Compliance

voestalpine requires its companies and all of its employees to comply with all laws in all of the countries in which it operates. For voestalpine, however, compliance means more than just acting legally and in accordance with other external requirements. It is the expression of a culture that is also rooted in ethical and moral principles. The principles of this corporate culture as it relates to the treatment of customers, suppliers, other business partners, and employees are spelled out in the voestalpine Code of Conduct.

Likewise, voestalpine requires its suppliers to comply, without limitation, with all applicable laws in the respective country and, in particular,to respect and uphold human rights as fundamental values.

Code of Conduct

The Code of Conduct covers the following areas:

• Compliance with laws and other external and internal requirements
• Fair competition
• Corruption, bribery, acceptance of gifts
• Money laundering
• Respect and integrity
• Conflicts of interest
• Handling of corporate information, confidentiality
• Corporate communications
• Use of the Internet and IT
• Insider information
• Reporting of misconduct

The Code of Conduct applies to all members of the management boards, the managing directors, and the non-executive employees of all entities in which voestalpine AG has a direct or indirect interest of at least 50% or which it controls in some other way. As regards all other companies in which voestalpine AG has a direct or indirect stake of at least 25% but does not control them, the Code of Conduct is brought to their attention with the request that they enforce it by having their corporate decision-making bodies recognize it of their own volition.

Every employee must reckon with disciplinary consequences if they violate statutory provisions, internal guidelines, regulations, and instructions, or the provisions of voestalpine’s Code of Conduct. Moreover, violations may also have consequences under criminal and/or civil law, e.g., claims to compensation and claims for damages.

voestalpine aims to have the Code of Conduct apply throughout its sphere of influence. Suppliers and consultants are required to comply with the Code of Conduct for Business Partners. Additionally, Group companies are required to bring the Code of Conduct to the attention of their customers and, if possible, to require them to comply with it too. All of voestalpine’s business partners are also requested to reasonably promote compliance with the Code of Conduct among their own business partners along the supply chain.

voestalpine AG has adopted several Group guidelines that serve as a helpful tool for employees in applying the Code of Conduct. The compliance rules and regulations associated with the voestalpine Code of Conduct currently comprise the following:

Business Conduct

These guidelines supplement and flesh out the Code of Conduct with respect to issues of corruption, bribery, acceptance of gifts, and conflicts of interest. For example, they regulate the permissibility of gifts, invitations and other benefits; donations and sponsoring; secondary employment as well as the private purchase of goods and services by voestalpine employees from customers and suppliers. The section entitled “Business Conduct” also addresses the prohibition of political contributions. The voestalpine Group does not allow donations to politicians, political parties, organizations affiliated with political parties, or political front organizations. This does not apply to political front organizations that are devoted solely to social issues and have been individually approved by the Management Board of voestalpine AG.

Dealings with Brokers and Consultants

This guideline contains additional supplementary information on issues of corruption, bribery, and the acceptance of gifts. It defines the procedure to be complied with prior to engaging sales representatives, agents, and other marketing consultants. An objective analysis of business partners’ environment and scope of activities before establishing business relationships with them serves to ensure that the business partners also comply with applicable laws and the voestalpine Code of Conduct.

Antitrust Law

This guideline (most recently revised in April 2019) describes the prohibition of agreements restricting competition; provides rules for dealings with trade associations, professional organizations as well as other sector organizations; and establishes specific rules of conduct for all employees of the voestalpine Group. Additionally, manuals have been developed with respect to issues of information sharing and benchmarking, procurement alliances, and supplier relationships with competitors; they provide employees with information on these topics from an antitrust perspective.

Compliance Manual & Prevention Program

These rules and regulations provide information on the Group’s compliance strategy; the compliance structure; measures aimed at preventing, identifying, and responding to violations; sanctions; and the Web-based whistleblower system.

Code of Conduct for voestalpine’s Business Partners

The rules and regulations that are directed toward suppliers of goods and services as well as toward brokers, consultants, and other business partners define the principles and requirements for doing business with voestalpine. Among other things, voestalpine requires its business partners to respect and comply with human rights as fundamental values in accordance with the European Convention on Human Rights and the UN Charter.

In particular, this applies to the prohibition of child and forced labor; the prohibition of human trafficking in any way, shape, or form; the equal treatment of employees; and the right to employee representation and collective bargaining.

Compliance system

The responsibility for adherence to Compliance regulations rests with the respective management. A compliance system was established in the voestalpine Group in the business year 2011/12 to support management in fulfilling its responsibility and set up the processes required to this end.

Aside from a Group Compliance Officer, a compliance officer was appointed in each division; additional compliance officers were appointed in certain divisional units. The Group Compliance Officer reports directly to the Chairman of the Management Board and is not bound by instructions. The divisional compliance officers report to both the Group Compliance Officer and the respective division heads.

The compliance officers are responsible for the following areas:

• Antitrust law
• Corruption
• Compliance with capital market regulations
• Fraud (internal cases of theft, fraud, misappropriation, or embezzlement)
• Conflicts of interest
• Special topics assigned to the compliance system by the Management Board of voestalpine AG (e.g., in connection with issues related to UN or EU sanctions)

All other issues of compliance—e.g., environmental law, taxes, accounting, labor law, protection of employees or data—are not part of the compliance officers’ sphere of responsibility. These compliance issues are handled by the respective departments.

Preventive measures

As part of its compliance activities, voestalpine places particular importance on preventive measures including, in particular, education and training, discussions with management, and communications. As a result, managing directors, sales personnel, and other employees have attended face-to-face training that is aimed at sensitizing them to issues of antitrust law since 2002.

Employees of the voestalpine Group have completed more than 56,000 e-learning courses on the Code of Conduct and antitrust law (including refresher and advanced courses) since e-learning courses were introduced in the voestalpine Group (antitrust law from 2009, Code of Conduct from 2012).

The existent e-learning courses on antitrust law (including an advanced course and a course on the Code of Conduct) were revised and updated in the business year 2018/19.

In addition to the e-learning courses, face-to-face training tailored to target groups has been carried out especially for sales and marketing personnel. This face-to-face training was generally focused on compliance with the law and internal guidelines as well as on corruption and antitrust law as it applies to the participants’ respective sphere of activity.

Compliance training is mandatory for young executives: six to seven training sessions are conducted per year for up to 40 employees each. Face-to-face training on issues of compliance with capital market regulations is also provided to employees of voestalpine AG.

Furthermore, compliance is a regular topic in Group communications and is addressed repeatedly—including by top management—during major employee events at the level of the Group and the divisions.

Reporting compliance violations

Reports of compliance violations should be made openly for the most part, i.e., providing the whistleblower’s name. Pursuant to the Code of Conduct, such reports may be directed to the individual’s direct supervisor; the appropriate legal or human resources department; the management of the respective Group company; Internal Audit of voestalpine AG; or one of the Group’s compliance officers. Upon request, whistleblowers are ensured of absolute confidentiality.

Furthermore, an option to anonymously report violations via a web-based whistleblower system has been available since 2012. Reports using this system may be filed solely with respect to antitrust law, corruption, fraud, and conflicts of interest; put differently, only reports on these issues are processed through this system. The system makes it possible for the appropriate compliance officers to communicate with whistleblowers while maintaining absolute anonymity.