Interview – Ocyan’s program to mitigate risks in contracting third parties

Relations with third parties is a constant concern for any organization and at Ocyan it’s no different. The company is alert to existing risks and a joint effort by the Compliance and Procurement departments launched in 2017 is yielding important results, besides underlining Ocyan’s commitment to a more ethical and transparent business environment.

Today, with more than 2,000 active suppliers and service providers, Ocyan continuously works to qualify and monitor its partners on legal, tax, financial, technical, environmental and compliance aspects.

We talked to Gilberto Couto, Chief Compliance Officer of Ocyan, about the importance of suppliers to maintain an ethical, reputable and transparent environment. Read the interview!

What is the importance of involving suppliers in Compliance processes?
Compliance of third parties is one of the key elements of an effective integrity program since, according to the Brazilian Anti-Corruption Law, the contracting party can be held liable for wrongdoings committed by third parties even if it alleges ignorance of said acts. In this regard, we should assess beforehand the risk of contracting any supplier through a process called Due Diligence or Know Your Supplier (KYS).

What should team members observe before and after contracting?

At Ocyan, contracting of suppliers and service providers follows a process flow under the responsibility of the Procurement area, with the Compliance area participating in the due diligence process. That’s why, team members from the Procurement area are constantly trained by the Compliance team on the risks involved in each negotiation. Other team members must follow all the procedures defined in the corporate guidelines and procedures, and must properly manage the contract and report any irregularities.

What are the requisites evaluated in the due diligence process at Ocyan?

The due diligence process at Ocyan differs from most in that it’s a proprietary methodology that is customized according to the risks mapped. We set out to evaluate 100% of the suppliers and today, for a supplier to be registered with Ocyan, they must compulsorily undergo due diligence regardless of their operating segment or the value of the contract to be signed.

This process begins with a questionnaire to be completed by the supplier in order to identify Compliance-related red flags, which will subsequently be analyzed in greater detail to determine the risk of this supplier. This in-depth analysis considers the risks of corruption, reputation, possible conflicts of interests with team members, presence of public agents or politically exposed persons in the ownership structure, risk of fraud and money laundering, and inclusion in blacklists, and also evaluates the level of maturity of the supplier’s Integrity Program.

Based on the information obtained, the Compliance department classifies the supplier’s risk (low, medium, high or critical), issues an opinion and sends it to top management for decision-making, according to the predefined hierarchy of approvals, which may accept or reject the contracting of the supplier.

What are the parameters for a company to be considered medium and high risk at Ocyan?

Supplier risk classification at Ocyan results from a series of analyses in which the risks identified are categorized according to their significance and the potential impact on contracting, considering the existence and the level of maturity of the Integrity Program that was presented. It is a thorough analysis that will determine whether the identified risks are duly addressed by the supplier or if we will have to take additional measures in order to contract that supplier.

Ocyan has a training program for suppliers who undergo due diligence. What are the issues addressed?

In 2018, we designed an e-learning training program, targeted specifically at medium, high and critical-risk suppliers, to train them on the concepts established in the Anticorruption Law and Ocyan’s Code of Conduct for Third Parties, besides instructing them on the behavior expected in their relations with the company. The training material is objective, easy to understand and presents three hypothetical situations with questions and answers that guide the supplier on how to act and to report irregularities, when applicable.

After participating in the training session, do suppliers go through a new evaluation process? Is there any specific process for these companies that are classified as having higher level of risk in order to mitigate the risks for Ocyan?

Suppliers classified as medium or high risk are submitted to specific hierarchies of approval and constantly monitored by the Compliance team and by the Compliance and Ethics Committees regarding the contract management, payment flow and materiality of deliveries, but the idea is that the risk situation will not remain for long. The challenge today is to help suppliers implement measures that can mitigate the vulnerabilities that earned them higher risk classifications.

What are the biggest challenges faced by Ocyan in terms of Compliance today?

We seek to achieve excellence in what we do and that means constantly evaluating the effectiveness of our program, making adjustments whenever necessary and encouraging Ocyan’s team members to reflect on any risks before taking decisions. With regard to the market, our challenge is to contribute to the oil and gas segment through the Compliance Commission of the Brazilian Institute of Oil, Gas and Biofuels (IBP), the adoption of controls and measures that are common to all companies, thereby reducing costs, and raising the ethical and integrity standards across the industry. Signing the Pact for Integrity in the segment in 2018 was merely the first step.