Blackberry 2010 Annual Report Download - page 54

RECOMMENDATION RESPONSE
To discharge its oversight responsibilities, the audit committee should
ensure the effective operation of an enterprise-wide compliance program
with regular reporting on the state of compliance in the organization.
Reporting should continue to include reports on Sarbanes-Oxley
compliance, legal claims and known non-compliance incidents.
Reporting to the audit committee should also include reporting on the
enterprise-wide compliance program and the state of compliance across
the organization with focus on compliance risk exposures.
In addition, Internal Audit should periodically perform reviews of the
enterprise-wide compliance function and processes to provide
assurance to the audit committee on the program’s effective and
efficient operation.
The Chair of the Risk & Compliance Council also will make a report to the
A&RM Committee, at least quarterly, on the compliance program and
state of compliance. The Risk Council, through its Chair, will report out to
the Board, at least quarterly. In connection with its oversight of the
Company’s compliance program, the Board will continue to monitor
the need for accountability for the Company’s compliance program to
be assigned to a designated executive such as a chief compliance officer
or equivalent.
(b) Compliance Culture
In considering the future re-appointment of individuals reprimanded
by regulatory authorities to the honorary title of “Director Emeritus”,
the board should consider the messaging effect of these actions and
the impact on the organization’s compliance culture.
The Board believes this recommendation is not necessary or
appropriate, but nevertheless has been addressed. Each of the
individuals was formerly a director of long-standing, who agreed
not to stand for reelection to the board in 2007. The individuals were
appointed to the honorary position of Director Emeritus in recognition
of their substantial contribution to the Company and its shareholders
over many years. The Director Emeritus position carries with it no
authority, no responsibilities and no access to the Company’s
confidential information. The initial decision to confer this title was
announced by the Company on March 5, 2007, subsequent to which
five new independent directors have joined the Board. The Board
considered the implications of the appointment when initially made
for a one-year term, for each subsequent one-year reappointment
and will reconsider the implications upon the expiry of the current
one-year term. The Board does not view the designation as having an
impact on the organization’s compliance culture.
Pursuant to Schedule C to the Settlement Agreement, Protiviti is to
make recommendations where it identifies “a . . . deficiency
substantial enough to require changes or improvements at the
Company”. The Board does not consider this recommendation to
be of such a nature.
7. Receiving Feedback from Employees and Stakeholders
The board should proceed with its review and revisions of the
Company’s employee whistleblower program to ensure it operates
effectively with focus on internal awareness and methods of access to
promote ease of use. The board should consider the benefits of
establishing a channel by which outside parties can report relevant
information as a means of obtaining external feedback and gauging
potential reputational impact to the organization. As identified as a
corporate governance practice by National Policy 58-201, Corporate
Governance Guidelines, the board’s mandate should be revised to
include its responsibility for the implementation of measures for
Whistleblower Program: This recommendation has been accepted
and has been addressed. As of the end of the most recent fiscal year,
the Company employees could submit anonymous whistleblower
reports to a P.O. Box address. The Company whistleblower
program now makes whistleblower reporting available to
employees and external parties via a web and telephone hotline
based system supplied and operated by EthicsPoint. EthicsPoint
has advised the Company that over 2200 organizations use
EthicsPoint telephone hotline, web-based reporting and case
management services as a component of their overall governance,
receiving feedback from stakeholders — such as establishing a
process to permit stakeholders to directly contact the independent
directors.
risk and compliance efforts. The new system allows individuals to
make whistleblower reports, including anonymous reports, to the
Company via the Ethicspoint system and enables the Company or
the Chair of the A&RM Committee, as appropriate, to follow up directly
with the reporter while maintaining his or her anonymity. All
employees have been advised of the new whistleblower program
as part of the Company’s business standards and principles
acknowledgement program which is conducted annually.
MD&A
46