Whistleblower scheme

WHISTLEBLOWER PROCEDURE
As at 18 February 2023
Whistleblower Protection Act
RSM Netherlands

1. Introduction

RSM Netherlands Holding NV and all its subsidiaries aim to realise a safe and ethical environment for all persons employed by us. Nevertheless, irregularities may occur. We invite everyone who works or has worked for us to report suspected irregularities. We would like to receive these reports with the aim of remedying possible irregularities. Moreover, pursuant to Article 27 Accountancy Organisation Regulation (VAO), we are required to have a whistleblower procedure.

This reporting procedure explains how to safely report suspected irregularities both internally and externally.

An irregularity is considered conduct or an event that is or may become an integrity incident or wrongdoing. An irregularity involves, for example, conflicts of interest, intimidation, careless handling of confidential information or failure to comply with procedures (at some point this may also qualify as an integrity incident). We speak of integrity incidents in the case of theft, bribery, fraud, abuse of power, insider trading, etc. In some cases, integrity incidents may develop into wrongdoing such as breaches of procurement rules, or serious environmental or security offences.

These and other key concepts are explained in Annexes 1 and 2.

When you follow the steps outlined in this procedure, your position in our organisation is protected. This means that no one in our organisation may treat you unfairly as a result of your report. Do you feel you have been disadvantaged? Please discuss this with your supervisor, managing partner or with our external confidential advisors at ArboNed: [email protected] (telephone: 06-29389058) and [email protected] (telephone: 06-83290323).

We consider it important that you feel completely free to report irregularities. After all, without reports, we are unable to remedy the irregularities.

2. Internal reporting procedure

You can report suspected irregularities to your supervisor or to a compliance officer. You may report verbally, by email or in writing by letter.

Your supervisor will then take care of handling the report. This means that he/she assesses (possibly after consulting the compliance department) whether a suspicion of an integrity incident or wrongdoing exists. If that is the case, your supervisor must immediately forward your report to the compliance officer, [email protected]. In all other cases, your supervisor handles the irregularity herself/himself. Your supervisor is obliged to provide you with feedback on how your report has been handled.

You may also report your suspicion of an irregularity directly to the compliance officer. You may choose how you wish to report to the compliance officer: in writing, by telephone or an interview (on location) within a reasonable period of time.

In case of any doubts about submitting a report, you always have the option of discussing it with your supervisor. Would you prefer a confidential meeting? Please contact our external confidential advisors. You may also request the confidential advisor to submit a confidential report on your behalf. In that case, your contact details will be known only to the confidential advisor and not to anyone else in the organisation.

Anonymous report

If you would rather not have your details known to anyone, you may also submit an anonymous report by sending a letter. When reporting anonymously, we cannot ask you any additional questions or provide you with feedback on the steps we take. And if we are unable to launch an investigation, we will not be able to provide you with an explanation. We prefer being able to contact you, therefore. An anonymous report will always be considered.

Advice

You may always ask another person to assist you. This could be someone from your business or private environment. You, the person assisting you and any third party involved may at any time request confidential advice from our external confidential advisors and/or from the advisory department of the House for Whistleblowers. For more information about this organisation go to Home | House for Whistleblowers. The advisory department of this organisation can be reached by telephone on 088-133 10 00 on weekdays from 9 a.m. to 5 p.m.

3. Procedure of the compliance officer

If you report an irregularity, integrity incident or wrongdoing verbally, we will record the conversation with your prior consent or the compliance officer will ensure a complete and accurate recording of the conversation. You will be given the opportunity to check the written record of the reporting conversation, correct it and sign for approval or approve it by email.
The compliance officer registers the report of the suspicion of an irregularity, integrity incident or wrongdoing received in the register and confirms receipt of the report to you by email without delay but at the latest within seven days after the report was submitted.
The compliance officer assesses whether your report qualifies as a suspicion of an integrity incident or wrongdoing.
If your report qualifies as an integrity incident or wrongdoing, the compliance officer will inform the Executive Board of RSM Netherlands (hereinafter the Executive Board) about the report and advise them on the investigation to be initiated.
If the report concerns the Executive Board, the compliance officer informs the Chair of the Shareholders' Meeting (hereinafter the Chair of the AGM) about the investigation to be launched. In this case, the Chair of the AGM, rather than the Executive Board, performs all the steps below instead.
The Executive Board decides on the approach of the investigation to be launched. It may be conducted internally or by an external agency in case of insufficient internal capacity or expertise on the subject.
If your report is not considered an integrity incident or wrongdoing, the compliance officer decides who can handle your report. This may be the compliance officer himself/herself, but he/she may also refer you to your supervisor or another officer in the organisation.
The compliance officer informs you about his/her assessment of your complaint, so that you are aware of the status of your report.
Your identity or information that could directly or indirectly reveal your identity will not be shared with anyone other than the compliance officer and (if applicable) the investigators, without your consent. Your identity will not be shared with the Executive Board. We will share your identity with other persons only following your written consent or consent by email.

4. Conducting an internal investigation

The Executive Board transfers the investigation to (external) investigators.
Unless there are serious objections, the Executive Board will inform you by email that an investigation has been launched, by whom it will be conducted and what the terms of reference of the investigation are. Such objections may arise in connection with the GDPR or confidentiality of service provision or client information. This confirmation by the Executive Board of the investigation also contains information regarding your option to consult our external confidential advisors should you need to do so.
Within three months of the confirmation of receipt of the report, the Executive Board will inform you about the substantive assessment and, if applicable, the follow-up to this report. If it is not possible to complete the investigation within three months, the Executive Board will inform you before the end of that period. In any case, during the investigation period the Executive Board will send you a progress report at least every four weeks.
The investigator/investigation committee will inform the person(s) to whom a report relates of the report, unless there are serious objections to this due to the content and approach of the investigation to be conducted. The investigator/investigation committee shall draw his/her attention to the fact that he/she can consult our external confidential advisors.
In conducting the investigation, the following principles are observed:
- the principles of Dutch and European privacy laws and regulations;
- data is collected lawfully and proportionally;
- unlawfully obtained data will not be used;
- both sides of the argument will be heard. If hearing both sides of the argument is not possible during the investigation, this shall take place at the latest before the decision is taken.
The investigator/investigation committee will afford you the opportunity to be heard. The investigator/investigation committee will ensure this is recorded in writing and will submit this record to you for the purpose of verification, correction, approval and signature. You will receive a copy thereof.
The investigator/investigation committee may also hear other parties, including the person(s) to whom the report relates. The investigator/investigation committee will produce a written record thereof and submit this record to the person who was heard for the purpose of verification, correction, approval and signature. The person who has been heard shall receive a copy thereof.
The investigator/investigation committee may inspect and request all documents of our organisation (all relevant information, such as paper documents, electronic documents, emails and other durable data carriers) that it considers reasonably necessary in order to conduct the investigation.
Employees may also provide the investigator/investigation committee with any documents that they reasonably deem necessary for the investigator/investigation committee to view for the purpose of the investigation, on their own initiative.
The investigator/investigation committee draws up a draft investigation report and shall give the whistleblower and the person(s) who is/are the subject of a report the opportunity to comment, unless there are serious objections to this from the perspective of privacy or (client) confidentiality. The parties' comments shall not form part of the final report and are confidential, therefore.
Next, the investigator/investigation committee adopts the investigation report and sends it to the Executive Board. The Executive Board sends a copy to the compliance officer, the whistleblower and the person(s) who is/are the subject of a report, unless there are serious objections to this from the perspective of privacy or (client) confidentiality.
If the investigation concerns the Executive Board, the investigation report will be sent to the Chair of the AGM, who will then provide the compliance officer, the whistleblower and the person(s) who is/are the subject of a report with a copy thereof, unless there are serious objections.
If the investigation concerned the Executive Board, the Executive Board or the Chair of the AGM decides on the basis of the report whether and, if so, what repressive and corrective measures ought to be taken.

Escalation

If during the process you do not agree with the position of the compliance officer or the Executive Board, you may report the suspicion of an irregularity, integrity incident or wrongdoing, possibly with the assistance of the external confidential advisors, to the Chair of the AGM.

5. External reporting procedure

We encourage you to report your suspicion of an irregularity internally, allowing us to resolve it internally. However, you may also report suspected wrongdoing directly to a competent authority. For competent authorities, please refer to the glossary (Annex 1). Under the Whistleblower Protection Act, you may only report suspicions of wrongdoing externally; you may not report suspicions of irregularities externally. The competent authority must inform you about the assessment within three months of receipt of the report and, if applicable, the follow-up of the report, unless that information could jeopardise the investigation or legal proceedings or is in breach of a legal obligation of confidentiality. The competent authority may extend this period once for three months, subject to sufficient justification. If you have reported to the wrong competent authority, that authority must seek permission from you, the whistleblower, to pass the report on to the correct competent authority. If you need information about who the competent authority is, you can contact the House for Whistleblowers or the external confidential advisors for this purpose.

6. Making your report public

If you do not receive any information from the competent authority within the three to six-month deadlines or receive notice that according to objective standards shows that your report is not being adequately addressed, you are also protected if you make disclosure in the public interest. This includes, for example, contacting the press.

The terms of three and six months relate to providing you with information about the progress of the investigation and actions taken as a result of your report. The investigation does not need to have been completed within those time limits.

You may also disclose your report immediately if you have reasonable grounds to believe that:

the wrongdoing may pose an imminent or real danger to the public interest;
there is a risk of prejudice in reporting it to a competent authority, or
the wrongdoing is unlikely to be effectively remedied.

Should you consider disclosing your report, we advise you to engage our external confidential advisors as the conditions for disclosing your report in the public interest are complex. Our external confidential advisors can, in confidence, assist you by explaining the path to be followed.

7. Confidentiality and protection

Confidentiality

All persons involved in the report or investigation are obliged to keep confidential data confidential, unless we have a legal duty to report. In any case, confidential information refers to the identity of the whistleblower and the persons alleged of wrongdoing, as well as trade secrets.

Protection in the event of reporting

You, the person assisting you, a legal entity assisting you, a third party involved, the compliance officer, the investigator(s) and any witnesses heard in an investigation may not be disadvantaged because of making a report. A condition of this protection is that you have reasonable grounds (fact-supported suspicion) to believe that the reported information is correct at the time of submitting the report. You are not required to provide evidence for your suspicions.

Protection in the event of disclosure

you have reasonable grounds to believe that the reported information is correct at the time of submitting the report. you are not required to provide evidence for your suspicions, and
you have first submitted an internal report to the compliance officer and a competent authority or reported directly to a competent authority and you have reasonable grounds to believe that the investigation is not progressing sufficiently, or
you have reasonable grounds to believe that:
- the wrongdoing may pose an imminent or real danger to the public interest;
- there is a risk of prejudice in reporting it to a competent authority, or
- the wrongdoing is unlikely to be effectively remedied.

No longer entitled to protection

Those who deliberately and knowingly report or disclose false or misleading information (the criteria for assessing this are based on the Dutch Penal Code), have no protection and may even be penalised for doing so. The person assisting you, third parties involved, the compliance officer and the investigator do not lose protection in this case as long as they themselves are not guilty of intentionally and knowingly reporting or disclosing false or misleading information.

Protection remains in place if you reported with the correct intentions and your report was ultimately found to be unfounded.

8. Prejudice

If, despite the statutory prohibition on prejudice, you believe that you are being prejudiced, or that there is a threat or attempt to be disadvantaged, please contact your supervisor and/or managing partner, or our external confidential advisors to discuss the matter. Prejudice is also understood to include a threat and an attempt of prejudice. You may also consult with the advisory department of the House for Whistleblowers. The advisory department can be reached by telephone on 088– 133 10 00, on working days from 9 a.m. between 5 p.m.

9. Liability waiver

You, the person assisting you, a third party involved, the compliance officer and the investigator(s) may not be held liable by reporting wrongdoing or disclosure thereof when:

you do not share more than is necessary to submit the report;
when you have submitted or disclosed the report according to the steps specified in this procedure.

However, you, the person assisting you, a third party involved, the compliance officer and the investigator(s) may be held liable when the acquisition of or access to information is a punishable offence.

10. Processing of personal data

We process the following personal data within the scope of this reporting procedure: name, position, (email) address and telephone number of the whistleblower, the person(s) who is/are the subject of a report and, if applicable, the confidential advisor and/or third parties involved.

We apply the principles for processing personal data, as included in our Privacy Statement Privacy statement | RSM | AUDIT | TAX | CONSULTING. We process personal data obtained only for the purpose for which we obtained the personal data and only for the period for which the data processing is necessary. We destroy the personal data after 12 months from the time of submission of the report in the event that the report has been determined to be inadmissible, or when the investigation has shown that there is no irregularity. If an irregularity is found following an investigation, we will anonymise the investigation file after a maximum of one year after completion of the investigation. The file of your report is stored in the protected archive of the compliance office and can also be inspected there.

ANNEX 1: TERMS

In this procedure, we use the following terms:

third party involved: a. a third party related to the whistleblower who may be disadvantaged by the whistleblower's employer or a person or organisation with whom the whistleblower is otherwise related in a work-related context, and b. a legal entity owned by the whistleblower, for whom the whistleblower works or with whom the whistleblower is otherwise work-related;
competent authority:
- Authority Consumer and Market (ACM)
- Netherlands Authority for the Financial Markets (AFM)
- Dutch Data Protection Authority (AP)
- De Nederlandsche Bank (DNB)
- Financial Supervision Office (BFT)
- House for Whistleblowers
compliance officer: the officer appointed as compliance officer who acts as the reporting point for the purposes of this procedure. This is Monica Versteegh, who can be reached at [email protected] and on 06 510 437 67;
Executive Board: the Executive Board of RSM Netherlands
integrity incident: conduct or event that poses a serious threat to the integrity of the business of the company concerned;
whistleblower: a natural person who, because of his future, current or former employment with our organisation:
- reports an irregularity or integrity incident internally.
- reports or discloses a suspicion of wrongdoing (internally and/or externally).
wrongdoing:
- a violation or risk of violation of European Union law; or
- act or omission involving the public interest due to:
- a violation or risk of violation of a statutory regulation, or internal rules constituting a concrete obligation and that have been established by a legislator on the basis of a statutory regulation, or
- a danger to public health, to the safety of persons, a risk of damage to the environment or to the proper functioning of our organisation as a result of improper conduct or omission. In any case, the public interest shall be considered to be at stake if the act or omission does not only affect personal interests and either shows a pattern or has a structural character or the act or omission is of a serious or extensive nature.
irregularity: conduct or event that is or may become an integrity incident;
violation of European Union law: act or omission that:
- is unlawful and relates to certain Union acts and policies (see Annex 2 to these rules), or
- undermines the purpose or application of the rules in Union acts and policies (see Annex 2 to this procedure).
confidential advisors: those appointed by the Executive Board to act as such for our organisation:

Astrid Ooyer
Social worker / ArboNed confidential advisor
Telephone: 06 29 38 90 58
Email: [email protected]
Office: Amsterdam
Working days Monday, Tuesday, Thursday and Friday

Joost de Kruiter
Social worker / ArboNed confidential advisor
Telephone: 06 83 29 03 23
Email: [email protected]

Offices: Tilburg and Eindhoven
Available on Monday, Tuesday, Thursday and Friday

Chair of the AGM: the Chair of the RSM Netherlands Shareholders.

ANNEX 2

For a complete overview of all EU Directives an EU violation may relate to, see the Annex of the EU Directive.