Whistleblower Policy

1. OVERVIEW
At Standards Australia Limited (SA) we are guided by our company values. These values are the foundation of how we conduct ourselves and interact with each other, our clients, members, supplies, and other stakeholders. SA is committed to ensuring corporate compliance and promoting ethical corporate culture by observing the highest standards of fair dealing, honesty and integrity in our business activities.

2. PURPOSE
The purpose of this policy is to encourage the reporting of any instances of suspected unethical, illegal, corrupt, fraudulent or undesirable conduct involving SA’s business and provides protection and measures to individuals who make a disclosure in relation to such conduct without fear of victimisation or reprisal.

3. SCOPE
This policy applies to any person who is, or has been, any of the following with respect to SA:

• Employee
• Officer
• Director
• Contractor (including sub-contractors and employees of contractors)
• Supplier (including employees of suppliers)
• Consultant
• Auditor
• Associate
• Relative, dependant, spouse, or dependant of a spouse of any of the above

This policy is publicly available on our website and through internal information systems. In this policy, ‘our’, ‘us’ and ‘we’ refer to SA, and ‘you’ and ‘your’ refer to other persons as defined in the Scope of this document, e.g., employees, officers, directors.

4. REPORTABLE CONDUCT
You may make a report or disclosure under this policy if you have reasonable grounds to believe that SA, or a company director, officer or employee has engaged in conduct (Reportable Conduct) which is:

• Fraudulent or corrupt
• Illegal, such that it constitutes an offence:
  - or a contravention of, a provision of relevant legislation such as the Corporations Act 2001 or the Australian Securities and Investments Commission Act 2001; or
  - against any other law of the Commonwealth that is punishable by imprisonment for a period of 12 months or more
• A breach of trust and a breach of duty
• Oppressive or negligent
• Misconduct or an improperstate of affairs
• Misconduct or an improper state of affairs
• A danger orrepresents a dangerto the public or financialsystemA danger, or represents a danger to the public or financial system

For example:

• Evidence of an SA employee accepting bribes inconnection with SA's standards development activities would amount to Reportable Conduct because it is fraudulent and corrupt conduct
• Evidence of historical manipulation or falsification of company records would amount to Reportable Conduct because it is an improper state of affairs, and because it is fraudulent conduct

A report that is not about Reportable Conduct will not qualify for protection under this policy.
‍
For the avoidance of doubt, Reportable Conduct does not include personal work-related grievances which do not qualify for protection under this policy. These grievances should be reported to your manager inaccordance with the Grievance Policy. A personal work-related grievance is a grievance about any matter in relation to an employee’s current or former employment, having implications (or tending to have implications) for that person personally and does not have broader implications for SA.

Examples of personal work-related grievances are as follows:

• An interpersonal conflict between the employee and another employee
• A decision relating to the engagement, transfer or promotion of the employee
• A decision relating to the terms and conditions of engagement of the employee
• A decision to suspend or terminate the engagement of the employee, or otherwise to discipline the employee

However, a personal work-related grievance may still qualify for protection if it also includes information about Reportable Conductor the grievance suggests misconduct beyond your personal circumstances. It may also qualify for protection if it relates to breaches of employment or other laws punishable by imprisonment for 12 months or more, or the information relates to conduct that represents a danger to the public. A personalwork-related grievance may also still qualify if it relates to the suffering from or threatening of detrimental conduct for having made a qualifying disclosure about Reportable Conduct.

To be clear, if you make a disclosure about Reportable Conduct and that disclosure turns out to be incorrect, you may still qualify for protection under this policy.

5. MAKING A DISCLOSURE
We rely on you to maintain a culture of honest and ethical behaviour. Accordingly, if you become aware of any Reportable Conduct, it is expected that you will make a disclosure under this policy. It is important that you make a disclosure of Reportable Conduct through the appropriate channels to the right people – a disclosure will only qualify for protection if it relates to Reportable Conduct and is made to someone who is eligible toreceive and act upon the disclosure.

There are several ways in which you may report or disclose any issue or behaviour which you consider to be Reportable Conduct.

When making a disclosure, it is expected that you will provide as much detail as possible including any evidence to assist in a fair, accurate and timely investigation.

5.1. Reporting
You may disclose any Reportable Conductto any of the Whistleblower Protection Officers (WPO) via email:

• Chief Operating Officer
  Katrina Eadie
• General Counsel
  ‍Christina Forsyth‍

The role of the WPO is to receive and act upon disclosures that qualify for protection. If you are unable to use any of the above reporting channels, a disclosure can be made to an Eligible Recipient. Eligible recipients include:

• Officers
• Directors
• Senior Managers
• Auditor or member of an audit team conducting an audit of SA
• External Audit Partner – Kym Reilly of PKF(NS) Audit & Assurance Limited Partnership

The WPO or Eligible Recipient will safeguard your interests and will ensure the integrity of the reporting mechanism. If you have any questions or wish to find out more about your protections as an Eligible Whistleblower, you may contact the WPO and make general enquiries for more information.

Be aware that a disclosure will only attract protection if it is made to the WPO or to an Eligible Recipient, or otherwise to a relevant independent person (see Reporting to Regulators and Reporting to a Legal Practitioner).

5.2. Anonymity
When making a disclosure, you may do so anonymously. It may be difficult for us to properly investigate the matters disclosed if a report is submitted anonymously and therefore, we encourage you to share your identity when making a disclosure. However, you are not required to do so, and you may still qualify for protection even if you wish to maintain anonymity. We have procedures in place to protect your identity, including:

• Applying redactions on written disclosures
• Referring to you in gender-neutral terms
• Communicating with you through anonymous email addresses
• Limiting access to information on a need-to-know basis; and
• reminding each person involved that the disclosure and any associated process is strictly confidential and that a failure to comply with confidentiality requirements could result in disciplinary action

5.3. Reporting to Regulators
You may also make a disclosure to the Australian Prudential Regulation Authority (APRA), or Australian Securities and Investments Commission (ASIC) in relation to Reportable Conduct. Disclosures to these regulators will be covered by the protections outlined in this policy.

5.4. Reporting to a Legal Practitioner
You may choose to discuss your concerns with a legal practitioner for the purpose of obtaining legal advice or representation. You will be covered by the protections outlined in this policy if you have reported your concerns to a legal practitioner.

5.5. Public Interest and Emergency Disclosure
In certain situations, the conduct or wrongdoing may be of such gravity and urgency that disclosure to the media or a parliamentarian is necessary. In such cases, you may make a 'public interest disclosure' or an'emergency disclosure'. Both public interest disclosures and emergency disclosures will qualify for protection under this policy – however, you should note and understand that there are specific criterion in order for a disclosure to qualify in this regard. A public interest and emergency disclosure can only be made to:

• A journalist, defined to mean a person who is working in a professional capacity as a journalist for a newspaper, magazine,or radio or television broadcasting service
• A Member of the Parliament of the Commonwealth or of a State or Territory parliament

You may only make a public interest disclosure if:

• You have previously disclosed the information to, APRA orASIC, or another Commonwealth body prescribed by regulation
• At least 90 days have passed since the previous disclosure was made
• You have reasonable grounds to believe that action is not being taken to address the matters which you have disclosed
• You have reasonable grounds to believe that making a further disclosure to a journalist or member of parliament would be in the public interest; and
• You have given written notification to the body to which you made the initial disclosure that
  - includes sufficient information for the body to identify your previous disclosure; and
  - that you intend on making a public interest disclosure
• The extent of information disclosed is no greater than is necessary to inform the recipient of the misconduct or improper state of affairs

You may only make an emergency disclosure if:

• You have previously disclosed the information to APRA orASIC, or another Commonwealth body prescribed by regulation
• You have reasonable grounds to believe that the information concerns a substantial and imminent danger to the health or safety of one or more persons, or to the natural environment
• You have given written notification to the body to which you made the initial disclosure that:
  - includes sufficient information for the body to identify your previous disclosure; and
  - you intend to make an emergency disclosure; and
• No more information is disclosed than is reasonably necessary to informthe journalist or parliamentarian of the substantial and imminent danger

6. INVESTIGATION

6.1 Investigation process
We will consider all matters reported under this policy as soon as practicable after the matter has been reported. If the report is not anonymous, the WPO will contact you to discuss next steps. The WPO may also advise you if your disclosure qualifies for protection, and if so, refer you to this policy and highlight what those protections are. Where you have chosen to remain anonymous, your identity will not be disclosed to any other person, and we will conduct any necessary steps based on the information. We aim to achieve these preliminary steps within 10 business days of your disclosure being made; however, the exact timing may depend on each case.

The WPO will review the matter and may seek to contact you for more information. Where necessary and appropriate, the WPO appoints an internal or external investigator to assist in conducting the investigation. Any investigations will be conducted in a fair; independent and timely manner and all reasonable efforts will be made to preserve confidentiality during the investigation. We aim to finalise any investigation within 3 months; however, the timing of any investigation process will vary depending on the nature and complexity of the disclosure.

Where possible, the WPO will provide you with regular feedback on the progress and expected timeframes of the investigation. The person(s) against whom any allegations have been made will also be informed of the concerns and will be provided with an opportunity to respond (unless there are any restrictions or other reasonable bases for not doing so).

To the extent permitted by law, the WPO may inform you and/or a person against whom allegations have been made of the findings. Any findings, corrective action, and reports to you or the person(s) against whom the allegations have been made will depend on the circumstances.

6.2 Fair treatment for subjects of disclosures about Reportable Conduct
When an investigation needs to be undertaken, the proces swill be objective, fair and independent to all parties involved. A person who is the subject of a disclosure will be:

• Advised about the substance of the allegations in the disclosure with enough detail so they can provide a response; and
• Provided with anopportunity to respond

An employee who is the subject of a disclosure may contact the entity’s support services (e.g.,counselling. See Support Available)

7. PROTECTION OF WHISTLEBLOWERS
We are committed to ensuring that any person who makes a disclosure is treated fairly, does not suffer detriment, and that confidentiality is preserved in respect of all matters raised under this policy.

All qualifying disclosures will attract the protections listed in this policy, including disclosures of Reportable Conduct that are made to legal practitioners, external and regulatory bodies, and any qualifying public interest and emergency disclosures.

We may also consider administrative steps that we can take to limit your exposure to adverse treatment because you have made a disclosure. For example, we may temporarily change your reporting line if the disclosure relates to your manager.

7.1. Protection from Legal Action
You will not be subject to any civil, criminal or administrative legal action (including disciplinary action) for making a qualifying disclosure under this policy or participating in any investigation.

Any information you provide will not be admissible in any criminalor civil proceedings other than for proceedings in respect of the deliberately false disclosures.

7.2. Protection against Detrimental Conduct
We (or any person engaged by us) will not engage in ‘Detrimental Conduct’ against you if you have made a qualifying disclosure under this policy.

Detrimental Conduct includes actual or threatened conduct such as the following (without limitation) because of your involvement in a disclosure of Reportable Conduct:

• Termination of employment
• Injury to employment including demotion, disciplinary action
• Alternation of position or duties
• Discrimination
• Harassment, bullying or intimidation
• Victimisation
• Harm or injury including psychological harm
• Damage to person’s property
• Damage to a person’s reputation
• Damage to a person’s business or financial position
• Any other damage to a person

We will take all reasonable steps to protect you from Detrimental Conduct and will take necessary action where such conduct isidentified.

We also strictly prohibit all forms of Detrimental Conduct against any person who is involved in an investigation of a matter disclosed under the policy in response to their involvement in that investigation.

If you are subjected to Detrimental Conduct as a result of making a disclosure under this policy or participating in an investigation, you should inform a WPO or Eligible Recipient in accordance with the reporting processin this document. See Reporting.

You may also seek remedies including compensation for loss, damage or injury suffered due to Detrimental Action. Civil penalties or reinstatement where you have been subject to any Detrimental Conduct may also be available. This includes remedies against SA if we fail to take reasonable precautions and exercise due diligence to prevent the Detrimental Conduct.

7.3. Protection of Confidentiality
All information received from you will be treated confidentially and sensitively.

If you make a disclosure under this policy, your identity (or any information which would likely to identify you) will only be shared if:

• You give your consent to share that information
• The disclosure is allowed or required by law (for example where the concern is raised with a lawyer for the purposes of obtaining legal advice)
• The concern is reported to ASIC, APRA the Australian Taxation Office (ATO) or the Australian Federal Police (AFP)

Where it is necessary to disclose information for the effective investigation of the matter, and this is likely to lead to your identification, all reasonable steps will be taken to reduce the risk that you will be identified.

7.4. False and Misleading Reporting
Where the information received is found to be:

• Trivial or vexatious in nature with no substance
• Unsubstantiated, and found to be made maliciously
• Made knowingly to be false

This will be treated in the same manner as a false report and may itself constitute wrongdoing. These actions will be taken seriously and may result in disciplinary action, up to and including termination of employment.

8. SUPPORT AVAILABLE
Access to our Employee Assistance Program (EAP), which is a free and confidential counselling service, is available to any person who:

• Makes a disclosure under this policy
• Believes Detrimental Action is being taken against them; or
• Is implicated as a result of a disclosure thatis made

Our EAP service is:
Acacia Connection
1300 364 273
info@acaciaconnection.com
Text or Live Chat: 0401 337 711 (within Australia)

Where appropriate, we may also appoint an independent support person from the Human Resources team to deal with any ongoing concerns you may have.

You may also access third party support providers such as Lifeline (13 11 14) and Beyond Blue (1300 22 4636) for support.

9. BREACH OF POLICY
This policy and its application are at our discretion (subject to our compliance with statutory obligations) and may be varied, withdrawn or replaced from time to time. This policy is not intended to constitute a contractual term or a contractual promise.

Any significant breach or failure to comply with this policy may result in disciplinary action up to and including termination of employment.

10. HOW TO MAKE A WHISTLEBLOWER DISCLOSURE
You are able to make a report (disclosure) by submitting your details here or by contacting any of the WPO’s or Eligible Recipients. Ensure you include clear details of the breach; what happened, where and when. Provide supporting evidence of your disclosure and the names of any other persons involved.

By making a disclosure using this channel of reporting, your details will be shared with the WPOs. A disclosure can also be made anonymously; however, this can make the disclosure more difficult to investigate, and we will not be able to respond to you personally.
‍
Reports can be made by post to:
Standards Australia
Confidential
Whistleblower Protection Officer
Darling Park Tower 1
Level 17, 201 Sussex Street
Sydney, NSW 2000