esg whistle blower procedure.pdf

Check Point’s Whistle Blower Procedure

Introduction

Check Point is leading provider of cyber security solutions to corporate enterprises and governments globally. Our goodwill and reputation are affected by what we do every day. Our Code of Ethics and Business Conduct sets out the business practices that we follow and sets clear standards of behavior. Check Point strives to promote its values and establish uniformity within the company. Our employees and business partners are expected to adhere to and follow the standards and principles we set. In order to support the adherence to our Code of Ethics and Business Conduct as well as other policies, we provide different channels for reporting, which include the Whistle Blower Procedure herein. This is crucial for our high standards and values.

Our Whistle Blower procedure is in accordance with requirements set in Section 301 of the Sarbanes-Oxley Act of 2002, Rule 10A-3 of the Securities Exchange Act of 1934, the German Whistleblower Protection Act (Hinweisgeberschutzgesetz – HinSchG). It applies to Check Point and all its subsidiaries. Any prohibited conduct reported shall be handled by the Ethics Committee.

Types of Concerns to be Reported

  1. Any complaints or concerns regarding questionable accounting, internal accounting controls or auditing matters; or
  2. Any matters of legal or regulatory concerns as set forth in the Company’s Code of Ethics and Business Conduct as well as any applicable whistleblower protection legislation, including the following:
    a) All forms of corruption and bribery: corruption of government officials in any form; payments of bribes of any kind; any business-related payments by or to Check Point personnel which were not authorized in advance by Check Point; any undisclosed commissions (or a commission in excess) to a third party for obtaining any business.
    b) Any forms of harassment and sexual harassment.
    c) Any illegal conduct, including law violations subject to fines, insofar as the violated regulation serves to protect life, limb, health or the rights of employees or their representative bodies;
    d) Fraud, money laundering or misappropriation of funds.
    e) Any financial irregularity.
    f) Any failure to comply with, or breach of, legal or regulatory requirements.
    g) Any failure to comply with the Company’s policies, procedures and codes.
    h) Any complaints or concerns regarding breaches of EU law or national laws implementing the EU law, including the laws implementing the EU Directive 2019/1937, including breaches that affect the public interest, including, inter alia: public procurement; financial services, products and markets and prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; protection of privacy and protection of personal data security of networks and information systems.

Procedure for Reporting

  1. Any Check Point employee, former employee, contractor, supplier or third party may report his or her concern or complaint on a confidential and anonymous basis (if permitted by applicable law) (the “Reporter”).
  2. Complaints and concerns that are in accordance with this procedure may be filed through the contact information and the reporting channels provided below.
  3. The report will be directed to the Ethics Committee, who shall send a formal acknowledgement to the Reporter within 7 days of the receipt of the concern or complaint.
  4. The Ethics Committee shall review to determine if the reported concern or complaint falls within the scope of applicable whistleblower protection legislation or whether to commence an investigation for any other reason.
  5. In instances where the report is made anonymously, the information provided is insufficient and it is not possible to probe the Reporter for more information, the Ethics Committee may decide not to investigate the report.
  6. For as long as the identity of the Reporter is known, the Reporter will be informed on the procedures and the steps that are taken in accordance with his or her report. The Reporter will be given information about the status of the investigation process no later than within 3 (three) months following the receipt of the concern or complaint.
  7. The investigation shall be managed by the Ethics Committee. In conducting an investigation of a report, the confidentiality of the Reporter shall be maintained to the fullest extent possible, if desired and if permitted by applicable law.
  8. The Ethics Committee shall report the findings of the investigation to the Audit Committee.
  9. The Ethics Committee will keep records of the written reports and steps that were taken, including the investigation process, all findings of fact, conclusions and proposed recommendations for remedy. The data will be anonymized or deleted in accordance with Check Point’s applicable retention policy.
  10. As appropriate, Check Point shall take such disciplinary steps, legal proceedings or other procedures that shall be required based on the Ethics Committee’s findings and recommendations.

Information to be Included in a Report

  1. Any report submitted should contain the facts forming the basis of such Reporter’s belief.
  2. The report should be sufficiently detailed to ensure a clear understanding of the issues raised.
  3. The report shall set forth all the information the Reporter knows regarding the allegation or concern, including the identity of the individuals involved.
  4. If the report contains only unspecified unsupported allegations and the Reporter does not provide sufficient information upon additional inquiry, it may not result in the commencement of an investigation.

Contact Information for Reporting

Any matter addressed in this Policy may be reported to:

Protection and Support

  1. Check Point does not tolerate retaliation of any kind (including dismissal, transfer, demotion) against a Reporter, including indirect forms of discrimination, such as negative performance evaluations, lack of promotion or negative references.
  2. In case of legal proceedings concerning defamation, breach of copyright, breach of secrecy obligations, breach of data protection regulations, disclosure of trade secrets or for claims based on private law, public law or collective labor law, the liability of the Reporter could be excluded, provided that there are well-founded reasons for considering the whistleblowing report as a “necessary disclosure”.
  3. Our managers shall hold special responsibility to listen, act and handle any complaints and concerns that were reported directly to them, and shall support any of the Reporters that desire to file a report in accordance with this procedure.
  4. The processing of personal data regarding the whistle-blower will be carried out in compliance with EU legislation (Regulation n.679/2016).
  5. Any Reporter shall have the option to remain anonymous when reporting a concern and the confidentiality shall be kept to the fullest extent permitted by applicable law. This relates to the period that the investigation is in progress and will apply also in the event the disclosure is later found to be untrue, provided that the Reporter had reasonable grounds to believe that the violation was true.
  6. In case the Reporter believes the complaint has not been handled properly through the internal reporting channel, he/she is welcome to contact the General Counsel who will try and resolve and/or report the matter as she deems fit.
  7. In special cases and to the extent required, the General Counsel may direct a Reporter to comprehensive information and advice on available retaliation protection procedures and remedies; legal aid in cross-border criminal and civil proceedings; and/or to financial assistance and support, including psychological support in legal proceedings.