Optional_2023 Board Resources

Department is responsible for ensuring that any identified findings are addressed and that process controls are developed to correct deficiencies and prevent findings in the future. Measures to Respond to Violations What is the process by which the organization evaluates and responds to suspected compliance violations? How are reporting systems, such as the compliance hotline, monitored to verify appropriate resolution of reported matters? • In accordance with the Reporting and Investigating Potential Compliance Issues policy, all employees must immediately report any potential compliance issues to their supervisors, department managers or directors, Compliance Officers, the Ethics & Compliance Department, or the ComplyLine. This requirement is widely publicized and discussed in Banner’s compliance materials. The Ethics & Compliance Department leads or participates in any investigation involving potential compliance issues. • Compliance matters that are reported through the ComplyLine or through other reporting means are handled by the Ethics & Compliance Department in an appropriate, timely, and, when requested, confidential manner. Does the organization have policies that address the appropriate protection of “whistleblowers” and those accused of misconduct? • Banner has a non-retaliation policy to protect employees who brings forward any good faith compliance question or concern. Banner encourages employees to ask questions and report problems while ensuring that no one is disciplined until a thorough investigation has occurred. All certifying employees as well as their direct reports under Banner’s CIA will be requested to complete exit interviews before leaving employment at Banner in order to identify potential compliance issues. What is the process by which the organization evaluates and responds to suspected compliance violations? What policies address the protection of employees and the preservation of relevant documents and information? • Suspected compliance violations are investigated by or under the direction of the Ethics & Compliance Department. The investigation may include obtaining documents, conducting interviews, and/or performing other activities as appropriate. The investigator(s) also may involve the Legal Department and/or outside legal counsel. • Employees are protected by the system’s non-retaliation policy. The system’s Records Retention and Destruction policy provides instructions on when records and documents may be destroyed and when they must be retained. What guidelines have been established for reporting compliance violations to the Board?

5.