Michael J. Bridwell John F. Kuckelman Implementing an Effective Anti-Corruption Compliance Program: Lessons Learned Michael J. Bridwell John F. Kuckelman

Getting Started There is no one size fits all Tone at the Top Examples and benchmarking are useful But in the end your program will need to be customized Unfortunately, there is not an FCPA compliance program in a box Most important advice: develop a program that is risk-based Tone at the Top Need executive leadership to sponsor the program Keep them informed and involved 2/23/2019 Company Confidential Copyright © 2008 Eli Lilly and Company

Getting Started (cont.) Core Team Formation Legal and Compliance experts Don’t forget Privacy Law! International finance expert Trainer Project manager Communications expert Consider subject matter experts from functions Steering Committee/Advisory Committee International Cross-functional Leadership 2/23/2019 Company Confidential Copyright © 2008 Eli Lilly and Company

Getting Started (cont.) Consultants They are good sources for examples and benchmarking But you know your business better than they do Outside Counsel They must understand your industry and your business to give you good advice Knowing what their last client did may be helpful to you, particularly if they worked with someone else in the industry But trying to do exactly what their last client did will not be helpful to you, particularly if their last client was not from your industry 2/23/2019 Company Confidential Copyright © 2008 Eli Lilly and Company

Getting Started (cont.) Get out of your office and go talk to the business Meet with any function that does business outside the United States or that pays third parties from outside the United States Identify the transactions that are highest risk Payments to foreign officials Payments to third parties who interact with foreign officials on your behalf Identify the policies and procedures already in place that help protect the company Identify where the anti-corruption program will fit in to existing business processes 2/23/2019 Company Confidential Copyright © 2008 Eli Lilly and Company

Developing the Program Go back to executive leadership and tell them what you plan to do Get feedback from your steering committee/advisory committee Get feedback from the affected functions Conduct pilots Regional Latin America Europe Asia Corporate Headquarters Conduct focus groups Program enhancement Use the pilots to gather real time data to update/enhance the program Rinse and Repeat 2/23/2019 Company Confidential Copyright © 2008 Eli Lilly and Company

Implementing the Program Conduct Live Regional Rollouts “Train the Trainer” Latin America Europe Asia Corporate Headquarters Give clear direction on what it means for them to implement at the local level Set-up bi-weekly conference calls for implementation teams Over communicate Use Senior Management at Regional Workshops to show support of the program – “Tone at the Top” 2/23/2019 Company Confidential Copyright © 2008 Eli Lilly and Company

Implementing, cont’d Be prepared to spend a lot of time talking to people What seems obvious to you is not obvious to them Language Culture Privacy Do not underestimate the impact of privacy law on your program Do not underestimate the time needed to notify DPAs Data Management paper based system electronic solution 2/23/2019 Company Confidential Copyright © 2008 Eli Lilly and Company

Post-Implementation Monitor Audit Learn from internal investigations Follow FCPA legal developments SEC and DOJ releases Improve and enhance your program Drop what is not necessary Add what is necessary to fill gaps 2/23/2019 Company Confidential Copyright © 2008 Eli Lilly and Company