Whistleblowing Policy and Procedures

Objective

Whistleblowing is an important aspect of an accountability and transparency mechanism to enable personnel or business associates of PPB Group Berhad (“the Company”) and its subsidiaries (“the Group”) and members of the public to voice concerns in a responsible and effective manner.

It is a fundamental term of every contract of employment that a personnel of the Group will faithfully serve his or her employer and not disclose confidential information about the employer’s affairs. Nevertheless, where the whistleblowers discover information which they believe shows serious malpractice or wrongdoing within the organisation then this information should be disclosed internally without fear of discrimination or harassment.

The Whistleblower Protection Act 2010 (“the WPA”)

“An Act to combat corruption and other wrong doings by encouraging and facilitating disclosures of improper conduct in the public and private sector, to protect persons making those disclosures from detrimental action, to provide for the matters disclosed to be investigated and dealt with and to provide for other matters connected therewith.”

Essentially the WPA gives legal protection to a whistleblower against being dismissed or penalised by their employers as a result of disclosing serious concerns. The provisions of the WPA are to ensure that no whistleblower should feel at a disadvantage in raising legitimate concerns.

It should also be emphasised that this policy is intended to assist whistleblowers who believe they have discovered malpractice or impropriety. It is not designed to question financial or business decisions taken by the Group nor should it be used to reconsider any matters which have already been addressed under harassment, complaint, disciplinary or any other procedures. Once the "whistleblowing” procedures are in place, it is reasonable to expect employees to use them rather than air their complaints outside the Group.

Scope of Policy

Any of the following persons (“whistleblower”) can make a report to the Company of any malpractice or impropriety:

• all personnel in the Group, which refers to directors (both executive and non-executive), employees (including permanent, part-time and contract employees);
• all business associates which are external parties such as customers, suppliers, contractors and other stakeholders who may have a business relationship with the Group; and
• members of the public.

This policy is designed to:

• Support our values;
• Ensure whistleblowers raise concerns without fear of retribution, and
• Provide a transparent and confidential process for dealing with concerns.

This policy covers not only possible improprieties in matters of financial reporting, but shall also include the following:

• Financial malpractice or impropriety or fraud
• Failure to comply with a legal or regulatory obligations
• Health and safety, or the environment
• Criminal activity
• Bribery and corruption acts
• Improper conduct or unethical behaviour
• Serious conflict of interest without disclosure
• Any other serious improper matters which may cause financial or non-financial loss to the Group or damage to the Group’s reputation
• Concealment of any of the above.

Principles

• All genuine concerns raised will be treated fairly.
• Harassment or victimisation of any whistleblower raising a genuine concern will not be tolerated.
• The identity of the whistleblower making the disclosure will be kept confidential unless he/she agrees otherwise, or the circumstances demand otherwise.
• Will ensure that the whistleblower is aware of who is handling the matter.
• Will ensure that no one will be at risk of suffering any retribution as a result of raising a concern, even if the whistleblower is mistaken. However, this assurance will not be extended to someone who maliciously raises a matter that is known to be untrue.

Safeguards

1. Protection
   This policy is designed to offer protection to those whistleblowers who disclose such concerns provided the disclosure is made:
   
   • in good faith; and
   • in the reasonable belief of the whistleblowers making the disclosure that it tends to show malpractice or impropriety and if they make the disclosure to an appropriate person (see below).
2. Confidentiality
   The Group will treat all such disclosures in a confidential manner. The identity of the whistleblower making the allegation may be kept confidential so long as it does not hinder or frustrate any investigation. However, the investigation process may reveal the source of the information and the whistleblower making the disclosure may need to provide a statement as part of the process or evidence required.

   In the event the Group is faced with a circumstance where the identity is to be revealed, the Group will endeavour to discuss this with the whistleblower first.

   Should the whistleblower choose to disclose his/her identity either internally or externally/ publicly, the Group is no longer obligated to maintain the confidentiality of the whistleblower.

3. Anonymous Allegations
   This policy strongly encourages whistleblowers to put their name to any disclosures they make. However, whistleblowers may remain anonymous, if they choose to do so. Anonymous whistleblowers are encouraged to provide an email address or other contact information to facilitate proper investigation.

   Whistleblowers are advised to provide sufficient information to enable the Group to conduct investigation. Additionally, the factors to be taken into account will include:

   • The seriousness of the issue or concern raised
   • The credibility of the concern
   • The likelihood of confirming the allegation from attributable sources.
4. Untrue Allegations
   If a whistleblower makes an allegation in good faith, which is not confirmed by subsequent investigation, no action will be taken against that individual. In making a disclosure the whistleblower should exercise due care to ensure the accuracy of the information. If, however, the whistleblower makes malicious or vexatious allegations, and particularly if he or she is an employee and persists with making them, disciplinary action may be taken against that employee.

How to Raise a Concern or Provide Information

Whom to report to:

You may report to any of the following :

How to make a report:

• Concerns or information are preferably raised or provided in writing via email. Ideally, the Group recommends any report to be detailed in setting out the background and history of events and the reasons for your concern by completing the Whistleblower Report Form (Appendix attached) which is available on PPB’s website at : http://ppbgroup.com/images/pages/sustainability/WHISTLEBLOWER_REPORT_FORM.pdf. The completed form can be emailed to our whistleblowing email address : “This email address is being protected from spambots. You need JavaScript enabled to view it.” which is directed to PPB Internal Audit Department authorized personnel.
• Alternatively, you may send your duly completed Whistleblower Report Form by mail to the following address:
  
  The Audit and Risk Committee Chairman
  c/o Group Head of Internal Audit
  PPB Group Berhad
  12th Floor UBN Tower
  10 Jalan P Ramlee
  50250 Kuala Lumpur.
• If you are not comfortable about writing in, you may telephone : +603-27260075 (Group Head of Internal Audit) or meet the appropriate Company official in confidence, at a time and location to be determined together.

Investigating Procedure

The investigation process will be as follows:

• Full details and clarifications of the complaint should be obtained.
• Depending on the type/ nature of the reported case/ complaint, the Audit and Risk Committee holds the highest authority to form an investigating panel which may consist of the relevant business division / personnel best-placed such as Head of Legal / Group Head of Internal Audit / GCRO / GCHRO to address the reported issue.
• The investigating panel should inform the subject(s) against whom the complaint is made as soon as is practically possible. The subject(s) will be informed of their right to be accompanied by a trade union or other representative (where applicable) at any future interview or hearing held under the provision of these procedures.
• If appropriate, the investigating panel should consult with the relevant Chief Executive / Managing Director / Chairman and, consider the involvement of the Company’s internal auditors and/or the police at this stage.
• The allegations should be fully investigated by the investigating panel with the assistance where appropriate, of other individuals / bodies.
• A finding concerning the complaint and validity of the complaint will be made by the investigating panel. This finding will be detailed in a written report containing the findings of the investigations and conclusion of the finding. The report will be passed to the relevant Chief Executive / Managing Director / Chairman, as appropriate.
• The relevant Chief Executive / Managing Director / Chairman will decide what action to take. If the complaint is found to be valid, disciplinary or other appropriate Company procedures will be invoked.
• The whistleblower will be kept informed of the progress of the investigation, if appropriate, and of the final outcome.

If the whistleblower is not satisfied that his/her concern is being properly dealt with by the investigating panel, he/she has the right to raise it in confidence with the Audit and Risk Committee or one of the designated persons described above.

What happens after the investigation is completed?

• The findings of the investigation(s) will be communicated to the Audit and Risk Committee for any necessary action.
• The investigating panel will communicate the conclusion of all findings to the whistleblower as a matter of policy, for closure.

Safe-keeping of Records

• All concerns received in writing via the above-said channels together with the relevant investigation documents are to be forwarded to PPB Internal Audit Department and will be retained by the Group for a minimum period of 7 years.
• All reports, supporting evidence, findings of investigations and monitoring of corrective actions shall be maintained and monitored by PPB Internal Audit Department.

Oversight and Ownership of Policy

• The Board of the Company has overall responsibility for this Policy and shall oversee the implementation of this Policy.
• The Board has delegated the responsibility for the administration and implementation of the Policy to the Audit and Risk Committee.
• The use and effectiveness of this Policy shall be regularly monitored and reviewed by PPB Internal Audit Department, who is the owner of this document and shall be responsible for incorporating any amendments and updates into this document, obtaining the approval of the Audit and Risk Committee Chairman for such amendments and updates and disseminating the same to the relevant parties.
• The Group will review this policy at least once every 3 years to assess its effectiveness.

 

6 June 2023