NNPCL GRC_Planning and Investigation.pdf

2.2 Planning an Investigation In order for an investigation to be thorough and complete, it is essential that a detailed plan which clearly sets out the objectives of the investigation and how to achieve them is created. Investigations can be complex and dynamic and can grow rapidly, thereby leading...

2.2 Planning an Investigation In order for an investigation to be thorough and complete, it is essential that a detailed plan which clearly sets out the objectives of the investigation and how to achieve them is created. Investigations can be complex and dynamic and can grow rapidly, thereby leading the investigation team in many directions. It is therefore important that the investigation team is flexible and prepared to address any changes without losing track of the overall purpose of the investigation. Investigation planning require a wide range of considerations to determine what is achievable during an investigation. This includes considerations such as team size and qualification, location of incident, department(s) affected, outsourcing options, etc. It is therefore imperative that a clear plan is created for every investigation as it enables the investigation team answer critical questions such as: a. What are the objectives of this investigation? b. What actions are required to achieve the objectives? c. How to establish the facts by considering: What, Where, When, Who, Why and How? d. What types and sources of information do we require? e. How long should the investigation take? Must the investigation be completed within a certain time-frame? f. What skill sets are required for the investigation? 2.2.1 Other Planning Considerations Some factors to be considered during the planning stage of an investigation include: a) Confidentiality: All information gathered during investigations should be treated with utmost confidentiality and should only be distributed to NNPC Limited Investigation Processes and Procedures a limited number of individuals with an established business need for such information. Therefore, the planning phase should include creation of protocols for information storage and sharing and also report distribution lists. b) Notification of third parties: Certain third parties such as regulators, external auditors, and law enforcement agencies may need to be notified of certain allegations to be investigated. It is important that the relevant third parties are identified during the planning phase of the investigation and necessary action taken to notify such parties. c) Gathering and securing evidence: During the planning phase of investigations, methods to be adopted in gathering and securing information should be stipulated in order to ensure that evidence is admissible in legal proceedings. For instance, it can be stipulated that: i. Original copies of documents should not be altered in any way. ii. Interview statements should be signed by the interviewee and attested to by a witness. d) Investigation timeline: During the planning phase, it is important that timelines are assigned to each task to be performed during the investigation. This will also help determine the human resources required to carry out the investigation as investigations may need to be conducted by a large team, urgently for various reasons such as mitigation of loss or potential harm. e) Legal privileges: Involving legal counsel early in the process where required. Legal counsel might be required where an allegation involves some form of regulatory breaches and/or require legal advice on how to proceed. f) Objectivity: Members of the investigation team must maintain the highest levels of integrity in executing their duties. As such, all members of the team must declare any conflicts of interest or potential conflict of NNPC Limited Investigation Processes and Procedures interest that may exist before the investigation occur or during the investigation. g) Compliance: Investigations should comply with applicable laws and rules regarding gathering information and interview of witness. h) Resources & Skillsets: During the planning phase of investigations, the nature and complexity of the allegation should be considered in deciding on the resources and skillsets required to effectively perform the investigation. Such resources and skillsets could include but are not limited to: i. Forensic technology and IT tools ii. Law iii. Engineering (mechanical, electrical, civil, etc.) iv. Others 2.2.2 Work Plan Development A work plan is a document which details the specific tasks/activities to be carried out to achieve the objectives of the investigation. It is an essential part of all investigations and must be prepared by personnel with relevant skills and experience. In preparing a work plan, it is pertinent that each step of the investigation process is appropriately considered to arrive at tasks to be performed and the objective of the investigation each task will aim towards achieving. 2.2.3 Investigation Team Professionalism The team responsible for investigating any reported incident should consist of individuals who possess knowledge, skillsets and tools relevant to the incident being investigated. This may involve using personnel of the NNPC Limited Investigation Processes and Procedures GRC, and/or personnel of an independent and competent professional service firm (subject to the decision of the Chief Compliance Officer). Based on the uniqueness of each incident report investigated, the investigation team may need to appoint team members from different departments of the Company to provide insight using knowledge gathered as a result of their function in the organization or educational background. Resources may be required from departments such as Finance, Legal, Internal Audit, Human Resources Division and Information Technology etc. Where possible, the personnel responsible for heading the investigation team should be at least one grade level higher than any individual potentially involved in the reported issue, except in a case where an external consultant is responsible for the investigation. Investigations involving members of executive management such as Directors, the Chief Executive Officer and Executive Vice Presidents should be supervised by the Chief Compliance Officer or outsourced to an independent and competent professional service firm. Conflict of Interest It is also required that all potential team members disclose if there is an actual or potential conflict of interest with any of the issues or parties that are involved in the investigation prior to concluding on the team make up. In the event that a Head within the GRC function or a GRC Manager is the subject of an investigation or is unable to perform his/her duties as a result of an actual or perceived conflict of interest, the Chief Compliance Officer will appoint an alternative staff to carry out the responsibilities of the Head or Manager, in the investigation process as captured in this Processes and Procedures. Likewise, In the event that the Chief Compliance Officer is the NNPC Limited Investigation Processes and Procedures subject of an investigation, or has an actual or perceived conflict of interest, the Board Audit Committee will appoint an alternative staff to perform the responsibilities of the Chief Compliance Officer as captured in this Processes and Procedures. Integrity and Ethics Investigation team members must maintain the highest standards of integrity and ethical conduct. Each investigation shall be conducted in accordance with the Investigation Processes and Procedures. Confidentiality Investigation team members have a duty of confidentiality regarding all information they come across during the investigation. 2.2.4 Considerations for Appointing Independent Investigators Independent investigators may be appointed for various reasons including but not limited to: a. A need for absolute confidentiality and objectivity. b. A need for specific skill sets which may not be available within the Company. c. The involvement of multiple high-ranking officers of the Company. d. The scale of the investigation may be too large for the GRC to handle within acceptable timelines. The appointed investigator may sometimes be a member of staff with relevant experience, or an external investigator. When it is decided that an investigation will be outsourced to external investigators, the reputation, integrity, capability and experience of the investigators should be considered during the process of selecting the external investigators. NNPC Limited Investigation Processes and Procedures 2.2.5 Procedures in Planning an Investigation The following procedures should be followed in planning an investigation: Procedures S/N 1. Responsible Party Description Chief Compliance Open an investigation file with the following: Officer or Head of • Unique investigation ID Business Ethics or • Title of Case Chairman, Ethics • Date of file opened Committee (based on the level of staff involved) 2. Chief Compliance Officer or Head of Understand the issues surrounding the investigation and the objective of investigating the issue. Business Ethics (based on the level of staff involved) 3. Chief Compliance Officer or Head of Business Ethics (based on the level of staff involved) Define the scope of the investigation. NNPC Limited Investigation Processes and Procedures Procedures S/N 4. Responsible Party Description Chief Compliance Understand and consider professional standards, Officer or Head of regulatory/legal standards and frameworks relevant Business Ethics to the investigation. (based on the level of staff involved) 5. Chief Compliance Ascertain whether there is a need to appoint an Officer or Head of investigator internally, outsource the investigation or Business Ethics engage a forensic specialist. (based on the level of staff If the investigation is to be outsourced, go to step 6, otherwise, go to step 9. involved) 6. Head of Business Initiate process for selecting internally qualified or Ethics or GRC external investigators. Manager (based on the level of staff involved) 7. Head of Business If determination is made that an external Ethics or GRC investigator be appointed, select the external Manager (based investigator, observing all existing procurement and on the level of contracting process in the Company. staff involved) NNPC Limited Investigation Processes and Procedures Procedures S/N 8. Responsible Party Description Chief Compliance Select a member of the internal investigation team Officer, Head of to liaise with the external consultant. Business Ethics or GRC Manager (based on the level of staff involved) 9. Chief Compliance Understand the nature of the evidence to be Officer, Head of gathered. Business Ethics or GRC Manager (based on the level of staff involved) 10. Chief Compliance Officer, Head of Business Ethics or GRC Manager (based on the level of staff involved) Constitute an Investigation Team. NNPC Limited Investigation Processes and Procedures Procedures S/N Responsible Party Description 11. Head of Business Provide Investigation Team with all information Ethics /Relevant available as regards the case in question. Function 12. Head, Prepare a detailed work plan document covering Investigation the: Team • Objectives of the investigation • Proposed interviewees • Preliminary information requirements • Investigation approach to be adopted • Timelines for each procedure to be performed • Reporting milestones/project status reporting frequency. 13. Head, Review the work plan for adequacy and update, Investigation where applicable. Team 14. Head, Investigation Assign roles and responsibilities to the Investigation team members based on knowledge and expertise. Team 15. Head, Update work plan with information on individuals Investigation responsible for the various procedures to be Team performed NNPC Limited Investigation Processes and Procedures Procedures S/N Responsible Party Description 16. Head, Establish the timeframe for completing the Investigation investigation. Team 17. Head, Plan for the collection and retention of evidence. Investigation Team Input & Output Documents Input & Output Documents S/N 1. 2. KPIs Document Description Type Frequency Source Recipient Investigation file Input As need arises Report log GRC Work document time frame Output As need arises Designated GRC Officer Head, Investigatio n Team plan with NNPC Limited Investigation Processes and Procedures Key Performance Indicators S/N Performance Measure Basis of Timeframe Measurement Target 1. Timeliness of Work plan developmen t Latest date for approval of the investigation For the period of Investigation Two weeks after receipt of incident report and validation Quality of Work plan document Number of material errors, and omissions in the Work Plan document As required Zero error and realistic goal setting Compliance to the Work Plan document % Compliance with Work Plan during review period. As required 100% 2. 3.