CONTROL TRANSITION POLICY

Prepared By:

Approved By:

Revision Date:

Effective Date:

The purpose of this policy is to establish procedures for ensuring the continued integrity of the company’s internal
controls system. The company experiences periodic personnel and process changes, which result in changes to
business processes and to who is responsible for the ownership and execution of internal controls. This policy is
designed to ensure the timely transition of internal control responsibilities and the continued and ongoing
execution of key controls. Moreover, this policy ensures that the company’s internal control documentation is
maintained throughout the year to reflect the actual controls in place and the individuals responsible for the
execution of such controls.

RESPONSIBILITIES

CORPORATE AND DEPARTMENT MANAGERS

• Maintain effective internal controls within business processes.
• Assess the impact of personnel changes on internal controls and remediate accordingly.
• Participate in process improvement teams.

CORPORATE AND DEPARTMENT HUMAN RESOURCES

• Provide periodic listings of personnel changes to corporate compliance.

DIRECTOR: CORPORATE COMPLIANCE

• Ensure that internal control documentation is kept current.
• Assess and consult on the impact of personnel changes on internal controls.
• Assess and consult on the compliance of process changes within corporate policy.

PROCESS IMPROVEMENT TEAMS

• Work toward global standardization of financial business processes.
• Standardize internal controls.
• Optimize internal control design.
• Identify and implement “best practices” to be communicated and implemented worldwide.
• Design controls to be automated and preventive rather than manual detective.
• Identify and share cost-saving opportunities.

1 Source: [Link]
 POLICIES

Upon termination, transfer of an employee, or a change in an employee’s responsibilities, management must

assess the impact of these changes on the design and execution of management’s internal control system. Each
department manager's responsibility is to ensure that the system of internal controls within their area of
responsibility is maintained after any personnel changes. Each department manager should assess the impact of
personnel changes on their department’s internal controls, including segregation of duties, and ensure that any
necessary changes are implemented immediately to ensure that controls' design and operating effectiveness
remain intact throughout the year. The local controller should be consulted on the adequacy of the changes made
to address any control gaps identified.

Suppose local management determines that a personnel change will adversely impact the system of internal
controls. In that case, such a change should be reported to the corporate controller, as well as the director-
corporate compliance. The corporate controller and director-corporate compliance will work with management to
determine the change's potential impact and identify any mitigating controls that may be required.

Changes in employee status must be reported to the director-corporate compliance or designee to assess the
impact of this change on internal controls, including the segregation of duties. Any impact must be addressed as
soon as practicable based on the related risk. Related internal control documentation is also to be updated in a
timely manner to facilitate management’s annual assessment of internal controls and their quarterly identification
of significant changes in internal control.

PROCEDURES

PERSONNEL CHANGES
Prior to terminating an employee or performing any personnel changes, management needs to evaluate the
impact on internal controls that these changes will have. This should include ensuring that controls continue to
operate as designed, key controls continue to operate effectively on an ongoing basis and no segregation of duty
conflicts arise as a result of the changes. Business process owners should discuss their concerns regarding the
impact on controls with the department, corporate controller, director of the internal audit or director of
compliance. Once personnel changes are executed, it is the managers of the business process to maintain
effective controls within their processes. Responsible managers should ensure that personnel taking on new
control responsibilities are competent to perform the control, can do so, and are trained on the proper execution of
the controls for which they are responsible, including periodic follow-up by management, or “self-testing” to ensure
the continuing operation of key controls.

Monthly, each department’s human resources group lists all terminations and title changes to the director of
corporate compliance. Corporate compliance will determine if any noted personnel are in the internal control
database as control owners. If so, corporate compliance will work with the local process owners to determine the
change's impact and confirm that management has transitioned ownership of the control to another comparable
employee. Corporate compliance will assess the segregation of duties impact and make any necessary
recommendations to the local process owner. Corporate compliance will ensure that business process and
internal control documentation are properly updated to reflect the changes made.

One to three months after any changes in process owners, corporate compliance will perform limited remote
testing of the controls impacted by personnel changes to ensure that the control continues to operate effectively.
The results will be reported to the local business process owner, department controller and corporate controller.

PROCESS IMPROVEMENT TEAMS

Local managers are responsible for maintaining an effective system of internal controls within their areas of
oversight. Management also ensures that controls are executed cost-effectively. The company strives for
continuous improvement of its business processes.

2 Source: [Link]
The company management will establish process improvement teams for each major financial business process.
Each team will have a designated team leader responsible for coordinating and leading team meetings. The
purpose of the process improvement teams is to:
• Work toward global standardization of financial business processes.
• Standardize internal controls.
• Optimize internal control designs.
• Identify and implement “best practices” to be communicated and implemented worldwide.
• Ensure that design controls are automated and preventive rather than manually detective.
• Identify and share cost savings opportunities.

Process improvement teams consist of the designated team leader and the managers responsible for the
business process at each location. For instance, the accounts payable process improvement team would consist
of the accounts payable manager for each location and the team leader (who may also be the manager from one
of the locations).

Each process improvement team must meet formally at least once per quarter; however, monthly meetings are
recommended. During these meetings, teams will discuss the internal controls in place at each of their locations,
identify and discuss the impact of any personnel or process changes at the various locations, and identify best
practices and work to determine methods to shift the control environment from manual detective controls to
automated preventive controls.

BUSINESS PROCESS CHANGES

Local managers are responsible for maintaining an effective system of internal controls within their areas of
oversight. Management also ensures that the controls are executed cost-effectively. The company strives for
continuous improvement of its business processes.

As management and process improvement teams identify more cost-effective controls and measure and improve
the effectiveness and efficiency of their business processes, management must maintain accurate documentation
that reflects the existing system of internal controls to support and facilitate management’s annual assessment of
its system of internal controls, in compliance with Section 404 of the Sarbanes Oxley Act of 2002.

Any business process changes must be reported to the appropriate process improvement team. The director of
corporate compliance must be notified by either the process owner or the relevant process improvement team
lead. The director of corporate compliance ensures that the business process changes follow corporate
accounting policies and any other applicable corporatewide policies. Corporate compliance also ensures that
internal control documentation is properly updated to reflect the changes to support the annual assessment of
internal controls and related audits.

3 Source: [Link]