U.K. Modern Slavery Act 2015 Transparency Statement 2023

This Sophos 2023 Transparency Statement (the “Statement”) is provided pursuant to Section 54 of the Modern Slavery Act 2015 (the Act)i, and other related legislation, as it applies to Sophos Limited, a commercial organization that does business in the UK and worldwide, supplying goods and services having a total annual turnover of £36 million or more, and all entities in the Sophos Group global structure (together “Sophos” or the “Group”). This peer-reviewed Statement sets out the steps that have been taken during the fiscal year ending 31 March 2023 (FY23) to ensure that modern slavery is not taking place in the Sophos Supply Chain or in any part of Sophos business.

This Statement has been signed by Kris Hagerman, Chief Executive Officer, on behalf of Sophos Group Companies and has been published on the homepage of the Group’s website and on the Sophos Trust Center.

Sophos continues to prioritize the establishment and implementation of effective systems and controls described in the Sophos Modern Slavery Policy (the “Policy”), originally adopted in 2016 and updated during the past fiscal year, reflecting Sophos’ commitment to acting legally, ethically, transparently, and with high integrity in all business dealings, relationships, vendor, and third-party partnerships where individuals are employed by Sophos. The Policy sits alongside the Sophos Anti-Corruption Policy and the Sophos Whistleblowing Policy. Further, Sophos’ compliance with the U.K. Modern Slavery Act is a comprehensive platform under which Sophos also meets the broader demands of similar legislation, such as the California Transparency in Supply Chain Act of 2010ⁱⁱ, certain U.S. federal regulations, and The Commonwealth Modern Slavery Act 2018, Australia.iii

This Statement covers the following topics:

Our Business Model- Sophos’ product capabilities, partnerships, and global reach.
Sophos Risk Assessment- Measurements applied to respond to potential risks in the environments where Modern Slavery may exist.
Our Governance and Policies- A description of operational policies, actions taken, and measurements in place to ensure compliance with the Act.
Sophos Standard Operating Procedures- Actions required from our supply chain and steps undertaken by the business for recruiting.
Training - An explanation of the training systems used to create awareness among Sophos team members.
Our Monitoring and Performance Review- A description of the steps and indicators used to evaluate risk in our supply chain and in our business.

During FY23, Sophos focused on training, monitoring, and ongoing enforcement of its systems and processes to maintain high standards, which has improved Sophos’ ability to see, understand, and effectively manage the risk of modern slavery in any form.

A. Our Business Model

Sophos is a leading global provider of cybersecurity as a service through end-user, network, cloud, and email security solutions, offering organizations end-to-end protection and detection services against known and unknown cybersecurity threats through products that are easy to install, configure, update, and maintain. At the end of FY23, the number of customers supported reached more than 573,000. Sophos products are sold through its relationships with distributors and resellers, which comprise more than 63,000 partners worldwide.

At the end of FY23, Sophos had approximately 4,500 team members worldwide, including an office in the UK, operational offices, threat assessment labs, sales offices, and product development centers located around the world, including Asia Pacific, Europe, the Middle East, North America, and South America.

The Sophos supply chain consists of organizations comprised of hardware manufacturers, component suppliers, warehouses, employment agencies, recruitment agencies, and logistic fulfilment centers responsible for product distribution through which Sophos team members may be sourced (each a “Supplier,” collectively, the “Sophos Supply Chain”). Sophos also has close working relationships with and responsibilities to works councils in several jurisdictions, which represent the interests and rights of Sophos employees.

During FY23, Sophos saw significant growth in the number of its channel partners and end-users. As Sophos’ business grows, we continue to find new and effective ways to understand the Group’s forced labor risk, and we continue to adjust our compliance controls to ensure that any risk remains visible and managed.

B. Sophos Risk Assessment

Sophos faces modern slavery risks in two principal areas:

The Sophos Supply Chain and Suppliers located in jurisdictions outside the U.K.
The Sophos business enterprise, including employment, internal policies, and certain recruitment through agencies and third parties.

The formal process for identifying, evaluating, and managing significant risks faced by Sophos is overseen by the Board, along with the Group’s Finance, Legal, and Regulatory Teams. These Teams provide the business with a risk management framework, including reporting on significant risks, Sophos policies, and standard operating procedures.

The potential for non-compliance with the Act is assessed as part of this risk management framework. Sophos undertakes this risk assessment with input from external advisers, and the assessment criteria includes the business function and location, together with the principles set out by Transparency International, the Responsible Business Alliance Code of Conduct, and the U.N. Global Coalition Against Corruption. During the reporting period, Sophos continued its adherence to the Responsible Business Alliance Code of Conduct, Version7.0 (2021) (RBA Code of Conduct), particularly Section A.1., Freely Chosen Employment. The Sophos Declaration to the RBA Code of Conduct was signed by Sophos CEO on 19 February 2021 and is published on the Group website.

Each third-party Supplier is assessed during the onboarding process and screened with the use of the Dow Jones Adverse media list. Suppliers must agree in their written contract that they will comply with Sophos Modern Slavery Code of Conduct, complete the Slavery and Trafficking Risk Template (STRT), and the Conflict Minerals Reporting Template (CMRT). Currently, the Group shows a 100% response from all Sophos Suppliers for completion of the Modern Slavery Code of Conduct, the STRT, and the CMRT.

Both the STRT and the CMRT assess the Suppliers’ actions under international standards, are verified annually by each Supplier, and measure how Suppliers screen, prioritize, train, identify and manage risk, report, and have internal policies in place to govern against prohibited practices. No Supplier is owned by the Group.

Sophos takes a two-pronged approach to risk identification: (i) a bottom-up approach at the business function level; and (ii) a top-down approach at the senior leadership team level. All identified risks are assessed against a pre-defined scoring matrix and are prioritized accordingly. Any risks identified in the bottom-up approach are deemed to be rated as a higher risk and are escalated in line with pre-defined escalation procedures for further evaluation.

C. Our Governance and Policies

The Sophos Board has leadership responsibility to ensure the Policy complies with the Group’s legal and ethical obligations, and that all those under the control of the Group must comply with the Policy.

The Board provides oversight regarding the implementation of the Policy and monitoring of risks and issues raised in connection with it. The Policy recognizes Sophos’ responsibilities under the Act, its application to the Sophos Supply Chain, and places requirements on all persons working for Sophos in any capacity, including team members at all levels: directors, officers, agency workers, seconded workers, volunteers, interns, agents, contractors, external consultants, third-party representatives, and business partners.

The Policy and the Modern Slavery Code of Conduct continue to incorporate requirements regarding child labor in the workplace. Training on this issue has been provided to all team members.

The Sophos Conflict Minerals Policy, implemented in 2020, also supports Sophos’ commitment to reducing, if not removing, modern slavery in the Sophos Supply Chain. Sophos Supply Chain team members are responsible for reading, understanding, and enforcing this policy. 100% of this Team has completed the requirement to read and enforce the Conflict Minerals Policy.

Any breach of the Policy by a Sophos team member would result in disciplinary action and potential dismissal. Any breach of the Policy by a Supplier or other third-party would result in a termination of the business relationship and further action depending on the circumstances.

All those subject to the Policy are required to raise concerns about any suspicion of modern slavery in any part of our business within the Sophos Supply Chain or among any current or potential Supplier when they have any credible information about a policy violation or a prohibited practice. The Sophos Whistleblowing Policy provides a mechanism to enable team members and external entities, including third parties to report matters of concern confidentially via the Sophos Whistleblowing Portal. Internally, Sophos team members also can report directly to their line manager or to a designated HR manager.

All such matters reported to the Whistleblowing Portal are investigated and evaluated until they are concluded. Sophos’ Regulatory Team has responsibility for adherence to the Policy and for investigating and evaluating Whistleblower complaints. When appropriate, these matters are brought to the attention of Sophos’ Senior Management Team and to the Audit Committee of the Board. Consistent with the Sophos Whistleblowing Policy, Sophos is committed to ensuring no one suffers any negative treatment because of reporting in good faith any credible information they may have about a policy violation or prohibited practice.

D. Sophos Standard Operating Procedures

Our Suppliers: We take the following actions with each Supplier:

Sophos informs all new and renewed Suppliers in writing that we will not accept any form of labor exploitation in their business or in their supply chain, and we give them a copy of our Policy;
Suppliers are required to make an annual declaration to the Sophos Modern Slavery Code of Conduct stating that they are in full compliance with the Policy. This declaration includes the identification of all parties that supply components to our Suppliers to ensure extended supply chain information is visible to Sophos and is integrated into our management controls;
Suppliers are required to complete an annual questionnaire, which includes each Supplier’s identification of actions taken to build and maintain a socially responsible supply chain. This questionnaire was adopted from the Social Responsibility Alliance (SRA) and the STRT;
Suppliers must complete the CMRT, a standardized reporting template developed by the Responsible Minerals Initiative (RMI);
Suppliers are requested to provide ISO 9001 and OHSAS 18001 certification to evidence actions they have undertaken for their organizations;
Sophos accounts for each step of its hardware manufacturing processes to know the suppliers providing the hardware products that we resell. This includes the Sophos Supply Chain understanding how Suppliers source their components and that these component providers also meet required labor and employment guidelines. Any anti-corruption or modern slavery changes for a specific Supplier will trigger an immediate review and business investigation, together with identifying specific risk indicators and categories;
Our standard supply chain contracts include anti-slavery provisions which prohibit Sophos Suppliers, their team members, and their sub-suppliers from engaging in modern slavery;
Sophos conducts regular risk assessments of the Sophos Supply Chain. In cases of elevated risk, Sophos may request Suppliers to provide a ‘Statement of Compliance’ on their actions to prevent modern slavery and to confirm that any concerns have been satisfactorily and promptly resolved;
Sophos undertakes specific due diligence when onboarding new distributors to request that they have their own Policy regarding Modern Slavery or Human Trafficking. Otherwise, the new distributor must agree to comply with the Sophos Policy. The Policy is made available to our distributors during their onboarding;
In cases of high-risk, Sophos audits the Supplier and, as appropriate, Sophos requires them to take specific measures to ensure that the risk of modern slavery is removed or significantly reduced. If modern slavery is identified in a business in the Sophos Supply Chain, Sophos will require immediate remedial action from the Supplier. When appropriate, further support will be provided to achieve the safest outcome for potential victims. Sophos expects its Suppliers to engage constructively and responsibly and to remedy any issues promptly. Should the Supplier fail to resolve the situation to Sophos’ satisfaction, their business relationship with Sophos will be terminated;
Should allegations of modern slavery emerge in any part of the Sophos Supply Chain, including from whistle blowers, Sophos will comprehensively investigate such allegations. If any modern slavery is identified, Sophos takes immediate action as set out above.

Our Business: We take the following actions within Sophos:

Sophos ensures all team members have a contract of employment and that they have not had to pay any direct or indirect fees to obtain work;
Sophos ensures team members are legally eligible to work in the country where they are recruited;
Sophos checks the names and addresses of each team member (several people listing the same address may indicate high shared occupancy and often is a factor for those being exploited);
Sophos provides information to all new recruits about their statutory rights, including sick pay, holiday pay, and any other benefits to which they may be entitled;
Sophos invests in the professional development, health, and wellbeing of Sophos team members, including Well Being days which occur throughout the fiscal year;
Sophos pays all Sophos team members in the UK at least the living wage (pro rata in the case of part- time team members; vacation students and interns are paid an allowance);
If Sophos suspects someone is being exploited, our Human Resources Team will follow investigative and reporting procedures;
Sophos performs due diligence checks on any recruitment agency engaged by the Company to ensure that it is reputable and conducts appropriate checks on all team members provided to the company.

E. Training

Mandatory training on Modern Slavery, Conflict Minerals, Anti-Corruption, and Whistleblowing is required annually by all Sophos team members and to new joiners during onboarding. Training is accompanied by an online resource, which is available to all Sophos team members. Updates to these materials are ongoing. Feedback is encouraged to improve the Policy and the training material for all Sophos team members.

F. Our Monitoring and Performance Review

Sophos validates its oversite of Suppliers through real-time adverse media screening provided by a third-party to audit the Sophos Supply Chain and keep it under periodic review on an ongoing basis. Together with our external validation of compliance data, Sophos monitors Suppliers’ performance under the Policy, as well as their performance under the Sophos Anti-Corruption and Whistleblowing Policies. Sophos maintains a watching brief on the compliance of all Suppliers through live monitoring tools. Any alert raised through this process will be subject to an internal review and where appropriate, an investigation of the Supplier will be undertaken.

During FY23 screening, we were alerted to risks within our supply chain through adverse media screening. These alerts were related specifically to component providers supporting Sophos’ Suppliers. For example, one alert identified a potential customer sourcing certain goods from a manufacturer engaging in forced labor practices. Action was taken to pause any transaction with the potential customer until the manufacturer produced evidence of its proactive change in the company’s workforce.

Evidence of these Suppliers’ own screening procedures and Corporate Social Responsibility policies were viewed, which provided insight into their component providers accountability for labor and employment practices. This revealed that the risk had been reduced and actions had been carried out by these component suppliers, which addressed the relevant adverse media reports.

Indicators to Evaluate Risk.

Every endeavor is made to fully adhere to the requirements of the Modern Slavery Act (2015) in relation to Sophos’ recruitment, employment, and internal policies. The following measures support this:

Visibility and Management of the Sophos Supply Chain
1. Account for each step of our supply processes, and knowing who is providing goods and services to us;
2. Our level of communication and personal contact with the next link in our supply chain and their understanding and compliance with Sophos expectations.
Assessment, Code of Conduct, and Statement of Compliance
1. Number/percentage of new and existing Suppliers satisfactorily screened using risk assessment tools and/or self-assessment questionnaires, including risk scoring and categorization;
2. Number/percentage of Suppliers who have signed the Sophos Code of Conduct;
3. Number/percentage of Suppliers who have provided a satisfactory Statement of Compliance about their actions to prevent slavery, and any concerns have been satisfactorily and promptly resolved.
Reports on Concerns
1. Number of reported concerns of modern slavery (including if there were none);
2. Any material issues arising from implementation of the Policy were effectively escalated when the need arose;
3. All concerns raised as a result of audits or allegations were promptly followed- up and resolved;
4. How Sophos responded to concerns raised or to issues found by screenings, assessments, or audits and how Sophos worked with Suppliers to implement corrective action plans.
Training and Awareness
1. Number/percentage of relevant team members trained, informed, or completed mandatory training.

Sophos makes responsible sourcing decisions, develops plans to avoid brand damage, and complies with regulatory demands within the below legislation, among others:

Modern Slavery Act 2015, United Kingdomⁱ
California Transparency in Supply Chains Actⁱⁱ
United States Federal Acquisition Regulations
Trade Facilitation and Trade Enforcement Act of 2015^iv
The Commonwealth Modern Slavery Act 2018, Australiaⁱⁱⁱ

To ensure Sophos’ actions expressed in its Modern Slavery Statement meet all requirements in the Act, Sophos participated in a peer review facilitated by a trade association within the United Kingdom and within its industry segment.v Feedback from the review supports Sophos in meeting the requirements and provides further information about Sophos’ actions that reduce and remove modern slavery in the Sophos Supply Chain.

All Suppliers reviewed were validated at a granular level, including entities that are contained in each Supplier’s corporate structure.

Conclusion

Sophos’ actions, essential to manage its compliance with the Act, continue to mature. Existing processes are in place to ensure that these tasks are kept under regular and effective review and that Sophos’ performance under the Act is routinely and robustly measured.

This Statement is made pursuant to Section 54(1) of the Act.