Advanced Case Studies in Largescale Contract Remediation 1

Advanced Case Studies in Large-scale Contract Remediation 1

• What is contract remediation? – Company has a problem involving a lot of contracts – Contracts must be reviewed to determine if they are affected by the problem – If affected, an action must be taken to remedy the problem – For new contracts, processes must be put in place to ensure new contracts are not affected by the problem Now lets hear some real life stories. . . 2

Contracts Remediation in the Aftermath of an FCPA Investigation Laurence Houlbert Senior Manager and Leader, Third Party Program Pentair 3

AGENDA • Presentation of Pentair • Third-Party Program Background & Context (Tyco days) • Third-Party Program Design • Third-Party Program Implementation – Must-Dos, Challenges, & Statistics • Contracting Remediation Process – Phases & Challenges 4

PENTAIR – A FEW NUMBERS $6. 4 Billion ~28, 000 6 EMPLOYEES CONTINENTS ANNUAL REVENUE ~100 500+ 60+ MANUFACTURING FACILITIES PRODUCT LINES SERVICE CENTERS • An S&P 500 Diversified Industrial Company 5

FOUR GLOBAL OPERATING SEGMENTS VALVES & CONTROLS Designs, manufactures, markets, and services valves, fittings, automation and controls, and actuators for the Energy and Industrial verticals. 2015 SALES (BILLIONS) $1. 8 FLOW & FILTRATION SOLUTIONS Designs, manufactures, markets, and services solutions for the toughest filtration, separation, flow, and fluid management challenges in agriculture, food and beverage processing, water supply and disposal, and a variety of industrial applications. 2015 SALES (BILLIONS) $1. 4 WATER QUALITY SYSTEMS TECHNICAL SOLUTIONS Designs, manufactures, markets, and services innovative water system products and solutions to meet filtration and fluid management challenges in food and beverage, water, swimming pools, and aquaculture applications. Designs, manufactures, markets, and services products that guard and protect some of the world’s most sensitive electronics and electronic equipment, as well as heat management solutions designed to provide thermal protection to temperature sensitive fluid applications, and engineered electrical and fastening products for electrical, mechanical and civil applications. 2015 SALES (BILLIONS) $1. 4 2015 SALES (BILLIONS) $1. 8 6

FOUR GLOBAL OPERATING SEGMENTS 29% Valves & Controls 22% Flow & Filtration Solutions 21% Water Quality Systems 28% Technical Solutions $6. 4 B PENTAIR 2015 SALES BY VERTICAL 2015 SALES BY REGION 30 Residential & Commercial 27 Industrial 25 Energy 10 Food & Beverage 08 Infrastructure 54 US & Canada 22 Developing 18 Western Europe 06 Other developed 7

DELIVERING VALUE ACROSS FIVE GROWTH VERTICALS We Combine Our Global Perspective and Product Expertise to Serve Customers Across Five Verticals Through Which We Go to Market ENERGY INDUSTRIAL FOOD & BEVERAGE INFRASTRUCTURE RESIDENTIAL & COMMERCIAL • Oil & Gas • Power • Mining • Chemical/Process • Pharmaceutical • Manufacturing • Agriculture • Aquaculture • Food & Beverage Processing • Food Service • Municipal • Telecommunications & Networks • Transportation • Residential • Commercial • Recreation & Leisure 8

THIRD-PARTY PROGRAM CONTEXT • Tyco scandals in early 2000 – CEO and CFO stole millions + $50 m SEC settlement around FCPA violations by newly acquired company in 2003. • DOJ requirements to strengthen internal Ethics & Compliance programs. • Third Party Management Program at Tyco: – Designed by a team of dedicated employees; efforts led by the Chief Compliance Counsel. – Objective: “a comprehensive program to gain better control over the activities of third parties”. – Key to success? Top-level support from CEO, board and audit committee. – Step 1: Existing population - Assess current 3 P relationships, identify high risk relationships, go through 7 qualifying steps. – Step 2: 3 P Program launched in August 2009 across the company, implementation of financial controls. 9

THIRD-PARTY PROGRAM CONTEXT • October 2012 merger between Tyco Flow Control & Pentair. • DOJ non-prosecution agreement in place for Flow Control business. Due to expire Sep 2015. • Pentair’s decision to implement 3 rd Party Program for Pentair globally. Program implementation date for Pentair Global: July 2013. • Program objectives for Pentair – strengthened preventive controls: – Due-Diligence – compliance risk mitigation, increased likelihood of working with ethical partners – Strong contract management – Alignment across corporate functions & operations, better protection for Pentair, reduced litigation risks 10

THIRD-PARTY PROGRAM DESIGN RELATIONSHIP TYPE LOCATION “CORRUPTION PERCEPTION INDEX” ANNUAL TRANSACTION VOLUME RISK PROFILE DRIVES QUALIFICATION REQUIREMENTS • 3 determinants of risk that drive program requirements 11

THIRD-PARTY PROGRAM DESIGN – RETENTION STEPS Step 1 Step 2 Step 3 Business Sponsor and Third Party provide retention and business information Third party risk assessed. If needed, investigative due diligence is performed Complete thirdparty training and written agreements If required 90 days to complete 1 a – Business Sponsor form 2 a – Level 1: Risk Scoring or Media Assessment 3 a – Third-Party Training 1 b – 3 P questionnaire & compliance certification 2 b – Level 2: Enhanced Due Diligence (EDD) 3 b – Third-Party Contract Ok to transact • Steps required are defined by a Third-Party’s risk profile 12

PROGRAM IMPLEMENTATION – NEW vs. EXISTING New July 2013 Train Business Sponsors Train Controllers July 2014 Confirm document templates, optimize process timing December 2014 Launch NEW financial controls Launch EXISTING financial controls Existing Business Sponsors / Third parties complete Written Agreements (if required) Third parties complete Anti-Bribery Certification & Training (if required) Business Sponsors confirm ownership and data in Tool Remaining high-risk third parties undergoing Due Diligence investigation 100 high risk third parties were inactivated during Rationalization Forensics partner scored third parties. 664 scored high risk. Businesses identified 20, 835 third parties Underway Complete 13

PROGRAM IMPLEMENTATION MUST-DO's • • • Clear communications about expectations, Tone at the Top. Strong Training programs: – Aligned with implementation phases – On-site training sessions, target material to audience – Focus on WHY then WHAT then HOW Active support function – Helpdesk, local 3 PP resources Alignment with each stakeholder – Business, Finance, Legal and Compliance teams: – Across GBUs, across regions – Critical during contract remediation phase Existing third party data gathering – rationalization process: – Clear instructions, close monitoring/support to local team – Inaccurate / incomplete data may lead to incorrect evaluation of risk – In-Scope decision IT Management: – Adequate tool to support the Program: Approval workflows, data & document tracking, reporting, data analysis – Support from IT / Database team • Program Management/Support Infrastructure 14

PROGRAM CONTINUITY - CHALLENGES • • Continued awareness around the Program: – Ongoing training, address recurring issues, Helpdesk support Leadership support vs Business and third-party push-backs Process alignment - Each GBU operating independently; different business models, structure and leadership Miscommunication and/or misunderstanding risk & relationships: – Relationship misclassification – Out of scope third parties submitted Change Management process: – Correction of risk vs non-risk information (relationship, legal name) – Change of situation (business sponsors, volume of transaction, status, legal structure) IT / Database support: – Ongoing improvement and maintenance efforts (Change Management tool) – IT Controls - user management, backup and recovery plan Ongoing Program Maintenance: – Improvement opportunities - Alignment with business needs, simplified instructions • Large scale remediation challenges 15

PROGRAM IMPLEMENTATION - NUMBERS December 2014 Third parties Total Active 3 Ps High/Med Risk (DD) In scope for contract Contracts in place (drafted & existing) Contract Completion (incl. exemptions) Existing 11, 200 1, 600 5, 300 200 42% (2, 200) Flow/New 18, 900 1, 500 5, 300 3, 900 94% (5, 000) Total 30, 100 3, 100 10, 600 4, 100 68% (7, 200) Today (August 2016) Third parties Total Active 3 Ps High/Med Risk (DD) In scope for contract Contracts in place (drafted & existing) Contract Completion (incl. exemptions) Existing 9, 500 1, 200 4, 000 2, 000 93% (3, 700) Flow/New 18, 900 3, 500 6, 100 4, 600 96% (5, 900) Total 28, 400 4, 700 10, 100 6, 600 95% (9, 600) • Number of Active third parties decreased significantly: – Inactivation, incorrectly classifications • Evolution of Contract scope & completion % 16

PHASES & CHALLENGES • • • Phase 1 – Document Collection Efforts – Identify existing contracts in place. Where are they, how do we collect them? – Identify accountable owners for contracts. Phase 2 – Identify third parties in scope for contract – Risk focused determination, relationship types & standard agreements review – Decision to exempt some populations of third parties Phase 3 – Scope and steps for remediation – Identify scope for remediation and wanted outcome, build workflow together with Legal – Focus on commercial, compliance risk & DOJ requirements Phase 4 – Localization Efforts – Identify regional/country specific needs, including specific Legal requirements – Draft new agreements and/or compliance addendums, upon alignment with Legal Phase 5 – Put in place Remediation team – Identify resources needed – internal vs external, based on available skills 17

PHASES & CHALLENGES (Cont’d) • • • Phase 6 – Monitor Progress – Monitor each step, discuss progress on a regular basis, with all team members – Identify potential road blocks, address immediately (see “Challenges” below) – Discuss and re-evaluate timeline, as needed Ongoing communications – Communicate progress & due dates to all people directly or indirectly impacted – Request active support from leadership Challenges – Delay in sponsor’s action, particular focus on due dates – Contract language (legal entity country vs third-party country) – External partners communications & push-backs – Reconsideration of compliance verbiage needed – Ongoing change management review - ended relationships, reclassifications, etc. – Misevaluation of risk, impacting remediation scope (case by case exemption requests) – Misevaluation or disregard for GBU contracting policies 18

CONTRACTING PROCESS - TODAY • 6, 600 active third parties (new and existing) have a valid contract in place • Contract templates covering 12 relationship types • Standard approved templates available in 19 languages, for 42 jurisdictions • 193 standard templates in dual languages (local language & English) • Contract negotiations managed through escalation guidelines & push back options for compliance verbiage • Close collaboration between Compliance teams, regional & GBU counsels & Operations teams. 19

AVAILABLE RESOURCES • http: //fcpacompliancereport. com/2011/12/tycos-seven-step-process-for-thirdparty-qualification/ • http: //www. navigant. com/~/media/WWW/Site/Insights/Disputes%20 Investiga tions/Tyco_Third_Party_Risk_Disputes_Investigations. pdf (Sep 2011) • http: //blogs. wsj. com/riskandcompliance/2014/01/16/the-business-of-riskscandal-prompted-tycos-compliance-turnaround/ • http: //mydigimag. rrd. com/article/How+Compliance, +Ethics+%26+Leadership+S aved+Tyco/1439064/0/article. html • DOJ non-prosecution agreement: http: //www. gibsondunn. com/publications/Documents/Tyco_2012_NPA. pdf 20

The Rules of the Game Have Changed – Now What? A Post Safe-Harbor Contract Remediation Project Jacqueline Davis Vice President & Deputy General Counsel VMware, Inc. 21

Breaking News. . . Sa fe 6 October 2015 The European Court of Justice declares “Safe Harbor” to be an invalid mechanism to protect the transfer of personal data outside of the European Economic Area Ha rbo r 22

Inside the VMware Situation Room • Like 5000+ other US companies, VMware opted for Safe-Harbor certification • Unclear if/when we’d see a Safe Harbor 2. 0 (now known as Privacy Shield), leaving two choices: – EU Model Contract Clauses OR Binding Corporate Rules • Clock is ticking . . . End of JANUARY 2016: After this date, US companies that relied on Safe Harbor could face enforcement risk (per Article 29 Working Party) DECISION: EU Model Clauses 23

Big Picture: A Vendor Contract Remediation Project KEY ELEMENTS KEY CONSIDERATIONS WHO? Which business units are impacted? Who are our vendors? Any other internal (or external) stakeholders impacted? WHAT? What needs to be done (what is the goal)? What vendor agreements are in scope? Any other actions we need to take? Do we have incremental budget? WHEN? What is the timeline? Is there a deadline to complete? Milestones? Penalties for delay? WHERE? Any restrictions on where the work must be performed (onshore / offshore, internal vs external)? And finally HOW? This is where the fun really begins. . . 24

Big Picture: The Project Plan Phased approach • Phase 1: Assessment, across all lines of business • Phase 2: Update selected vendor contracts, via amendment Resource strategy • A combination of in house, outside counsel, and LPO resources • For external resources, leverage efficiencies from existing relationships (access, knowledge, existing team) • Heavy emphasis on LPO (extended “in house bench”) • Assign end-to-end responsibility Goal • A comprehensive remediation effort – to serve multiple objectives 25

Phase 1 Preparation: The In House Counsel “To-Do” List Client Focus Contract Team (or LPO) Focus ü Identify Business Units ü Secure point of contact and driver from each BU ü Compile list of vendors, by BU (hint: leverage Finance) ü With BU, identify the EU personal data each vendor is processing and how it is handled – and winnow list ü Gather relevant contracts ü Develop instructions q Draft EU Model Clause Checklist q Develop spreadsheet for use by reviewers ü Coordinate resourcing with other Legal teams (shared resources) ü Set project timeline (sign SOW, if applicable) ü Prepare & deliver training ü Kick-off with internal Business Clients 26

Phase 1: Contract Review Workflow Assign Vendor to “DPA/EUMC” list No further action No No With BU compile list of Vendors 1 Does Vendor handle personal data? Yes 2 Are data protection terms adequate? Review Vendor contract for data protection terms (EUMC Checklist) and complete spreadsheet Yes No further action Yes 3 Determine data export mechanism vendor used EUMC 4 Is EUMC signed & up to date? Review EUMC for compliance (EUMC template) Safe Harbor Assign Vendor to “EUMC” list No 27

Phase 2 Preparation: Contract Update Workflow Validate the List (Vendor and Contract(s) to be Amended) Sort the List (and Prioritize): • General Quality Check • Sanity Check with Internal Business Client • Third Party Check (Finance Spend Report) • Yellow – Send out contract • Orange – More investigation • Red – Special handling required Four Categories • Green – No further action Prepare Tracker and Assign a Resource • Contracts Project Team (or LPO) • Outside Counsel • In House Counsel • Strategic Sourcing / Business Initiate Contract Cycle • Prepare contract and communications templates • Add vendor contact information to tracker • Create general instructions and training • Prepare escalation guidelines • Set schedule and milestones; create dashboard for reviews 28

VENDOR PROJECT INITIATING ASSESSING Tracking Report Support Services BU BU CONTRACT REVIEW SEND EUMC Strategic Real Estate Finance Marketing Sourcing BU 1 BU 2 BU 3 BU 4 Designated contact person [name] [name] [name] Contact made (yes/no) yes yes Vendor contracts collected? yes in progress yes yes TBD yes Status / Comments / Roadblocks -- -- -- # Vendors (handling personal data) 12 12 23 2 22 381 M L 60% 100% Estimated Contract # ( Low / Med / High) Completion % 80% 40% OVERALL STATUS RENEGOTIATE ASSESSING RENEGOTIATE COMPLETE RENEGOTIATING COMPLETE HR Partner [name] yes yes yes Strategic Sourcing yes -- -- -- 139 4 25 402 10 35 40% 80% 20% 0% 40% CONTRACT REVIEW H 80% 20% CONTRACT INITIATING RENEGOTIATE REVIEW CONTRACT REVIEW

What We Delivered Phase 1 Review Line of Business Strategic Sourcing (incl. Marketing and REW) # of Agreements # of Vendors 9028 500+ Lines of Business 70 70 Finance & HR N/A 6295 Professional Services 1387 396 10, 000+ 7000+ TOTAL # of Vendors Engaged for Amendments (Phase 2): 342 Total Time (Phases 1 & 2): 16 Weeks Post Project Follow Ups: ü Close out letters to Vendors ü Repository cleanup ü Contract cleanup ü Vendor cleanup ü Revamp new vendor process & existing vendor management process 30

Biggest Challenges Issue Perceived as a “Legal” project Comments Engaging business resources proved difficult (no direct revenue impact) Significant pre-work with Business Identifying all the impacted business units and stakeholders, and then understanding the vendor strategy and data handling practices, was a project in and of itself. Also, it was difficult to assess scope of vendor activities without significant business involvement Complex legal issues Required extensive upfront training, plus several checkpoint meetings early on to course correct. Also, not all vendors were up to speed on the issue (or in agreement on remediation path) Timing Constrained timeline that overlapped with fiscal year end No compelling economic event to incent vendors to engage in a Incentives for vendors contract amendment cycle and sheer number meant there were some stragglers, found we needed a strategy to bring closure Collecting contracts / identifying vendors Discovered early on that several business units were not storing contracts in centralized location, following consistent administration practices, or tracking vendors, requiring a major cleanup effort. 31

What We Learned Ø Follow the money Ø Anticipate the “cleanup” activities – and fold into the project plan Ø End-to-end management by the front line team (whether LPO or internal contracts team) creates great efficiencies Ø Critical to have an early checkpoint to assess / recalibrate Ø With high volume, multi-phase project, it helps to break down steps into more discrete tasks (dashboard friendly), to manage tracks in parallel, and apply checkpoints and reassess priorities 32

Managing Supplier Mergers, Spinoffs and Other Supplier Transitions Suchitra Narayen VP, Legal and Associate General Counsel Oracle 33

Establishing a Supplier Relationship • Legal/Financial: • Financial “health check” • Contract • Legal entity structure • Tax ID • Business: • Qualifying products/services • Systems set up • Engagement between account teams, business reviews etc. 34

Why Can’t Things Stay the Same? Example: Avago 1961 HP semiconductor division 1999 spun off as part of Agilent 2005 • Agilent division sold to form Avago Technologies • Avago I/0 division sold to PMC-Sierra 2009 Avago buys division of Infineon 2009 Avago acquires Cyn. Optics 2013 Avago acquires LSI 35

Why Can’t Things Stay the Same? Example: Avago cont’d 2014 • LSI SSD controller division sold to Seagate • LSI networking division sold to Intel • Avago acquires PLX 2015 Avago acquires Emulex 2016 • Avago acquires Broadcom + name change • Microsemi acquires PMC-Sierra • Avago sells Emulex division to Aspeed And this is just ONE example! 36

Managing Supplier Transitions Must identify and manage supplier transitions proactively • Oracle legal team and LPO monitor news/public announcements • Status updates included in regular contract updates prepared by LPO • Need to start planning BEFORE you (customer) get the formal consent to assignment from the supplier • Need to analyze and manage legal and business impact of transition 37

Managing Supplier Transitions cont’d 1. Who are we dealing with • Competitor • Foreign ownership • Corporate structure and contracting entity 2. When: Effective date for merger/spinoff 3. How: structure of acquisition/spinoff • Is a spun off business going to be a standalone entity or is it being acquired by another company? • Who will be responsible for issues (warranty/IP etc. ) arising from products and services provided before the transaction closes? 38

Managing Supplier Transitions cont’d 4. Which contract(s) potentially apply after the transaction closes • Coverage for supplier, supplier affiliates, customer and customer affiliates • Consent/listing/acknowledgment requirements to add entities • Coverage for current portfolio of products and services provided by that supplier • Alignment to your (customer’s) current policies and business requirements 39

Managing Supplier Transitions cont’d 5. Steps to be Taken • Analyze impact on overall relationship (see prior slides) • Analyze impact on pending transactions: for example, confirm contracting entity • Identify and implement actions to provide contract coverage for supplier, supplier affiliates, customer and customer affiliates • Consent/listing/acknowledgment requirements to add entities • Managing assignments in partial spinoffs • Stock vs. asset transfers 40

Managing Supplier Transitions cont’d • Update contract repository • Update entity designations • Consolidate or separate contracts and related records • Clearly identify currently operative contract(s) vs. legacy contracts • Provide legal support as needed to manage business changes • Contract obligation to provide EOL notice • Right to change products, pricing etc. • Termination and post-termination rights • Identify required contract changes to align with current products/services/business requirements 41

Lessons Learned • Know the business and context in which you provide legal support: Both legal team and LPO must know the supplier base and actively follow business news about suppliers • Be proactive and consistent in analyzing and managing supplier transitions • Clear roles and responsibilities between legal team and LPO • Emphasize to legal team that “ownership” of a supplier relationship or contract includes ongoing lifecycle management • LPO can assist per established process and roles and responsibilities but is not independently responsible for managing the transition • Change management issues for both internal business clients and 42 legal team relating to “loss” of supplier responsibility