Corruption Risk Management CRM RISK DOCUMENT JANUARY 2019

Corruption Risk Management (CRM) RISK DOCUMENT JANUARY 2019 TCC@2019. ALL RIGHTS RESERVED 1

Table of contents Contents 1 Organisation context Strategic Objectives and Key Processes Potential corruption risks 2 Risk Map 3 Summary of Risks 4 Summary of Action Plans 5 Risk Registers TCC@2019. ALL RIGHTS RESERVED Pages 2

Organisation Context: Strategic Objectives and Key Processes Risk. Doc-01 Strategic Objectives Increase public usage by 20% p. a. Plan, design and implement the development strategy with local government of a high technology park Enhance efficiency by implementing ICT (technology)-based processes Product innovation Develop new designs (2 new designs per year) through research and development projects Create an efficient and dynamic working environment with integrity and good governance Key Processes linked to strategic goals Project management (construction, procurement) ICT management R & D process Human resource management Financial management Potential Corruption Risks (linked to key processes) Abuse of power in tendering - Loose contract to favour an interested sub-contractor Specification of ICT equipment was intentionally catered for interest party Leakage of R&D information to competitors Misuse of discretion and authorization for offices in foreign countries Management over-write for payment of incomplete work Collusion among site managers and checkers to certify noncompliance structure Collusion with suppliers to supply low quality parts Bribery to government officials to register the patents/ trademarks Hiring of “own” people to smooth the tendering and awarding of contracts False claims Bribery to government officials for approval of unsafe building designs Use of middleman TCC@2019. ALL RIGHTS RESERVED Waiver of job rotation for key positions le p m a x ee tiv a r st Illu 3

Risk. Doc-02 Risk Map - Corruption risks Kementerian Pertahanan RISK MAP – 31 March 2019 Almost certain No. 1 12 Likely 8 Moderate 3 5 Unlikely 2 11 6 7 10 9 4 Rare Insignificant Key: Minor Low TCC@2019. ALL RIGHTS RESERVED Moderate Major Significant 1 Leak of tender specification to cater for favouring party 2 Loose legal and contractual terms to allow for significant variance orders 3 Political interference 4 Price fixing 5 Bid rigging 6 Use of middleman 7 Collusion with site manager 8 Bribery to government officials 9 False claims 10 Management over-write for payment of incomplete work 11 Collusion with suppliers 12 Waiver of job rotation for key positions Catastrophic High Corruption risks 4

Risk. Doc-03 Summary of Risks Corruption risks Impact Likelihood Inherent risk rating Complex contractual structure Major Moderate Leak of tender specification to cater for favouring party Major Abuse of power in tendering Control Effectiveness Impact Likelihood Residual risk rating Risk Treatment? Impact Likelihood High Some weakness Moderate Signifcant Reduce Likely High Weak Major Likely High Reduce Major Likely High Weak Major Likely High Reduce Catastrophic Likely High Some weakness Major Moderate High Reduce Price fixing Major Likely High Satisfactory Moderate Unlikely Moderate Accept Bid rigging Major Likely High Satisfactory Moderate Unlikely Moderate Accept Use of middleman Major Likely High Some weakness Moderate Significant Reduce Collusion with site manager Moderate Likely Significant Satisfactory Moderate Unlikely Moderate Accept Bribery to government officials Major Moderate High Satisfactory Moderate Unlikely Moderate Accept False claims Major Moderate High Satisfactory Moderate Unlikely Moderate Accept Political interference TCC@2019. ALL RIGHTS RESERVED 5

Risk. Doc-04 Summary of risk action plan Risk action plans 1 To consider legal actions to enforce terms in the integrity pact (recovering costs and termination of contract). 2 To conduct detailed background checks on joint ventures and agents 3 To develop policies over the prohibition of using agent or middleman 4 To consider an Anti-corruption Policy in the company 5 To implement Integrity Pledge by all staff TCC@2019. ALL RIGHTS RESERVED Responsibilities Legal Dept Procurement Finance Target Date for detailed risk action plans 30 September 2017 6

RISK REGISTER TCC@2019. ALL RIGHTS RESERVED 7

RISK REGISTER Risk ID Risks MOD-001 Use of middle man to bribe public officials MOD-002 Abuse of power in tendering TCC@2019. ALL RIGHTS RESERVED Pages 8

Risk. Doc-05 Risk Register (Steps 1, 2, 3) Risk ID Risk title: 001 Use of middle man to bribe public State: India official Corrupt Payments authorised for agents to Department Project practices engage sub-contractors in India Management ly n Risk Category Operational o e pl m a Causes Consequences Ex 1. Incompetent staff to manage India operations, thus forced to use middleman. 2. Local culture of facilitation payments to get process moving 3. Payment of cash to be favoured for business 4. Political interference Impact Major TCC@2019. ALL RIGHTS RESERVED Likelihood Likely Financial loss due to misappropriate or illegal use of funds - a total of $15 mil paid to agent and undisclosed amount paid to polticians 1. Identify Corruption risk 2. Analyse root causes 3. Analyse consequences and determine Inherent risk rating Reputation damage - International breach of law and regulation which may lead to reputational shame and debarment (loss opportunity $250 Mil) Inherent risk rating High 9

Risk. Doc-05 Risk Register (Steps 4, 5, 6, 7) Existing Controls Internal audit over anti-corruption controls (1, 2, 3, 4) Whistle blowing hotline (2, 3, 4) ly e pl Additional Controls/ Action Plans on am x E Control Effectiveness To conduct detailed background checks on joint ventures and agents (2, 3) To develop policies over the prohibition of using agent or middleman (2, 3, 4) Impact Likelihood Some weakness Impact Likelihood Moderate 4. Identify controls 5. Evaluate control effectiveness: Satisfactory Some weakness Weak Some weakness Residual rating 6. Residual risk rating Significant Risk Treatment Option : o o o Terminate Reduce Risk Accept TCC@2019. ALL RIGHTS RESERVED 7. Risk treatment options 10

Risk. Doc-05 Example – Risk action plan RISK Use of middle man to bribe public official Risk analysis RISK ID: q Controllable q On-going Interconnect to other risks? q Uncontrollable q Discrete Litigation Poor quality q Combination Risk Treatment Strategy: o o o 001 Risk Category: Operational Risk Owner: Project management Terminate Assessment date: Next assessment date: Reduce Risk 31 March 2017 Accept Impact: Moderate Likelihood: Moderate Risk Rating: Significant Target Impact: Moderate Target Likelihood: Unlikely Target Risk Rating: Moderate High level action plan to be considered Responsibility Target date for detailed plan 1. To conduct detailed background checks on joint ventures and agents (2, 3) Project management 31 October 2017 Legal CEO Office 2. To develop policies over the prohibition of using agent or middleman (2, 3, 4) 3. TCC@2019. ALL RIGHTS RESERVED 11

Risk #2: Abuse of power in tendering Risk ID Risk title: MOF-002 Abuse of power in tendering State: Corrupt practices Department Risk Category Causes 1. Internal control weaknesses: Consequences Financial loss Reputation loss a) Delegation of authority not clear b) Lack of monitoring by IA c) Conflict of interest – no policy Litigation d) Weak HR management – job rotation Quality and safety compromised e) Low salary Low staff morale 2. Collusion with suppliers, employees a) Internal control weakness – taking advantage b) Culture of accepting corruption – personal gain 3. Financial pressure of the staff Impact Major TCC@2019. ALL RIGHTS RESERVED Likelihood Likely Inherent risk rating HIGH 12

Risk #2: Abuse of power in tendering Risk ID: MOF_002 : Abuse of power in tendering Existing Controls Delegation of Authority – policy Procurement committee and policy SOP – delegation of authority; procurement; conflict of interest Policy – job rotation; recruitment Training and communication to staff Segregation of duties in key controls areas Integrity pact – contractors and suppliers Declaration of assets – all staff Control Effectiveness Additional Controls/ Action Plans To consider an Anti-corruption Policy in the company Integrity pledge by all staff Impact Likelihood Some weakness Impact Major Likelihood Unlikely Some weakness Residual rating Significant Risk Treatment Option : o o o Terminate Reduce Risk Accept TCC@2019. ALL RIGHTS RESERVED 13

Risk action plan RISK ID: Abuse of power in tendering Risk analysis q Controllable q On-going q Uncontrollable q Discrete MOF-002 Interconnect to other risks? q Combination Risk Treatment Strategy: Risk Category: Risk Owner: o o o Terminate Assessment date: Next assessment date: Reduce Risk Accept Impact: Major Likelihood: Unlikely Risk Rating: SIGNIFICANT Target Impact: MODERATE Target Likelihood: UNLIKELY Target Risk Rating: MODERATE High level action plan to be considered Responsibility Target date for detailed plan 1. To consider an Anti-corruption Policy in the company 2. Integrity pledge by all staff 3. 4. 5. TCC@2019. ALL RIGHTS RESERVED 14

End of Document TCC@2019. ALL RIGHTS RESERVED 15