NNPCL GRC Due Diligence Processes PDF

NNPC Limited Due Diligence Processes and Procedures All vendors and other third-party service providers in existing contracts should have DD re-certifications performed on them every two years. Recertifications may be performed on Higher-risk vendors more frequently and on a need basis. 4.0 Indepe...

NNPC Limited Due Diligence Processes and Procedures All vendors and other third-party service providers in existing contracts should have DD re-certifications performed on them every two years. Recertifications may be performed on Higher-risk vendors more frequently and on a need basis. 4.0 Independent Verification Services NNPC Limited may rely on the services of third parties (including affiliated entities) for some or all the elements of its due diligence process and other services. The Company shall obtain data and information to verify that the third Party is registered to a renowned professional organization in accordance with relevant laws as well as supervised for the purpose of compliance with the measures for the prevention of money laundering and terrorist financing. Robust and effective controls must be in place for all third parties that undertake regulated business on behalf of NNPC Limited, for example, agents who register and conduct transactions and vendors/merchants/contractors who carry out verification and other financial-related activities. Third Parties will also be formally required to adhere to AML policies and procedures, be monitored to ensure adherence, and face sanctions for breaches. Appropriate contractual obligations must be put in place to support these requirements. 5.0 Ongoing Monitoring NNPC Limited shall use reasonable efforts to perform ongoing monitoring of its counterparties via a variety of processes that may include exercising audit rights or refreshed due diligence screening. NNPC Limited may Page 134 of 347 NNPC Limited Due Diligence Processes and Procedures conduct additional due diligence reviews and analysis as necessary to mitigate ongoing risks and intervene to reduce the Company’s overall risks. The frequency and scope of monitoring of ongoing NNPC Limited Activities shall correspond to the level of Risk identified. The Risk rating may be reclassified during the lifetime of the NNPC Limited Activity based on updated monitoring information GRC shall keep records of the identified Risk indicators, any mitigating measures undertaken, the conclusions reached as well as DD reports. Findings shall be archived for future reference for the period between five (5) to ten years. Risks shall be monitored on a regular basis. NNPC Limited must ensure that complete and up-to-date files in relation to each business relationship / opportunity which has been taken forward for completion is maintained. These files would, for example, include records of opportunity origination, all documentation of due diligence screening including any external due diligence reports, approval submission details, and completion documents in addition to any ongoing procedures undertaken during or post-transaction. 6.0 Responsibility for Review The GRC Division /Chief Compliance Officer shall oversee and jointly monitor, on an ongoing basis, all activities related to this Policy with the various responsible units, to identify any risks or conduct that may be contrary to the contents of this Policy. The Board Audit Committee shall, every two (2) years, review this Due Diligence Policy and submit recommendations to the Board of Directors regarding any amendments or revisions to the Policy as may be necessary or advisable to ensure that appropriate and effective controls are in place and working as intended to Page 135 of 347 NNPC Limited Due Diligence Processes and Procedures minimize the risks of fraud and corruption in NNPC Limited, taking into consideration the suggestions and input of the Chief Compliance Officer, and NNPC Limited Employees. 7.0 Reporting Decision on whether to proceed with the proposed NNPC Limited activity will be based on a completed IDD or EDD in respect of a medium or highrisk third party. After the EDD is completed, the Risk shall be re-assessed by the respective corporate service unit in consultation with GRC, taking into consideration any mitigating and aggravating factors, and a final risk rating shall be established. The Chief Compliance Officer shall provide advice to the Project Managers, management, and the Board of Directors on various risks and on specific IDD and EDD matters. GRC shall also advise on and monitor the implementation of this Policy, and recommend and advise on the development of relevant internal procedures and practices related to this Policy GRC shall regularly conduct quality checks on the IDDs performed. The findings shall be included in GRC’s report to the Board of Directors, and the Board Audit Committee. Page 136 of 347 NNPC Limited Due Diligence Processes and Procedures Addendum Guide on Due Diligence Competencies The following guide shall be applicable to the GRC and other functions responsible for the implementation of this policy on due diligence. The guide specifically applies to the GRC Manager or his equivalent, or other GRC-appointed officers or Assurance officers:  To be qualified as properly skilled and competent in the administration of this Due Diligence Policy, the manager or other relevant officers shall possess the minimum requirement of a Bachelors’ Degree in Economics, Finance, Accounting, Law, Business Administration, or other related area.  Furthermore, the possession of the right behavioural, analytical, decision-making, problem-solving skills, attention to details, and/or other required technical skills as may be determined from time to time by the GRC Division, shall be a major basis of consideration for qualification. Page 137 of 347