Safeguarding our culture of integrity

DNV GL’s business model is based on trust at all levels and in all business environments. Trust can only be achieved when we persistently maintain high standards of business and personal conduct. We endeavour to reflect DNV GL’s values in everything we do to demonstrate ethical leadership and uphold our reputation for integrity.

Targets and results

Relevant measures to achieve a high level of integrity have been further implemented through respective e-learnings, classroom training and communication measures, as well as improvements to the governing documents, observing and taking into consideration the latest legal developments.

• Targets
  • Reflect the findings of a risk assessment and introduce express training sessions, addressing the needs of employees in their daily work. 
  • Set up an export control network. 
  • Awareness training on the reporting of misconduct. 
  • Monitor the implementation of the new Supplier Code of Conduct and the instruction on Subcontractors and Intermediaries.
• Results
  • Express learning on the reporting of misconduct prepared for roll-out in 2018. 
  • Monitored implementation of a governing document on Subcontractors and Intermediaries, including the finalization of risk assessments per business area. 
  • Export Control Network set up. 
  • E-learning on export control law and sanctions prepared for roll-out in 2018. 
  • Express learning on personal data protection (refresher) rolled out.
• Plans

  Training and awareness

  • Preparation and roll out of an e-learning course for subcontractors.
  • Roll-out of an awareness session for all employees on the reporting of misconduct.
  • Anti-corruption measures for identified high-risk countries.
  • Drive awareness on export control and sanction requirements.
  • Express learning about DNV GL as a data processor.

  Governing documents and implementation

  • Further implementation of requirements related to the EU General Data Protection Regulation.
  • Activities to ensure the protection of customers’ personal data.

Approach

We seek to provide reliable protection against non-compliance risks and are continuously developing a common understanding of our integrity performance. Regular reports on developments are presented to the Board’s Audit Committee and CEO. The Group Compliance unit regularly evaluates risks reported in our risk management system and develops tailor-made awareness initiatives for these.

• Code of Conduct

  Our Code of Conduct outlines high-level principles in two main areas: DNV GL’s conduct of its business; and the personal conduct of people involved in DNV GL’s business at all levels, both in ordinary work situations and when there are challenges to our personal or professional integrity.

• Zero tolerance

  We do not tolerate any violation of applicable laws, including anti-corruption, privacy and export control laws, our Code of Conduct or internal instructions. Violations may result in disciplinary procedures, including termination of employment or contract as well as potential legal proceedings. As a global company with activities in a range of sectors, we face differing local regulations and practices, which in turn results in a diverse risk picture.

• Governance

  Effective compliance is based on the global governance of our compliance organization and clear-cut reporting lines, as well as close cooperation between our Group Compliance unit, all business areas and Global Shared Services, ensured through an international compliance network.

• Top management focus

  The Board of Directors gets regular updates through presentations, training and information on DNV GL’s compliance programme. A special focus on this is part of the latest legal and political developments.

• Compliance programme

  Our compliance programme with its related instructions is based on the Code of Conduct and owned by the Board of Directors. All focus areas, anti-corruption and antitrust efforts, export control law and sanctions, and personal data protection are based on the ISO standard 19600, creating an interlinked, integrative and tailor-made approach. Lessons learned are systematically used to build competence and resilience. This enables our employees to understand the structure and requirements of the compliance management system and meet customer requirements.

• Risk management

  The management of corruption and fraud risks is integrated into the regular risk management processes and the Group Compliance Officer is a member of DNV GL’s Group Risk Forum. All business areas conducted a risk assessment in 2017. The DNV GL risk management tool included 32 identified and active fraud and corruption risks in 2017. The risks were identified as being in Business Assurance (12), Global Shared Services (11), Oil & Gas (6), Maritime (2) and Energy (1). Identified high-risk countries report separately on risks identified in a separate risk reporting process.

• Communication

  Communication, including the tone from the top, is a key success factor in the programme. We are constantly developing our communication channels to create an ongoing high level of awareness in the organization. The latest information as well as FAQs can be found on the intranet.

• Training

  In our tailor-made training programme, we build competence by using customized awareness sessions and web-based training, including actual compliance cases to include lessons learned. All employees, regardless of category and region, are to complete the mandatory e-learning modules on Code of Conduct and Anti-Corruption and Antitrust. For this reason, we do not monitor completion by category and region.

• Customer privacy

  Customer data are handled in accordance with the confidentiality obligations that follow from the terms and conditions of our contracts with customers. Comprehensive instructions are in place outlining our standards to protect the personal data of employees and customers in line with the EU General Data Protection Regulation.

• Anti-trust

  The Antitrust instructions are supplemented by a guideline on “Dos and Don’ts for competition law”. Antitrust is also part of the mandatory training programme.

• Supply chain

  We expect our suppliers and subcontractors to uphold the same business ethics standards as DNV GL and instructions on our requirements are in place. We provide subcontractors with the Supplier Code of Conduct and carry out due diligence checks as decided in the business areas.

• Reporting of misconduct

  Our employees and customers are encouraged to report actual or suspected misconduct, such as, but not limited to, concerns related to bribery, fraud, labour grievances, discrimination or other ethical issues concerning colleagues, suppliers, subcontractors or agents working on behalf of our company. The different channels for reporting misconduct are set out in our instruction on the reporting of misconduct. Internally, issues should be handled through the normal line-management route. If this is not feasible, the Group Compliance Officer or one of the Ombudsmen should be contacted. 

  The Group Compliance Officer has a direct reporting line to the Board of Directors, guaranteeing direct access to the Board in the case of misconduct in the Executive Committee.

  Information on how customers, employees and other stakeholders should report potential misconduct is published on the company website and intranet. Concerns may be reported to the internal and external Ombudsmen, ensuring the anonymity of the whistle-blower. 

Review

Based on the findings of a risk assessment, we introduced express training sessions, addressing the needs of employees in their daily work, and ensured export control compliance, subcontractor due diligences and further awareness-building around the reporting of misconduct.

Click the image above to see relevant tables and figures.

• Compliance

  No critical concerns were reported in 2017. There were no legal actions pending or completed during the reporting period regarding anti-competitive behaviour or violations of antitrust and monopoly legislation in which DNV GL was identified as a participant. We have not identified any significant fines or non-monetary sanctions for non-compliance with laws and/or regulations in the environmental, social or economic area.

• Governing documents

  A major revision of the Reporting of Misconduct instructions was published, further emphasizing the role of the Internal and External Ombudsmen. 

  The existing procedure for implementing the requirements of the EU General Data Protection Regulation, in line with the Binding Corporate Rules approved by the Norwegian data protection authorities, is revised.

• Subcontractors and intermediaries

  We have monitored the implementation of the Instruction on Subcontractors and intermediaries, as well as the application of due diligence checks in the different business areas. Respective training is planned for 2018 and there are still some more improvements to be made.

• Local gift guidelines

  We have evaluated the roll-out of our local gift guidelines. Most local implementations were satisfactory, while several countries need further guidance. Suitable actions have been taken.

• Rules for investigations

  Guidelines for front-desk officers regarding rules in the case of investigations have been distributed in the organization.

• Measures for high-risk countries

  We continued to implement extra measures in countries with a high risk of fraud and corruption. As part of the inter-active e-learning training for employees provided in high-risk countries, we gathered feedback on theoretical fraud and corruption scenarios in our organization. This feedback will be used in awareness initiatives in 2018.

• Export control network

  The process of establishing an extended global export control network, which started in 2016, continued in 2017 with the nomination of responsible persons by business area CEOs. Furthermore, locally improved processes were developed, starting in Germany. Classroom training on export control law took place and an e-learning on export control laws and sanctions was developed. Measures to ensure compliance with export controls and sanctions were increased in key countries, starting with classroom training. An internal document was published to provide an overview of existing sanctions and guidance for all business dealings with a connection to Russia and/or Crimea and Sevastopol.

• Automatic sanctions checks
  Automatic sanctions checks were extended to include another of our customer relationship management tools used by operational business.
• Training

  The existing e-learning modules for the Code of Conduct and Anti-Corruption and Antitrust are mandatory for all permanent and temporary employees. 98% (97%) of all employees had completed the Code of Conduct e-learning module, while 97% (83%) had completed the Anti-Corruption and Antitrust e-learning module. 

  Interactive team training on anti-corruption and fraud for highrisk countries was rolled out in all high-risk countries in 2017. By the year-end, 91% of employees in the designated high-risk countries for 2015–2017 had been trained. In the discussions, employees described typical corruption scenarios, and actions for avoiding these scenarios were developed in subsequent discussions. The result of this feedback will be incorporated into further awareness measures in 2018. 

  A new e-learning module on export controls and sanctions was developed to help employees handling export control matters in all business areas to learn about the main aspects of export control laws and sanctions. This module will be rolled out in 2018. 

  A new express learning on the reporting of misconduct was prepared to create further awareness. This training will be mandatory for all employees and is to be rolled out in 2018. 

  To further increase awareness of relevant staff handling of personal data, the e-Learning on personal data protection was also rolled out in the HR units in all business areas. 

  A new express learning on personal data protection was rolled out in 2017 as a refresher for employees in relevant functions, explaining central principles of personal data protection and providing examples of where they are relevant and important in everyday work.

• Communication
  The Compliance Officer continued to present updates and highlights concerning the compliance programme to the Control Committee, Board of Directors and Executive Committee, as well as at several Country Chair meetings. The global compliance network continues to actively raise awareness of compliance issues in its members’ respective countries and to help communicate the compliance programme.