Modern Slavery Act Transparency Statement 2018/19

This statement is made in accordance with Section 54 of the Modern Slavery Act 2015 (the Act) as it applies to Sophos Limited, a commercial organisation that carries on business in the UK, supplying goods and services and having a total annual turnover of £36 million or more, and all entities in the Sophos Group plc global structure (together Sophos, or the Group). This statement sets out the steps that have been taken during the financial year to 31 March 2018 to ensure that modern slavery is not taking place in the Sophos Supply Chain and in any part of our own business.

The statement has been signed by Nick Bray, a Director of Sophos Limited and Chief Financial Officer and Executive Director of Sophos Group plc and published on our website, www.sophos.com, with a clear link on the homepage.

During the financial year 2018/19, the Group continued to prioritise the establishment and implementation of effective systems and controls as set out in the Sophos Group Anti-Slavery and Human Trafficking Policy (the Policy) adopted in 2016, reflective of Sophos commitment to acting ethically, transparently and with integrity in all our business dealings and relationships. The Policy sits alongside the existing Sophos Anti-Corruption and Bribery Policy and the Sophos Whistleblowing Policy and is available at https://investors.sophos.com.

During 2018/19, the Group has continued to focus on training, monitoring and ongoing enforcement of the Group’s systems and processes to maintain high standards and to continually improve Sophos ability to effectively manage the risk of modern slavery in any form.

Our structure and business model

Sophos is a leading global provider of cloud-enabled enduser and network security solutions, offering organisations end-to-end protection against known and unknown IT threats through products that are easy to install, configure, update and maintain. The Group’s products are sold through our relationships with more than 45,000 channel partners. Sophos has approximately 3,400 employees and although headquartered in the UK, it has 51 offices and a number of threat assessment labs and product development centres around the world, including in Asia Pacific, Europe, the Middle East and North America.

Sophos saw significant growth in the number of channel partners and customers during the financial year and our current approach remains effective. As the business continues to grow however, we will continue to monitor our effectiveness, as discussed later in the statement, and adjust our approach to ensure it remains proportionate.

The Group’s supply chain in this context consists of approximately21,000 organisations made up of hardware manufacturers and suppliers, logistic fulfilment centres responsible for the distribution of our products, procurement vendors and recruitment and employment agencies from whom Sophos employees may be sourced (each a Supplier and together the Sophos Supply Chain). Sophos also has close working relationships with works councils in a number of overseas jurisdictions representing the interests and rights of our employees.

Risk Assessment

We consider that the principal areas in which Sophos faces risks related to slavery include:

1. the Sophos Supply Chain and outsourced activities, Suppliers located in overseas jurisdictions;
2. Sophos’ own business, including employment, internal policies and particularly recruitment through agencies.

The formal process for identifying, evaluating and managing significant risks faced by the Group is overseen by The Risk and Compliance Committee (RCC), in association with the work performed by the Internal Audit and Risk Management function. The RCC provide the business with a framework for risk management, upward reporting of significant risks and policies and procedures.

The potential for non-compliance with the Act is assessed as part of this risk management process. Sophos undertakes this risk assessment with input from external advisers, the assessment criteria applied include business function and geography, together with the principles set out by Transparency International, the Global coalition against corruption. Each Supplier is also assessed against the Human Trafficking Risk Index (HTRI) tool. This provides an automated, repeatable, closed-loop process to proactively monitor the Sophos Supply Chain for potential human trafficking violations using external corporate databases with more than 250 million records incorporating data from the International Labor Affairs Bureau and the U.S. Department of State.

The Group takes a two-pronged approach to risk identification: (i) a bottom-up approach at the business function level; and (ii) a top-down approach at the senior leadership team level. All identified risks are assessed against a pre-defined scoring matrix and prioritised accordingly. Any risks identified in the bottom-up approach deemed to be rated as higher risk are escalated in line with pre-defined escalation procedures for further evaluation.

Our governance and policies

The Sophos Group Plc Board (the Board) has overall responsibility for ensuring the Policy complies with our legal and ethical obligations, and that all those under our control comply with it.

The Board’s Audit and Risk Committee provides oversight regarding the implementation of the Policy and monitoring of risks and issues raised. The Policy recognises the Group’s responsibilities under the Act, and applies to the Sophos Supply Chain and to all persons working for us or on our behalf in any capacity, including employees at all levels, directors, officers, agency workers, seconded workers, volunteers, interns, agents, contractors, external consultants, third-party representatives and business partners.

Any breach of the Policy would result in disciplinary action, and potential dismissal for an employee, and the likely termination of our relationship with a Supplier.

All those subject to the Policy are encouraged to raise concerns about any issue or suspicion of modern slavery in any part of our business or supply chains or those of any current or potential Suppliers, at the earliest possible stage. The Sophos Whistleblowing Policy provides a mechanism to enable employees and Sophos Supply Chain to confidentially report matters of concern via the Whistleblowing Web Form or Hotline or directly to their line manager, or designated HR manager. Where appropriate, such matters may be brought directly to the attention of the Senior Independent Director and the Chairman of the Audit and Risk Committee, each of whom are independent Non-Executive Directors.

The Group is committed to ensuring no one suffers any detrimental treatment as a result of reporting in good faith their suspicion.

Procedures

Suppliers: we take the following actions in respect of each Supplier:

1. We inform all our new and renewed Suppliers in writing that we are not prepared to accept any form of exploitation in their business or any part of their supply chain, and give them a copy of our policy.
2. All Suppliers are required to make an annual Sophos Modern Slavery Code of Conduct declaration stating that they are in full compliance with our policy. This declaration includes the identification of all parties that supply products to our Supplier to ensure extended supply chain information is known by Sophos and integrated into our management control processes;
3. Suppliers are required to complete an annual questionnaire regarding their own actions in building and maintaining a socially responsible supply chain. This questionnaire was adapted from the Social Responsibility Alliance (SRA) Slavery and Trafficking Risk Template (STRT). This is a new measure and has increased conversations regarding the subject of bonded labour and employee welfare.
4. Suppliers have been asked to provide ISO 9001 and OHSAS18001 certification to evidence action they have undertaken in this matter. 
5. We ensure that we can account for each step of our hardware manufacturing processes and we know who is providing the hardware to us that we resell. This is done by using BOMcheck, an industry-wide regulatory compliance tool which is offered by ENVIRON. BOMcheck identifies companies that are part of the Sophos extended supply chain that supply components for our hardware products to our immediate Suppliers. Once identified, we conduct live monitoring of all these companies through an external 3rd Party and by running them through our HTRI management tool. Any anti-corruption or modern slavery changes for a specific Supplier will trigger an immediate review and business investigation, together with identifying specific risk indicators and categories;
6. Our standard supply chain contract templates contain anti-slavery provisions which prohibit Suppliers and their employees and sub-suppliers from engaging in modern slavery;
7. We conduct regular risk assessments of our Sophos Supply Chain. in cases of high risk, we may request suppliers to provide a ‘Statement of Compliance’ on their actions to prevent slavery and to confirm that any concerns have been satisfactorily and promptly resolved;
8. In cases of high-risk, we may also audit the Supplier and, as appropriate, we require them to take specific measures to ensure that the risk of modern slavery is significantly reduced. If slavery is identified in a business in the Sophos Supply Chain, the Group will require that immediate remedial action be taken, and provide appropriate support to achieve the safest outcome for potential victims. The Group expects its Suppliers to engage constructively and responsibly, and to remedy any issues in a timely manner. Should the Supplier ultimately fail to resolve the situation to the Group’s satisfaction, their contract will be terminated;
9. Should allegations of slavery in any part of the Sophos Supply Chain emerge, including from whistle blowers, the Group will comprehensively investigate any such allegations, if any slavery is identified, will take immediate action as set out above.

Our business: we take the following actions:

1. We always ensure all staff have a written contract of employment and that they have not had to pay any direct or indirect fees to obtain work.
2. We always ensure staff are legally able to work in the country in which they are recruited.
3. We check the names and addresses of our staff (a number of people listing the same address may indicate high shared occupancy, often a factor for those being exploited).
4. We provide information to all new recruits on their statutory rights including sick pay, holiday pay and any other benefits they may be entitled to.
5. We continue to invest in the professional development, health and wellbeing of Sophos staff.
6. We pay all Sophos employees in the UK at least the Living Wage (pro rata in the case of part-time employees; vacation students and interns are paid an allowance).
7. If, through our recruitment process, we suspect someone is being exploited, the HR department will follow our reporting procedures.
8. We conduct due diligence checks on any recruitment agency that we use to ensure that it is reputable and conducts appropriate checks on all staff that they supply to us.

Training and Awareness

Mandatory training is provided to all existing Group employees and new joiners alike, and is re-taken on an annual basis. Training is accompanied by an online resource facility which is available to all Group employees. Refreshment of these materials is ongoing. Feedback is encouraged to develop improvement of Policy and future updates the training material for all Sophos employees.

Monitoring and performance review

Sophos engages an external compliance data provider on an ongoing basis, to audit the Sophos Supply Chain and keep it under review. Together with our external compliance data provider the Group monitor the performance of the Policy, together with the Sophos Anti-Corruption and Bribery and Whistleblowing Policies. The Group maintain a watching brief on the compliance of all Suppliers through live monitoring tools. Any alert raised through this process will be subject to an internal review and where appropriate, a business investigation of the Supplier will be undertaken. During 2018/19, no material alerts have been raised by our external compliance data provider concerning any Supplier, including recruitment agencies.

Indicators used to evaluate risk, include managing the risks in our own business.

Every endeavor is made to fully adhere to the requirements of the Modern Slavery Act 2015 in relation to our recruitment, employment and internal policies. The following measures support this.;

a. Understanding the Sophos Supply Chain

1. We can account for each step of our supply processes and we know who is providing goods and services to us;
2. Our level of communication and personal contact with the next link in our supply chain and their understanding of, and compliance with, our expectations.

b. Assessment, Code of Conduct and Statement of Compliance

1. Number/percentage of new and existing suppliers satisfactorily screened using risk assessment tools and/or self-assessment questionnaires, including risk scoring and categorization;
2. Number/percentage of suppliers who have signed our Code of Conduct;
3. Number/percentage of suppliers who have provided a satisfactory ‘Statement of Compliance’ on their actions to prevent slavery, when so requested, and any concerns have been satisfactorily and promptly resolved;

c. Reports on Concerns

1. Number of reported concerns of slavery (including if there were none);
2. Any material issues arising from implementation of the Policy were effectively escalated when the need arose;
3. All concerns raised as a result of audits or allegations were promptly followed-up and resolved;
4. How we responded to concerns raised or to issues found by screenings, assessments or audits and how we worked with suppliers to implement corrective action plans.

d. Training and Awareness

1. Number/percentage of relevant staff trained, informed or completed mandatory training.

During this period the total number of indirect suppliers conducted in this review was approximately 97,000 and direct suppliers was approximately 6500.

The (HTRI) provides Sophos with insights into where potential human trafficking may exist deep within our supply chain. Our 3rd Party provider created this proprietary scoring index by marrying their corporate database – the world’ largest, with more than 300 million records – to data from the International Labor Affairs Bureau and the U.S. Department of State.

Forced labor is more likely in certain geographic regions and product sets, so the data creates an analytic index that evaluates the potential for one of our suppliers to be involved in human trafficking based on the location of the supplier and the product or commodity type they provide.

The HTRI offers the ability to uncover and correct forced labour that may have entered your supply chain. The HTRI marries International Labor Affairs Bureau and U.S. Department of State data with proprietary analytics from our 3rd Party providers global corporate database – to spotlight suppliers in geographies and industries most likely to be exposed to human trafficking.

The HTRI then combines our 3rd Party providers own HTRI score with the Sophos supplier database, meaning that potential areas of forced labour or human trafficking can be quickly identified within the Sophos supply base. Sophos can then take the responsible sourcing decisions, develop plans to avoid brand damage and comply with regulatory demands within the below legislation:

Modern Slavery Act 2015, United Kingdom
California Transparency in Supply Chains Act
United States Federal Acquisition Regulations
Trade Facilitation and Trade Enforcement Act of 2015

All Suppliers reviewed were validated down to the family tree level. This indicates the number of entities that are contained in every Supplier’s corporate structure. This takes all the HTRI scores for the records within that corporate family tree and provides Sophos with an HTRI Corporate Family Tree Score (an average of all the companies involved within this structure).

Any medium risk suppliers identified within the HTRI scoring mechanism, are derived from the 2 factors stated below: -

1. Geographic Region. It was found that these records were based in medium risk territories for Human Trafficking.The countries falling in to this bracket were India, Bulgaria, Algeria, Saudi Arabia, Hong Kong, Hungary, Tunisia, Malaysia, China, South Africa, Pakistan and Thailand.
2. The other elements which are used within the algorithm is the Standard Industry Classification (SIC) and it is used to measure the risk of human trafficking being found in the company. The 354 in-direct supplier records and 231 direct supplier records have commodity codes which could be classified as medium risk such as:
   1. Electronic Components
   2. Communication Services
   3. Computer Peripheral Equipment

Conclusion

The Group’s position and approach to managing our compliance with the Act continues to evolve. However, the processes in place to ensure this will be kept under regular and effective review, and our performance will be routinely and robustly measured.

This statement is made pursuant to section 54(1) of the Act. The Board delegated approval of this statement on its behalf to the Chief Financial Officer of the Company.

Nick Bray
Director, Sophos Limited
Chief Financial Officer and Executive Director, Sophos Group plc

25 September 2019

Modern Slavery Act Transparency Statement 2018/19

Read the Modern Slavery Act Transparency Statement 2017

Read the Modern Slavery Act Transparency Statement 2016