This statement is made in accordance with the requirements of the Modern Slavery Act 2015 (the Act) as they apply to Sophos Limited, and all entities in the Sophos Group plc global structure (Sophos, or the Group).
Sophos is committed to compliance with the provisions of the Act. As such, the Group has a zero-tolerance approach to modern slavery and we are further committed to acting ethically, transparently and with integrity in all of our business dealings and relationships. The Group has prioritised the implementation and ongoing enforcement of effective systems and controls to ensure modern slavery, including any instance of hidden labour exploitation, is not taking place anywhere in our own business or in any of our supply chains.
Business and supply-chain
Sophos is a leading global provider of cloud-enabled enduser and network security solutions, focussing primarily on selling to mid-market organisations (100 – 5,000 employees) and the channel that serves them. The Group’s products are sold through our relationships with more than 20,000 channel partners who deliver to more than 175,000 sales representatives and 65,000 sales engineers. Sophos has approximately 3,000 employees and although headquartered in the UK, it has 40 offices and a number of threat assessment labs and product development centres around the world, including in Asia Pacific, Europe, the Middle East and North America.
The Group’s supply chain in this context consists of approximately 9,000 organisations made up of hardware manufacturers and suppliers, logistic fulfilment centres responsible for the distribution of our products, procurement vendors and recruitment and employment agencies from whom Sophos employees may be sourced (each a Supplier and together the Sophos Supply Chain). Sophos also has close working relationships with works councils in a number of overseas jurisdictions representing the interests and rights of our employees.
We consider that the principal areas in which Sophos faces risks related to slavery, include:
- the Sophos Supply Chain and outsourced activities and in particular those Suppliers located in overseas jurisdictions identified through our human development risk index management tool as higher risk, in accordance with the principles set out by Transparency International, the Global coalition against corruption;
- recruitment in our own business, particularly recruitment through agencies; and
- any Supplier that is identified through the Human Trafficking Risk index (the HTR Index). The HTR Index provides Sophos with insights into where potential human trafficking may exist using external corporate databases with more than 250 million records and incorporates data from the International Labor Affairs Bureau and the U.S. Department of State. The HTR Index creates an automated, repeatable, closed-loop process to proactively monitor the Sophos Supply Chain for potential human trafficking violations.
Our policies
The Sophos Group plc board (the Board) acknowledges the Group’s role in ensuring slavery and human trafficking is not taking place in its business or its supply chains. The development of our policy and operational response to the requirements of the Act have been a matter for consideration at Board meetings.
The Sophos Group Anti-Slavery and Human Trafficking Policy (the Policy) has been developed in recognition of the Group’s new responsibilities set out in the Act, and applies to the Sophos Supply Chain and to all persons working for us or on our behalf in any capacity, including employees at all levels, directors, officers, agency workers, seconded workers, volunteers, interns, agents, contractors, external consultants, third-party representatives and business partners.
The Board has overall responsibility for ensuring the Policy complies with our legal and ethical obligations, and that all those under our control comply with it. The Policy sits alongside the existing Sophos Anti-Corruption and Bribery Policy.
The Group’s existing structure of risk management provides the necessary framework to support the Group’s compliance with the requirements of the Act, primarily through oversight from the Risk and Compliance Committee (the RCC).
The Policy was adopted by the Board in April 2016, and will shortly be rolled out to the Group’s employees and the Sophos Supply Chain on a risk assessment basis, primarily focussing on relevant high-risk business functions such as Facilities, HR, Procurement and Supply Chain, and high-risk Suppliers, identified via the means set out above. A breach of the Policy would result in disciplinary action, and potential dismissal for an employee, and the likely termination of our relationship with a Supplier.
All those subject to the Policy are encouraged to raise concerns about any issue or suspicion of modern slavery in any parts of our business or supply chains or those of any current or potential Suppliers, at the earliest possible stage. Sophos aim to encourage openness and will support anyone who raises genuine concerns in good faith under the Policy, even if they turn out to be mistaken. Further, the Group are committed to ensuring no one suffers any detrimental treatment as a result of reporting in good faith their suspicion that modern slavery of whatever form is or may be taking place in any part of our own business or in any of our supply chains. All notifications received, together with the identity of the notifier, will be treated as confidential.
Assessment of risk
The Group’s preliminary assessment of risk in this context, and the subsequent potential therefore for exposure to instances of modern slavery, has been based upon business function and geography, together with the principles set out by Transparency International, the Global coalition against corruption and including all parties being assessed against the HTR Index. Sophos has undertaken this risk assessment with input from external stakeholders. The Group’s conclusion has been that the potential for non-compliance with the Act should be assessed as part of the Group’s risk management process.
The formal process for identifying, evaluating and managing significant risks faced by the Group is overseen by the RCC, in association with the work performed by the Internal Audit and Risk Management function. The RCC provide the business with a framework for risk management, upward reporting of significant risks and policies and procedures. The Group takes a two pronged approach to risk identification: (i) a bottom-up approach at the business function level; and (ii) a top-down approach at the senior leadership team level. All identified risks are assessed against a pre-defined scoring matrix and prioritised accordingly. Any risks identified in the bottom-up approach deemed to be rated as higher risk are escalated in line with pre-defined escalation procedures for further evaluation.
Procedures
This statement has been published in accordance with, Section 54 of the Act, as it applies to Sophos Limited, a commercial organisation that carries on business in the UK, supplying goods and services and having a total annual turnover of £36 million or more, and all entities in the Sophos Group plc global structure. This statement sets out the steps that have been taken during the financial year to ensure that modern slavery is not taking place in the Sophos Supply Chain and in any part of our own business. The statement has been signed by Nick Bray, a Director of Sophos Limited and Chief Financial Officer and Executive Director of Sophos Group plc, and published on our website with a clear link on the homepage.
Suppliers: we take one or more of the following actions in respect of each Supplier:
- we ensure that we can account for each step of our hardware manufacturing processes and that we know who is providing the hardware to us that we resell. This is done by using BOMcheck. BOMcheck is an industry-wide regulatory compliance tool which is offered by ENVIRON, and identifies companies that are part of the Sophos extended supply chain that supply components for our hardware products to our immediate Suppliers. Once identified these companies are then run through our human trafficking index management tool. This provides the business with extended supply chain information and data sources, to support our modern slavery controls;
- we inform our Suppliers that we are not prepared to accept any form of exploitation in their business or any part of their supply chain by publishing our policy and statement on our website;
- we complete Live Monitoring on all companies in the Sophos Supply Chain, and any anti-bribery or modern slavery changes for a specific Supplier will trigger an immediate review and business assessment / investigation;
- our standard supply chain contract templates and contracts that we negotiate with high-risk Suppliers contain anti-slavery provisions which prohibit Suppliers and their employees and sub-suppliers from engaging in modern slavery; and
- we conduct regular risk assessments of our Sophos Supply Chain. In cases of high risk, we audit the Supplier and, as appropriate, we require them to take specific measures to ensure that the risk of modern slavery is significantly reduced.
Recruitment: we take the following actions:
- We always ensure all staff have a written contract of employment and that they have not had to pay any direct or indirect fees to obtain work;
- We always ensure staff are legally able to work in the country in which they are recruited;
- We check the names and addresses of our staff (a number of people listing the same address may indicate high shared occupancy, often a factor for those being exploited);
- We provide information to all new recruits on their statutory rights including sick pay, holiday pay and any other benefits they may be entitled to;
- If, through our recruitment process, we suspect someone is being exploited, the HR department will follow our reporting procedures; and
- We conduct due diligence checks on any recruitment agency that we use to ensure that it is reputable and conducts appropriate checks on all staff that they supply to us.
Actions and due diligence
Proportionate training will shortly be provided to existing Group employees and new joiners, prioritising the relevant high-risk business functions. Training will be supplemented by a suite of internal communications and the existing online resource facility which is available to all Group employees. Future refreshment will be provided, as appropriate.
ince November 2015, Sophos’s standard supply chain contracts have been updated to include modern slavery compliance provisions, and similar provisions have been included in negotiated contracts with new high-risk Suppliers when first entering in to a business relationship with the Group.
In respect of existing Suppliers identified as high-risk, the Group introduced updated compliance requirements and put in place contract amendments. Such amendments brought the compliance requirements in line with those introduced for new Suppliers, outlined above. All high-risk Suppliers identified entered in to such contract amendments during 2016 and have therefore committed to full anti-bribery and modern slavery compliance, at the Group’s request.
Effectiveness and performance review
The Board was keen to understand whether at the time the Policy was adopted, the Group would be able to do so with adequate knowledge of the current compliance status of its Sophos Supply Chain.
In order to gain this comfort, the Group has engaged an external compliance data provider on an ongoing basis, to audit the Sophos Supply Chain. All new Suppliers are subject to screening as part of the Group’s existing due diligence processes. However, as a standalone exercise, the existing Sophos Supply Chain population was screened for any recorded anti-bribery or modern slavery breaches, and/or related reports in the media globally. The Board is pleased to confirm that no recorded anti-bribery or modern slavery breaches, and/or related reports in the media globally were identified in respect of any Supplier.
However, the Group is committed to keeping the existing Sophos Supply Chain population under review. Together with our external compliance data provider, the Group will monitor the performance of the Policy, together with the Sophos Anti-Corruption and Bribery Policy and will maintain a watching brief on the compliance of all Suppliers through live monitoring tools. Any alert raised through this process will be subject to an internal review and where appropriate, a business investigation of the Supplier identified.
In the event an instance of slavery is identified in a business in the Sophos Supply Chain, the Group will require that immediate remedial action be taken, and provide appropriate support to that end. Should the Supplier ultimately fail to resolve the situation to the Group’s satisfaction, their contract would be terminated.
The Board do not believe that the Group’s key performance indicators for the financial year ending, 31 March 2017 make the business or the Sophos Supply Chain vulnerable to modern slavery. However, this will be kept under ongoing review, and reassessed each year.
Conclusion
The Group’s position and approach to managing our compliance with the Act continues to evolve. However, we are pleased with the measures taken to date, and the processes now in place to ensure this will be kept under regular and effective review. The Board delegated approval of this statement on its behalf to the Chief Financial Officer of the Company, on 8 November 2016.
Nick Bray
Director, Sophos Limited
Chief Financial Officer and Executive Director, Sophos Group plc
30 November 2016