Welcome to MySafeWorkplace® Training for Enterprise Portal Users COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Overview Introduction to MySafeWorkplace® Benefits of MySafeWorkplace® Company Policies Possible Topics to Report Service Availability How to File a Report Anonymity Options Report Distribution Checking Report Status Frequently Asked Questions COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Development History Business Controls’ investigative experience and extensive employee interviews determined that employees often knew about violations, but had no resource to report them and feared retaliation BCI formulated a safe and confidential tool for employees to report incidents anonymously In existence since 1999, two years prior to Sarbanes-Oxley Used by more than 1 million subscribers in over 20,000 locations and 80 countries worldwide COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

MySafeWorkplace® Overview 24 / 7 / 365 hotline and internet reporting available throughout the world Unique offering of 3 anonymity levels, allowing for additional and continued anonymous communication with the reporting party Instantaneous notification of reports sent to management based on incident type, location, and organization Automatic tracking and retention of reports, investigatory notes, and communications with the reporting party Trending and analytics available, as well as basic statistics by type and location COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Confidential and Proprietary

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Benefits Comply with legislation SOX OSHA Federal Sentencing Guidelines Provide early-warning of misconduct Manage risk and mitigate litigation Support good faith investigation Automated distribution of reports eliminates opportunity for human intervention and preserves report integrity as submitted by the reporting party Create inhospitable environment for misconduct Create safe environment for employee COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Additional Service Consultations with in-house fraud examiners, corporate investigators, behavioral science specialists, and other subject-matter experts on request Skilled call center, scalable and flexible to meet your needs Call center agents available 24 / 7 / 365 Multi-lingual capability (170+ languages) Calls answered by a live agent Call agents use the same report intake form as web users COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Confidential and Proprietary

MySafeWorkplace® An Added Employee Benefit This tool is NOT a replacement of current policies and procedures - it is an added benefit Employees should use the company’s current policies and procedures to bring forward concerns If an employees does feel comfortable with these procedures, or wish to stay anonymous, they should use MySafeWorkplace® COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Company Goals Insert summary of the company’s goals in providing a reporting tool for employees, and perhaps restate the company’s ethics, code of conduct, or other policies governing employee misconduct and reporting – and how MySafeWorkplace® will help you achieve your goals. COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Report Intake Portal versus Enterprise Portal The Report Intake Portal refers to the website used by employees and others to submit incident reports The Enterprise Portal refers to the website you will use to: Configure and maintain the tool for your use: Define incident types, locations, departments, and other configuration settings Define distribution settings used for automated routing and notification of reports Set up users and access levels Manage reports submitted: Access and manage incident reports Communicate with reporting parties COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Report Intake Portal Reports may be filed via web portal (Internet) or hotline (call center) May also be used as a case management tool for recording and tracking internal reports made through alternate avenues, such as an open-door policy Intuitive and easy-to-complete report form, includes: Definitions of terminology Required elements User Tools Spell-check and review before submission Ability to update before submission Ability to check status, communicate with organization COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Confidential and Proprietary

Report Intake Portal Available 24 x 7 x 365 by Phone and Internet Toll-free phone access Calls answered by a live agent Assistance available for over 170 languages Report submitted through the same website Access code and personal password provided to check the status of the report Internet access Easy to complete report form, including spell-check and review before submission Definitions provided where needed Access code and personal password provided to check the status of your report COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending What Can Be Reported? The company has customized a list of different incident types that can be reported, including: Theft or Vandalism Accounting/Audit Related Complaints or Concerns Compliance/Regulation Violations Discrimination Employee Relations Environmental Issues Ethics Violations Falsifying Documents Harassment Poor Customer Service Sexual Harassment Substance Abuse Unfair Labor Practices Unsafe Work Conditions Workplace Violence COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Make a Report www.MySafeWorkplace.com The reporting party can check on the status of their own report through the call center or website. The reporting party can speak with a live call center agent or use the website to submit a report. May 17, 2019

Organization Name Search Type in the company name in the search field, and then select it in the drop-down selection box below. Once completed, click on Next. May 17, 2019

Selection of the Incident Type The company has customized a complete list of incidents you can file a report on. May 17, 2019

Three levels of anonymity: Incident Report Form Locations and Departments can be selected from pick lists; or departments can be entered free-form. Three levels of anonymity: In addition to remaining anonymous or providing contact information, you may Remain Anonymous Toward Your Organization. At the organization’s request, MySafeWorkplace® can contact you for follow-up – which allows for ongoing communications while protecting your anonymity. The date and time of an incident can be specific or general (such as “last week” or “ongoing”). May 17, 2019

Importance of Anonymity Choices You decide whether or not to provide any contact information! Stay anonymous and do not provide any contact information Provide contact information - or - You may choose to Remain Anonymous Toward Your Organization, but provide MySafeWorkplace® staff with contact information. If you choose this option, the Company will not know who you are and will not know any of your contact information This option is very helpful to enable communications between you and the Company. If you do not respond to messages posted by the Company via the MySafeWorkplace® website, the Company can request that MySafeWorkplace® contact you on their behalf. You then have the option to view the message and respond via the website; or provide your response to the staff at MySafeWorkplace® who will post your reply. May 17, 2019

Select Location and Department Select the location where the incident occurred (a location selection is required) Select from the department drop-down list, enter a department name in the box provided, or bypass it entirely (department identification is not required) Select the date and time of the incident, either from the drop-down date and time fields, or enter an unspecified time in the box provided (such as “last week” or “ongoing” ) The only department associated with this location is ALL, and that is to be sensitive to your anonymity. Some departments may have only a couple of people associated with it and Corporate Express wanted you folks to have the ability to make the decision as to whether or not you would disclose which department/or area in this facility you work in. May 17, 2019

Follow-up questions are based on answers provided Incident Questions Only questions pertinent to the incident type will be displayed Accounting Error: What monetary loss? Follow-up questions are based on answers provided Threat of Violence: Were you the target? May 17, 2019

Spell Check Available You can check for any spelling errors prior to submitting your report and when you post any follow-up messages to the Company May 17, 2019

Suspected Involvement This feature allows you to identify the individuals you suspect may be involved. May 17, 2019

Submit Your Report Document Your Access Code and Password Note: Your report is NOT submitted until you see this screen! MSW123456789 ******** Instructions to log into the website or call back to check on your report Randomly generated access number unique for each report Your personal password, which you create Discuss wallet cards here! Possibly distribute or at the end…… May 17, 2019

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Report Distribution Reports are distributed within 3 minutes of submission Distribution is based on organization, location, and incident type selected Notification of reports can be done by email, including pager, PDA, or cell phone alert (via email address) COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

How to Check Report Status You are encouraged to check status within 24-48 hours of submission Two Ways to Check Report Status Go to www.MySafeWorkplace.com and click “Report Status” Call 800-461-9330 and ask for “Report Status” You MUST have your access number and password - both of which are provided upon submission of your report Anonymously communicate with your organization by using the Message Board (“Talk to Your Organization” button on the report form) May 17, 2019

Check Status www.MySafeWorkplace.com You can check on the status of your own report through the call center or website. May 17, 2019

Report Status Portal Login screen where you can access your report. You will enter your unique MSW Access Number and your Personal Password. May 17, 2019

Report Status and Message Board Status of reports will be either New, Reviewed, Action Pending, Closed, or Reopened Check for messages, reply to messages, or post new messages here Add more information to your report or reply to a message posted from the Company May 17, 2019

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Enterprise Portal Configure report distribution, manage and track reports, as well as define access for designated individuals – Enterprise Portal (EP) users EP users receive notification within three minutes of report submission based on incident type, location, and organization EP users review reports, communicate to reporting parties, capture case management notes, and close reports through the Enterprise Portal COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Confidential and Proprietary

Enterprise Portal Organizational User Types Overall system administration and management of users and distribution settings: Organizational Super Administrator (OSA) Full access and full notification of reports Determines appropriate internal escalation path and investigatory protocol for reports received Organizational Manager (OM) – full access; notification based on user groups Organizational Administrator (OA) – data entry function to create user records, locations, departments, etc. Report access and management Receive notifications and manage reports, including message boards, status changes, and priority settings Modify organization, location, or incident type selected by a reporting party in order to update distribution Assign EP users as needed to specific reports COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Enterprise Portal Additional User Types Report access and management Designated Recipient (DR) Access to specific reports, with or without notification, as assigned through distribution settings Utilize message boards for communicating with the employee (“Talk to Reporting Party”) Utilize message boards for communicating with other Enterprise Portal users responsible for investigation (“Investigatory Notes”) Change the status of a report Change the priority settings, if configured for use Cannot modify the organization, location, or incident type selected by the reporting party (or as modified by an Organizational level user) Cannot modify system configuration settings COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Enterprise Portal Additional User Types Information Only Read Only (RO) View-only access to specific reports, with or without notification, as assigned through distribution settings View-only access to message boards Cannot utilize message boards for communicating with the employee (“Talk to Reporting Party”) or for communicating with other Enterprise Portal users responsible for investigation (“Investigatory Notes”) Cannot change the status of a report Cannot change the priority settings, if configured for use Cannot modify the organization, location, or incident type selected by the reporting party (or as modified by an Organizational level user) Cannot modify system configuration settings COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Internal Protocols for Investigation and Communication Who should post messages? Investigatory notes? When is it appropriate to post messages? What should messages contain? (Standardized content, identification of contacts for the reporting party, reassurance of anonymity and confidentiality) Who is chiefly responsible for the investigation on a report? When, how, and to whom should issues be escalated? What are the specific protocols for investigations? How to maintain confidentiality of the report? COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

User Access Access the Enterprise Portal at: www.mysafeworkplace.com/company/login.aspx You will receive a welcome letter which will give you the URL above, your user name, and your initial system-generated password. When you first log in, you will be prompted to create your own personal password. Keep your user name and password confidential! If you forget your password or want to change it in the future, just click on the “Forgot your password?” link on the Enterprise Portal login page. COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Troubleshooting Tips Check your spam filters: be sure that support@mysafeworkplace.com is an accepted sender Check your browser settings: be sure that pop-ups are allowed from www.mysafeworkplace.com Pop-ups are used for message boards and print views. Check your ActiveX Control settings: Browser options Security settings Enable ActiveX Controls COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Enterprise Portal Login Enter your user name and system-generated password from your welcome letter (copy and paste works well) You will be prompted to create your personal password If you forget your password or want to change it, simply click on “Forgot your password?” COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Email Notification of Incidents Email provides a link to the report, but NO identifying information about the report itself, other than the incident type: “A new incident from MySafeWorkplace® requires your immediate attention. The reporting party selected the incident type XXXXX for this report. Click MSWxxxxxxxxx to view the incident.” All users initially assigned to the report are listed in the email You must log in to the Enterprise Portal to view a report If you do not review (open) the report, you will receive a reminder notification every 24 hours until you review the report. (This applies to ALL users assigned to a report who are receiving notifications.) COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Sample Email Link provided to the specific incident report, without disclosing any identifying or specific information, requiring authorized Enterprise Portal user login. List of other Enterprise Portal users who received Email notification Incident Type identified (as selected by the reporting party). Check spam filters – support@mysafeworkplace.com should be a “safe sender” External email addresses may need to be tested; or have notices routed from a company email address COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Incident Report Overview Filters to display your list by Organization, status, type, or priority – or any combination of all filters Navigation links to Incident Reports, Statistics, My Profile Message Board Postings (messages / replies) for Investigatory Notes (IN) and Reporting Entity (RE) messages “# of messages / # of replies” Listing of all reports you have access to; Incident Number is a link to the report itself. COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Incident Report Format General Information (date, time, and location of incident) Message Boards Investigatory Notes Reporting Party Logs of report status, users assigned, and view (who has accessed the report by date and time) Update functionality (distribution elements, priority, and status) Incident description, including Anonymity preference Questions / answers Suspected party exclusions COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Incident Report Format Message Boards Incident Submission Summary Status Log Update Distribution and Status Users Assigned Log Anonymity Level View Log Incident Description and Questions/Answers User Exclusions COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Grant/Remove Access to Reports Only available to “organizational” level users EP users may be added to or restricted from reports by using the “Grant/Remove Access” button and simply selecting the user and providing a reason for the change. An audit history is provided to track all changes to EP users assigned to a report. COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Enter subject line and message; spell check available before saving Message Boards Investigatory Notes (internal) – Allows Enterprise Portal users to post messages to each other and maintain case management information for each investigation. Investigatory notes are NOT viewable by the reporting party. Talk to Reporting Party (external) – Enterprise Portal users can communicate with reporting parties while maintaining the anonymity of BOTH parties. Messages may be marked as “Attorney Work Product,” which is a unique feature of MySafeWorkplace®. Enter subject line and message; spell check available before saving Final opportunity to modify message before it is saved! Once saved, the message CANNOT be deleted or modified. COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Report Status Types New – system assigned status when a report is submitted by a reporting party, and has not been opened or viewed by an EP user Reviewed – system assigned status at the point that an EP user opens and views a report Action Pending – a manually assigned status to indicate that action is being taken Closed – a manually assigned status to indicate that no further action is being taken Reopened – a manually assigned status to open a previously closed incident COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Important Steps to Take Open the report (remember, each assigned user must open the report – if not, a daily reminder email is sent until you do) Communicate via the message boards Acknowledge receipt of the report and next steps as appropriate If desired, give the reporting party your contact information Save important case management information in Investigatory Notes Proof your messages before saving, and be sure you are in the correct message board (investigatory notes versus talk to reporting party) Change the report status when appropriate COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Communication of New Service Expected launch date Employees notified of new service by: Posters Wallet cards Brochures Email Newsletters Employee handbooks Reminder that current policies and communication procedures are still in place – MySafeWorkplace® is an additional anonymous and confidential tool for employees COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

Your Role in the Communications Campaign What is your role in ensuring employees understand how and why to use MySafeWorkplace®? Will you be distributing printed materials and explaining MySafeWorkplace® to your employees? Do you understand the current policies and procedures for employees to raise concerns? COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Recap of MSW Benefits Facilitates compliance with the Federal Sentencing Guidelines and Sarbanes-Oxley 301 Allows you to “seek guidance” from Certified Fraud Examiners, Corporate Investigators, as well as Forensic Psychology experts Establishes an early warning system and creates an inhospitable environment for those individuals who know the system is in place Reduces: Corporate litigation exposure Losses from workplace misconduct, such as fraud, theft, and substance abuse Risk to employee safety and welfare Lets your employees know you care about their safety and value their opinions! COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending

COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending Thank You. We look forward to implementing this new employee benefit! www.MySafeWorkplace.com 800-461-9330 COMPANY CONFIDENTIAL (c)2012 Convercent Patent Pending