. It is the expression of a culture built on ethical and moral principles. The principles of this corporate culture as it relates to the treatment of customers, suppliers, employees and other business partners are explicitly stated in the voestalpine Code of Conduct.

voestalpine likewise requires that its suppliers fully comply with all applicable laws in their respective countries, and they are particularly requested to respect and uphold the fundamental values of human rights.

Code of Conduct

The Code of Conduct covers the following areas:

• Compliance with laws and other external and internal regulations
• Fair competition
• Corruption/bribery/acceptance of gifts
• Money laundering
• Respect and integrity
• Conflicts of interest
• Handling of corporate information/ confidentiality
• Corporate communications
• Use of the Internet and IT
• Insider information
• Reporting of misconduct

The Code of Conduct applies to all members of the Management Board, CEOs, and employees of all companies in which voestalpine AG has a direct or indirect stake of at least 50% or which it controls in any other way. With regard to all other companies in which voestalpine AG has a direct or indirect stake of at least 25%, but which it does not control, the Code of Conduct is brought to their attention and they are requested to enforce it by way of independent recognition thereof by their decision-making bodies that are governed by corporate law.

In the event of a violation against statutory provisions, internal guidelines, regulations and directives, or against provisions of the voestalpine Code of Conduct, employees will be subject to disciplinary measures. Furthermore, violations can have consequences under criminal and/or civil law, e.g., recourse claims and claims for compensatory damages.

voestalpine is pursuing the goal of having the Code of Conduct apply throughout its sphere of influence. Suppliers and consultants are required to comply with the Code of Conduct for Business Partners. Additionally, Group companies are urged to bring the Code of Conduct to the attention of their customers and to strongly encourage them to commit to compliance therewith. All of voestalpine’s business partners are also requested to promote compliance with the Code of Conduct among their own business partners along the entire supply chain.

voestalpine AG has adopted several Group guidelines to serve as a helpful tool for employees in applying the Code of Conduct. The compliance rules and regulations associated with the voestalpine Code of Conduct are currently comprised of the following sections:

Business Conduct

These guidelines are an expansion and concretization of the Code of Conduct with regard to the subjects of corruption/bribery/acceptance of gifts and conflicts of interest and regulate, for example, permissibility of gifts, invitations and other benefits, donations, sponsoring, ancillary activities, and the private purchase of goods and services from customers and suppliers by voestalpine employees. Furthermore, the prohibition of political contributions is set forth under “Business conduct”. Donations to politicians, political parties, organizations affiliated or associated with political parties, or political front organizations are not tolerated in the voestalpine Group. Donations to political front organizations that are devoted solely to social issues are excepted; however, they must be approved by the Management Board of voestalpine AG in each individual case.

Dealings with business intermediaries/brokers and consultants

This guideline provides additional information on the topics of corruption, bribery, and acceptance of gifts. It defines the procedure to be complied with prior to contracting or engaging sales representatives, representatives, or other sales consultants. An objective analysis of the prospective business partner’s business environment and scope of activities prior to establishing business relations is required, in order to ensure that the business partner can comply with all applicable laws and the voestalpine Code of Conduct.

Antitrust law

This guideline describes the prohibition of agreements restricting competition, provides rules for dealings and interaction with, and in, associations, professional associations, or other industry organizations, and defines concrete rules of conduct for employees of the voestalpine Group. Additionally, handbooks have been developed on the topics of information sharing and benchmarking, buying collaborations, and supply relationships with competitors, which provide employees with information on these topics from an antitrust perspective.

Compliance Manual/Compliance Prevention Program

These rules and regulations provide information about compliance strategy, compliance structure, prevention measures, detection of and reaction to violations, sanctions, and the web-based whistleblower system.

Code of Conduct for voestalpine Business Partners

These rules and regulations that are directed towards suppliers of goods and services, as well as business intermediaries, consultants, and other business partners, and define the principles and requirements for doing business with voestalpine.

voestalpine requires from its business partners that they respect and comply with human rights as fundamental values in accordance with the European Convention on Human Rights and the UN Charter on Human Rights. In particular, this applies to the prohibition on child and forced labor, equal treatment of employees, and the right of employee representation and collective bargaining.

Compliance system

The management of the respective Group company is responsible for adherence to the compliance regulations. A compliance system was set up in the voestalpine Group in the business year 2011/12 to support management in meeting this responsibility and to set up the necessary processes.

In addition to a Group compliance officer, a compliance officer was appointed in each division; furthermore, additional compliance officers were appointed in certain divisional sub-units. The Group compliance officer reports directly to the Chairman of the Management Board and is not bound by directives. The divisional compliance officers report to the Group compliance officer and to the respective heads of the divisions.

The compliance officers are responsible for the following areas:

• Antitrust law
• Corruption
• Capital market compliance
• Fraud (internal incidences of theft, fraud, embezzlement, breach of trust)
• Conflicts of interest
• Special issues that are assigned to the compliance officers by the Management Board of voestalpine AG (e.g., UN or EU sanctions)

All other compliance issues, e.g., environmental law, taxes, accounting, labor law, protection of employees, or data protection are not part of the compliance officer’s area of responsibility. These compliance issues are handled by the respective specialist departments.

Preventative measures

Within the scope of its compliance efforts, voestalpine places particular importance on preventative measures, including training, discussions with management, and communication. Since 2002, CEOs, sales personnel, and other employees have attended courses sensitizing them to antitrust law.

Since the introduction of e-learning courses at the voestalpine Group (antitrust law from 2009; Code of Conduct from 2012) more than 53,000 employees of the voestalpine Group have completed e-learning courses on the Code of Conduct and antitrust law (including refresher and advanced courses).

Additionally, an e-learning refresher course on the Code of Conduct with a focus on corruption was rolled out in the business year 2017/18, and is designed for those employees who have already completed the basic compliance training on the Code of Conduct. The course was issued to around 14,500 employees, and by the end of March 2018 it had already been completed by roughly 12,000 employees.

In addition to the e-learning courses, target-group oriented, face-to-face training has been carried out Group-wide, especially for sales employees. This training was focused on compliance with the law and internal guidelines as well as corruption and antitrust law in the respective sphere of activity of the participants.

Compliance training is mandatory for young executives: there are six to seven training sessions each year for up to 40 employees. Additionally, face-to-face training on the topic of capital market compliance is also provided for employees of voestalpine AG.

Furthermore, compliance is a regular topic in Group communications and often mentioned– including by top management–at major employee events at both the Group and the divisional level.

Reporting of compliance violations

Reports of compliance violations should primarily be made openly, that is, providing the whistleblower’s name. According to the Code of Conduct, such reports can be made to the direct supervisor, the appropriate legal or HR department, management of the respective Group company, the audit department of voestalpine AG, or one of the Group’s compliance officers. Upon request, whistleblowers are ensured of absolute confidentiality.

Since 2012 it has also been possible to anonymously report violations via a web-based whistleblower system. Reports using this system can be made only in the areas of antitrust law, corruption, fraud, and conflicts of interest, in other words, only reports on these issues are processed through the system. The system enables compliance officers to communicate with whistleblowers while maintaining absolute anonymity.