U.K. Modern Slavery Act 2015 Transparency Statement 2020

This Statement is made in accordance with Section 54 of the United Kingdom Modern Slavery Act 2015 (the Act) as it applies to Sophos Limited, a commercial organisation that carries on business in the UK, supplying goods and services and having a total annual turnover of £36 million or more, and all entities in the Sophos Group global structure (together Sophos, or the Group). This statement sets out the steps that have been taken during the financial year to 31 March 2020 to ensure that modern slavery is not taking place in the Sophos Supply Chain and in any part of our own business.

The Statement has been signed by Kris Hagerman, Chief Executive Officer, on behalf of Sophos Group companies and published on the homepage of the company website, www.sophos.com.

During the fiscal year ending 31 March 2020, the Group continued to prioritise the establishment and implementation of effective systems and controls as set out in the Sophos Modern Slavery Policy (the Policy) adopted in 2016, reflective of Sophos commitment to acting legally, ethically, transparently, and with high integrity in all our business dealings and relationships, particularly in its vendor and third-party partnerships where individuals are employed by them. The Policy sits alongside the existing Sophos Anti-Corruption Policy and the Sophos Whistleblowing Policy, both of which aid in the oversight and transparency of the Policy, and is available here: Sophos Modern Slavery Policy. Further, Sophos’ compliance with the U.K. Modern Slavery Act is designed and enforced as a comprehensive platform under which Sophos meets the broader demands of similar legislation, such as the The Commonwealth Modern Slavery Act 2018 (Australia), California Transparency in Supply Chain Act of 2010 (United States), and certain federal regulations in the United States.

  1. Company Structure and Business Model. – an overview of Sophos’ product capabilities, partnerships         and global reach.
  2. Risk Assessment- measurements applied to respond to possible risks in the environments where        Modern Slavery may exist.
  3. Company Governance and Policies- A description of operational policies, actions taken and measurements in place to ensure compliance with the Act.
  4. Procedures- an over view of the actions required of our supply chain and steps undertaken by the business regarding recruitment.
  5. Training and Awareness- an explanation of the training systems used to promote awareness amongst Sophos employees.
  6. Monitoring and Performance review- a description of the steps and indicators used to evaluate risk both through the supply chain and our business.

During the fiscal year ending 31 March 2020, the Group has focused on training, monitoring, and ongoing enforcement of the Group’s systems and processes to maintain high standards and has continually improved Sophos ability to see, understand, and effectively manage the risk of modern slavery in any form.

A. Company Structure and Business Model

Sophos is a leading global provider of cloud-enabled end-user and network security solutions, offering organisations end-to-end protection against known and unknown cybersecurity threats through products that are easy to install, configure, update, and maintain. The Group’s products are sold through its relationships with distributors and resellers. Sophos has approximately 3,000employees and although headquartered in the UK, it has 20 offices and a number of threat assessment labs, Sales, and product development centres around the world, including in Asia Pacific, Europe, the Middle East and North America.

Sophos saw significant growth in the number of its channel partners and end-users during the fiscal year and the Company’s current approach remains effective. As the business continues to grow however, we will continue to monitor our effectiveness, as discussed later in the statement, and adjust our approach to ensure it remains proportionate.

The Group’s supply chain in this context consists of many organisations made up of hardware manufacturers and suppliers, logistic fulfilment centres responsible for the distribution of our products, procurement vendors and recruitment and employment agencies from whom Sophos employees may be sourced (each a Supplier and together the SophosSupply Chain).  Sophos also has close working relationships with works councils in several overseas jurisdictions representing the interests and rights of its employees.

B. Risk Assessment

We consider that the principal areas in which Sophos faces risks related to slavery include:

  1. the Sophos Supply Chain and outsourced activities, Suppliers located in overseas jurisdictions;
  2. Sophos’ own business, including employment, internal policies and particularly recruitment through agencies.

The formal process for identifying, evaluating, and managing significant risks faced by the Group is overseen by the Board along with the Company’s Finance, Legal, and Compliance Teams. These Teams provide the business with a risk management framework, upward reporting of significant risks, Company policies, and standard operating procedures. 

The potential for non-compliance with the Act is assessed as part of this risk management process. Sophos undertakes this risk assessment with input from external advisers, the assessment criteria applied include business function and geography, together with the principles set out by Transparency International, The responsible Business Alliance Code of Conduct and the Global coalition against corruption.

Each Supplier is also assessed during the onboarding process and screened with the use of the Dow Jones Adverse media list. Suppliers are required to confirm they will comply with Sophos Modern Slavery Code of Conduct, complete the Slavery and Trafficking Risk Template (STRT) and the Conflict Minerals Reporting Template (CMRT).

The Group takes a two-pronged approach to risk identification: (i) a bottom-up approach at the business function level; and (ii) a top-down approach at the senior leadership team level. All identified risks are assessed against a pre-defined scoring matrix and prioritised accordingly. Any risks identified in the bottom-up approach deemed to be rated as higher risk are escalated in line with pre-defined escalation procedures for further evaluation.

C. Company Governance and Policies

The Board governing the Sophos Group companies has overall responsibility for ensuring the Policy complies with the Company’s legal and ethical obligations, and that all those under the control of the Company comply with the Company’s Modern Slavery Policy.

The Board provides oversight regarding the implementation of the Policy and monitoring of risks and issues raised in connection with it. The Policy recognises the Group’s responsibilities under the Act and applies to the Sophos Supply Chain and to all persons working for us or on behalf of the Company in any capacity, including employees at all levels, directors, officers, agency workers, seconded workers, volunteers, interns, agents, contractors, external consultants, third-party representatives and business partners.

During the period concerned, the Modern Slavery Policy has been reviewed and revised, and training has been provided to all employees.

A Conflict Minerals Policy has been developed, and employees in roles which are related to conflict minerals have been directed to read and state they have read this statement. 119 staff in Supply Chain, Product Management, Finance and Business Operations departments have completed Compliance training with regard to the Conflict Minerals Policy and procedures.

Any breach of the Policy by a Sophos Team Member may result in disciplinary action, and potential dismissal for an employee, and the likely termination of our relationship with a Supplier. A material breach of the Policy by a vendor or third-party may result in a termination of the business relationship and further actions, depending on the circumstances.

All those subject to the Policy are encouraged to raise concerns about any issue or suspicion of modern slavery in any part of our business or supply chains or those of any current or potential Suppliers, at the earliest possible stage. The Sophos Whistleblowing Policy provides a mechanism to enable employees and external entities, including those third-parties within the Sophos Supply Chain, to confidentially report matters of concern via the Whistleblowing Web Form or Hotline or directly to their line manager, or designated HR manager. All such matters reported to the WhistleBlowing portals are investigated and evaluated until concluded. Sophos’ Compliance Team has responsibility for both adherence to the Modern Slavery Policy and for investigating and evaluating WhistleBlower complaints. Where appropriate, such matters may be brought directly to the attention of Sophos’ Senior Management Team and, where appropriate, to the Risk and Audit Committee. Consistent with the Company’s WhistleBlowing Policy, the Sophos Group is committed to ensuring no one suffers any detrimental treatment as a result of reporting in good faith their suspicion.

D. Procedures

Suppliers: we take the following actions with respect to each Supplier:

  1. We inform all our new and renewed Suppliers in writing that we are not prepared to accept any form of exploitation in their business or any part of their supply chain, and give them a copy of our policy.
  2. All Suppliers are required to make an annual Sophos Modern Slavery Code of Conduct declaration stating that they are in full compliance with our policy. This declaration includes the identification of all parties that supply products to our Supplier to ensure extended supply chain information is known by Sophos and integrated into our management control processes;
  3. Suppliers are required to complete an annual questionnaire regarding their own actions in building and maintaining a socially responsible supply chain. This questionnaire was adapted from the Social Responsibility Alliance (SRA) Slavery and Trafficking Risk Template (STRT).  This is a new measure and has increased conversations regarding the subject of bonded labour and employee welfare.
  4. Suppliers are required to complete the Conflict Minerals Reporting Template (CMRT) a standardised reporting template developed by the Responsible Minerals Initiative (RMI)
  5. Suppliers have been asked to provide ISO 9001 and OHSAS18001 certification to evidence action they have undertaken in this matter. 
  6. We ensure that we can account for each step of our hardware manufacturing processes and we know who is providing the hardware to us that we resell.  This is done by using BOMcheck, an industry-wide regulatory compliance tool which is offered by ENVIRON. BOMcheck identifies companies that are part of the Sophos extended supply chain that supply components for our hardware products to our immediate Suppliers. Once identified, we conduct live monitoring of all these companies through an external 3rd Party and by running them through our HTRI management tool.  Any anti-corruption or modern slavery changes for a specific Supplier will trigger an immediate review and business investigation, together with identifying specific risk indicators and categories;
  7. Our standard supply chain contract templates contain anti-slavery provisions which prohibit Suppliers and their employees and sub-suppliers from engaging in modern slavery;
  8. We conduct regular risk assessments of our Sophos Supply Chain. in cases of high risk, we may request suppliers to provide a ‘Statement of Compliance’ on their actions to prevent slavery and to confirm that any concerns have been satisfactorily and promptly resolved;
  9. In cases of high-risk, we may also audit the Supplier and, as appropriate, we require them to take specific measures to ensure that the risk of modern slavery is significantly reduced. If slavery is identified in a business in the Sophos Supply Chain, the Group will require that immediate remedial action be taken and provide appropriate support to achieve the safest outcome for potential victims. The Group expects its Suppliers to engage constructively and responsibly, and to remedy any issues in a timely manner. Should the Supplier ultimately fail to resolve the situation to the Group’s satisfaction, their contract will be terminated;
  10. Should allegations of slavery in any part of the Sophos Supply Chain emerge, including from whistle blowers, the Group will comprehensively investigate any such allegations, if any slavery is identified, will take immediate action as set out above.

Our business: we take the following actions:

  1. We ensure all staff have a written contract of employment and that they have not had to pay any direct or indirect fees to obtain work.
  2. We ensure staff are legally able to work in the country in which they are recruited.
  3. We check the names and addresses of our staff (a number of people listing the same address may indicate high shared occupancy, often a factor for those being exploited).
  4. We provide information to all new recruits on their statutory rights including sick pay, holiday pay and any other benefits they may be entitled to.
  5. We continue to invest in the professional development, health and wellbeing of Sophos staff.
  6. We pay all Sophos employees in the UK at least the Living Wage (pro rata in the case of part-time employees; vacation students and interns are paid an allowance).
  7. If, through our recruitment process, we suspect someone is being exploited, the HR department will follow our reporting procedures.
  8. We conduct due diligence checks on any recruitment agency that we use to ensure that it is reputable and conducts appropriate checks on all staff that they supply to us.

E. Training and Awareness

Mandatory training is provided to all existing Group employees and new joiners alike and is required to be re-taken annually. Training is accompanied by an online resource facility which is available to all Group employees.  Refreshment of these materials is ongoing. Feedback is encouraged to develop improvement of Policy and future updates the training material for all Sophos employees.

F. Monitoring and Performance Review

Sophos engages an external compliance data provider on an ongoing basis, to audit the Sophos Supply Chain and keep it under review. Together with external compliance data, the Group monitors the performance of the Policy, along with the transparency provided via the Sophos Anti-Corruption and Whistleblowing Policies. The Group maintains a watching brief on the compliance of all Suppliers through live monitoring tools.  Any alert raised through this process will be subject to an internal review and where appropriate, a business investigation of the Supplier will be undertaken. During the fiscal year ending 2020, no material alerts were raised by our external compliance data provider concerning any Supplier, including recruitment agencies.

Indicators used to evaluate risk, include managing the risks in our own business.

Every endeavor is made to fully adhere to the requirements of the Modern Slavery Act 2015 in relation to our recruitment, employment and internal policies. The following measures support this.;

  1. Understanding the Sophos Supply Chain
    1. We can account for each step of our supply processes and we know who is providing goods and services to us;
    2. Our level of communication and personal contact with the next link in our supply chain and their understanding of, and compliance with, our expectations.
  2. Assessment, Code of Conduct and Statement of Compliance
    1. Number/percentage of new and existing suppliers satisfactorily screened using risk assessment tools and/or self-assessment questionnaires, including risk scoring and categorization;
    2. Number/percentage of suppliers who have signed our Code of Conduct;
    3. Number/percentage of suppliers who have provided a satisfactory ‘Statement of Compliance’ on their actions to prevent slavery, when so requested, and any concerns have been satisfactorily and promptly resolved;
  3. Reports on Concerns
    1. Number of reported concerns of slavery (including if there were none);
    2. Any material issues arising from implementation of the Policy were effectively escalated when the need arose;
    3. All concerns raised as a result of audits or allegations were promptly followed-up and resolved;
    4. How we responded to concerns raised or to issues found by screenings, assessments or audits and how we worked with suppliers to implement corrective action plans.
  4. Training and Awareness
    1. Number/percentage of relevant staff trained, informed or completed mandatory training.

Sophos takes seriously responsible sourcing decisions, development of plans to avoid brand damage, and complying with regulatory demands within the below legislation:

  • Modern Slavery Act 2015, United Kingdom
  • California Transparency in Supply Chains Act, United States
  • Federal Acquisition Regulations, United States
  • Trade Facilitation and Trade Enforcement Act of 2015, United States
  • The Commonwealth Modern Slavery Act 2018, Australia.

All Suppliers reviewed were validated down to the family tree level.  This indicates the number of entities that are contained in every Supplier’s corporate structure.

Conclusion

The Group’s position and approach to managing our compliance with the Act continues to evolve. However, the processes in place to ensure this will be kept under regular and effective review, and our performance against these requirements shall be routinely and robustly measured.

This statement is made pursuant to section 54(1) of the Act.

214ea3c31128414d983a6a18cfa25c3a.jpg

 

 

 

 

 

Read the Modern Slavery Act Transparency Statement 2018/19

Read the Modern Slavery Act Transparency Statement 2017

Read the Modern Slavery Act Transparency Statement 2016

affiliate-dark.png