1. Types of offence connected with susceptible processes in BOLDROCCHI

Transcription

1 SPECIAL PART PREMISE 1. Types of offence connected with susceptible processes in BOLDROCCHI From a risk analysis performed by BOLDROCCHI pursuant to the Legislative Decree 231/2001 it was clear that the susceptible processes of the company are connected with: a. crimes against the Public Administration and Justice; b. computer fraud; c. organised crimes; d. counterfeiting and crimes against industry and commerce; e. corporate crimes; f. murder and serious or very serious injuries, committed together with a violation of the laws on health and safety on the workplace; g. receiving stolen goods, money laundering and using money or goods obtained with unlawful deeds; h. copyright violations; i. environmental crimes; Any risk of other types of crimes listed in the Legislative Decree 231/2001, as well as in the law dated 16 March 2006 n. 146 is neither abstractly nor concretely possible. 2. The system in general Any susceptible process must be carried out according to the current laws, the laws in the Ethical code and the rules in the hereby mentioned Model. In general, the organisational system of the company must follow the main requirements of formalisation, openness, communication and separation of roles connected with responsibility, representation, definition of the hierarchy and operations to be performed. The company must have organisational instruments (organigrams, organisational notices, procedures, etc.) that follow the general principles of: o being recognized in the company; o having a clear and formal definition of the roles and functions; o having a clear description of the lines of reporting. Internal procedures are usualy characterised by the following elements: o those who start a process (i.e those who decide), those who follow and end the process and those who control it are different persons; o any relevant stage of the process is written and can be tracked; o the level of formalisation is adequate. 3. Mandates and proxies In theory, the mandates and proxies system must be characterised by elements of certainty and safety so to prevent crimes. We mean with proxy an internal act through which a subject gives specific functions and duties to another subject; this act has to be tracked in the system of organisational communication. The proxy has to be written and must include: the name of the person giving the proxy; the name and the tasks of the person who was given the proxy, which must correspond to the position covered by the subject and the object of the proxy; the field to which the proxy applies; date; signature of the person giving the proxy;

2 acceptance by the person whom the proxy is given. We mean with mandate a unilateral legal transaction through which the company gives representative powers to a third part. The main requirements for the mandate system, to efficiently prevent crimes, are the follwing: mandates must have the formal requirements typical of the notary mandates ; general mandates are given upon deliberation of the Board of Directors and can be given to people with an internal proxy or with a specific appointment contract who need to have, to perform their task, representative powers of the company towards third parties; mandates can be given either to a natural person or to a corporate body, that will act through an appointed solicitor with given powers; a procedures must regulate modalities and responsibilities to guarantee a prompt update of the mandates, by deciding the cases in which mandates must be given, modified or revoked (e.g. in case of new responsibilities, new tasks that are in conflict with those who had originally to be performed, resignment, dismissal, etc.). The Contol Organ can periodically verify, with the support of the other competent functions, the current system of mandates and proxies and their coherence with the whole system of organisational notices (these are those internal documents with whom proxies are given); they can recommend any required modification in case the management power and/or the qualification does not correspond to the powers given by the solicitor or in case there are other anomalies. 4. Subjects of the special part The hereby special part refers to any behaviour that Workers, Company Bodies, Collaborators may directly have. The main ideas explained in the Ethical Code and the procedures described in any specific section must also be respected by the External Companies, the Consultants, the Agents and the Partners, by creating special clauses in the contracts. The main objective of the hereby special part is that any subject according to the ways in which they are involved in the activities connected with susceptible processes and to their position and duties they have towards BOLDROCCHI follows the behaviour rules stated in the special part so to prevent any crime, together with the rules stated by the Ethical Code. SECTION A CRIMES AGAINST PUBLIC ADMINISTRATION AND JUSTICE (1) A.1. Susceptible processes in BOLDROCCHI The susceptible processes in BOLDROCCHI, i.e the Risk Areas connected with crimes against Public Administration, are those linked with any activity that: o has any relationship with any functionary, any person in charge of a public service, judicial authorities, control authorities, inspection organs, public bodies that may give money grants or assisted loans, public bodies and subjects in charge of a public service that have authorisational, granting, abilitating, certificating or regulating powers; o is connected with public funds management. In particular, taking into consideration the activity of BOLDROCCHI, the possibility that the company takes part to a tender notice or a negotiation announced by public bodies (Italian or foreign), or that the company may want to have public funds of any kind, the following susceptible processes have been listed, as a crime pursuant to artt. 24, 25 and 25 decies of the Decree may be committed. Taking part to a tender notice or a direct negotiation announced by public bodies (Italian or foreign), to get a commission, with particular attention to the following Risk Activities: - arrangement of all the necessary documents; - any communication connected with the tender notice;

3 - definition of the value of the object stated in the contract between the company and the Public Administration; - control of the contract agreements by the Public Administration. Getting and managing any grant, contribution or loan from a public body (Italian or foreign), with particular attention to the following Risk Activities: - arrangement of all the documents so to get the assisted loan/grant/mortgage from the public body; - arrangement of all the financial reports to show that the money received was used in an appropriate way. (1) The different types of crimes against Public Administration and the Law pursuant to the articles 24, 25 and 25 decies of the Legislative Decree 231/01, as well as the general criteria to define any subject as belonging to Public Administration are in the Annex. Management of the relationship with the Public Administration, and with particular attention to the following Risk Activities: - managing the relationship with the public bodies to get any authorisation, permission or licence from a public body; - getting and managing any commission from the Public Administration; - managing important projects that have a high interaction with the Public Administration; - managing any inspection (adiministrative, fiscal, of the social security, etc.); - any activity performed in a public body (be it national or international), to protect the interests of the company; - managing any judicial and extrajudicial controversy with the Public Administration. - any activity connected with the omologation and certification of the products. Management of the relationship with Judicial Authorities, with particular attention to the following Risk Activities: - Management of the relationship with those who are called to give any declaration to the Judicial Authorities. Moreover, as for the crime pursuant to art. 25 Bribery and Corruption of the Legislative Decree 231/2001, the following subsidiary activities have been identified: giving presents or gratuities; promising employments; managing any consulence or supply; granting or allowing the use of goods or services that are the main activity of the company; sponsoring; cost refunds; managing agents who work in Italy and/or abroad. A.2. General rules for behaviour and implementation. The sujbects mentioned in the Special Part are forbidden to: o start, work towards or be the cause of any behaviour that represents (directly or indirectly) a crime pursuant to articles.24, 25 and 25 decies of the Legislative Decree 231/2001; o break the general rules and the company procedures mentioned in this section. To prevent any crime against Public Administrations, in particular, it is forbidden to: give any money gift to a public official (Italian or foreign), both directly, for Italian bodies or their workers, and for people who act on behalf of these bodies, in Italy or abroad; give free goods and presents that are not connected with the company procedure (i.e. any gift whose value is more than what is usually given according to the everyday commercial or kindness routine, or that is aimed to get any special treatment in a company activity). In particular, any present given to Italian or foreign public officials and their families is forbidden, because it may have an influence on the impartiality of judgement or get an advantage for the company. In those countries where presents are considered a custom, it is possible to give them only if they are appropriate and not very valuable, and they follow the current laws. The presents which are allowed are always characterised by their low value or the fact that they are used to sponsor a charity or cultural event.

4 The presents given (apart from those with a low value) must have an adequate documentary evidence, so that the Control Organ can make any control; grant any advantage of any kind (employment promises, etc.) to any Italian or foreign Public Administration official that may have the same consequences listed at the previous point; influence, during any business transaction of any kind, request or relationship with the Public Administration, any decision of an official who works or takes decisions for the Public Administration; present any false declaration to national public bodies to get grants of public money, contributions or assisted loans; use any sum of money received from national or European public bodies as grants, contributions or loans for purposes that are different from those stated; have a third party or consultants who represents them in the relationships with the Public Administration and that may arise a conflict of interest; have any behaviour that has the purpose of inducing somebody to give false declarations to the Judicial Authorities; give any service to External Companies, Agents, Suppliers, Consultant and Partners that is not adequately justified in the contract drawn with them. A.3. Specific procedural principles To implement the rules and prohibitions listed in the paragraph above, the following procedures must be respected as well. These procedures must be respected both when BOLDROCCHI performs its activities in Italy, and when they are performed abroad: I. the Workers, Company Bodies, Collaborators, External Societies, Agents, Consultants and Partners who personally have any relationship with the Public Administration on behalf of BOLDROCCHI must have a formal power to act, given from the company (with a specific proxy for the Workers and the Company Bodies or in their contract, in case of the other subjects listed); II. any declaration given to national or European public bodies to take part to any tender notice or to a business transaction to get grants of money, contributions or loans must contain only true elements; III. In case any grant of money, contribution or loan is obtained, a specific financial statement on the use of the money must be written; IV. in any relationship with Public Authorities, and in particular with the Judicial and Enquiring Authorities, a clear, transparent, scrupolous and collaborative behaviour must be kept, giving all the information, data and news that are required; V. the subjects with a specific proxy must take part to any judicial and administrative inspection, as well as to any inspection connected with taxes. (e.g. inspection about the Legislative Decree 81/2008, tax inspections, social security, etc.). Reports about the whole inspection must be written and kept. In case the final report shows any critical aspect, the Control Organ will have to be informed about them with a written notice from the person in charge of the function involved; VI. The Control Organ must be informed with a written notice about any critical aspect or conflict of interest that may arise in the relationship with the Public Administration; VII. The contracts between the Company and the Service Companies, the Consultants, the Agents and Partners must be defined in a written form, in all their conditions and terms, and they must have standard clauses to pursue the Legislative Decree 231/2001 and the Ethical Code, with also specific consequences in case of any violation of the norms pursuant to the Model and/or the Ethical Code (e.g. express termination clauses, fines); VIII. In general, no payment can be made in cash and, in case of exceptions, the payments must be authorised. In any case, payments must be made in a way so that the reason of the expense can be clearly understood and found; IX. as for the financial management, the company performs specific controls of the procedures and pays a close attention to any amount that is not connected with the ordinary activities of the company and that is temporarily and discretionary managed. These controls (e.g. checking the accounting data, supervising, separating the tasks, diversification of the functions, documenting the decisions

5 efficiently, etc.) are aimed to prevent any concealed money stock. LAW ANNEX Types of crimes against the Public Administration (articles. 24 and 25 of the Legislative Decree 231/2001) As for the here mentioned Annex A of the Special Part, here below is a short description of the crimes listed in it, and mentioned in the articles. 24 and 25 of the Decree (form here known as crimes against the Public Administration), as well as the general criteria to define any subject as belonging to Public Administration and any subject as active subject in any crime pursuant to the Legislative Decree 231/2001, or those subjects that must be qualified to understand their guilt in a crime. Art. 24 considers the Company responsibility connected with the crimes pursuant to articles 316-bis, 316-ter, 640, para 2, n. 1, 640-bis and 640-ter c.p. if committed against the government or another public body. Embezzlement against the Government (art. 316-bis penal code) Anyone who does not belong to the public admnistration and who has got from the Government or any other public body or from the European Community a money grant, contribution or loan to finance any work or perform any activity of public interest, and does not use it for the before mentioned aims, will be imprisoned for a period ranging from six months to four years. This behaviour consists in the misuse, even partial, of the sum of money granted, regardless of the fact that the scheduled activity actually took place. Taking into consideration the fact that the crime is committed during the executive phase, it can be committed also in connection with money obtained in the past and that is not used for the original aims. Getting undiserved grants and damaging the Government or the European Union (art. 316-ter penal code) Unless the episode is considered a crime pursuant to the art. 640-bis penal code, anyone who uses untrue declarations or documents that state untrue information, or omits necessary information to illegittimately get (for themselves or for other people) money grants, loans, assisted mortgages or similar grants, regardless of their definition, that are given or granted by the Government, by public bodies or by the European Community will be imprisoned for a period ranging from six months to three years. In this case, contrary to what is stated in the before mentioned point (art. 316-bis), the use of the money is not relevant, because the crime is committed when getting the money. Finally, it is important to highlight that this alleged crime comes after that of fraud against the State and it its committed only when there are no elements to say a fraud against the State has been committed. Fraud against the State, any other public body or the European Union (art. 640, paragraph 2 n. 1, penal code) Art. 640 para 1 penal code condemns anyone who, with tricks or frauds and making somebody make a mistake, will get an undiserved profit and cause a damage to anyone else and, in para 2 n. 1, states the imprisonment for a period ranging from one to five years and a fine ranging from 309 to as the punishment in case the fraud was committed against the State or any other public body. This crime can be committed, for example, when untrue information is given to the Public Administration (e.g. supported by falsified documents) during the collection of documents or data to take part to a tender notice and win it.

6 Aggravated fraud to get public funds (art. 640-bis penal code) Imprisonment for a period ranging from one to six years as a matter of course is the punishment given in case the crime pursuant to art. 640 is connected with money grants, loans, assisted mortgages or any other money grant of the same type, regardless of their definition, that are granted by the Government, any other public body or the European Community. This crime is committed when tricks or frauds are used, for example giving untrue data or writing falsified documents to get public money grants. Computer fraud against the State or any other public body (art. 640-ter penal code) Art 640 ter penal code condemns anyone who, altering with any means the ways in which an I.T. System works or getting by any means data, information or computer programmes in a computer system, will get an undiserved profit and cause a damage to anyone else and, in para 2, states the imprisonment for a period ranging from one to five years and a fine ranging from 309 to as the punishment in case the fraud was committed against the State or any other public body. The crime here mentioned can be committed, for example, when, after obtaining a money grant, an I.T system is hacked in to input any untrue sum and/or data to get undeserved profits. * * * Art. 25 states the company responsibility in connection with the crimes pursuant to articles. 317, 318, 319, 319 bis, 319 ter, 321 and 322 penal code. Bribery (art. 317 penal code) Any public functionary or person in charge of a public service who, abusing of their positions or their powers, will force or make somebody illegitimately give or promise them or a third part money or any other grant, will be imprisoned for a period ranging from four to twelve years. This crime can be undoubtly committed in connection with those pursuant to the Legislative Decree 231/2001; in particular, it can happen when a person working for the company or an agent is accused of the public functionary crime who, taking advantage of their position, asks a third party for any service which is not required (if the company gets any advantage from this behaviour). Corruption crimes In the articles from 318 to 322 the penal code presents a complex and varied set of rules about the corruption crimes. They are crimes where there must be two or more subjects who have an unlawful pact aimed at unlafully exploiting the functions of the Public Administration. The penal code makes a distinction between typical corruption and atypical corrupiton. Corruption when performing a duty (art. 318 penal code) Any public official who, when performing a duty connected with their position, receives money or any other kind of grant for themselves or for a third person, or receives an unjustified payment or a promise for it, will be imprisoned for a period ranging from six months to three years. If the public official receives any payment for a duty already performed, imprisonment will be up to one year. Corruption when acting contrary to duties (art. 319 penal code) Any public official who, to omit or delay or has omitted or delayed a duty receiving money or any other kind of grant for themselves or for a third part, or, as they have acted contrary to their duties, receive money or any other kind of grant for themselves or for a third part or are promised to receive,

7 will be imprisoned for a period ranging from two to five years.. The discriminating factor is acting against one's duties: typical corruption is when the exploitation of the Administrative Function is connected with an act against one's duties (e.g. a public official who accepts money to make somebody win a tender notice); atypical corruption is when the pact is about an act belonging to one's duties (e.g. making a due procedure faster). These alleged crimes are different from that of bribery, because in this case there is a pact between corruptor and corrupted to have a reciprocal advantage, whereas with bribery it is the private citizen who is subject to the behaviour of the public official or the person in charge with a public service. Penalties for the corruptor are also stated (art. 321 penal code). Incitement to corruption (art. 322 penal code) Art. 322 penal code will punish whoever offers or promises to offer unnecessary money or any other kind of grant to a public official or to a person in charge of a public service who is performs the duties of a public official to make them perform any of their duties or to make them omit or delay any of their duties, or to do anything against their duties, when the offer or the promise ar not accepted. Bribery, corruption and incitement to corruption of members of the European Community and officials of the European Community and foreign States (art. 322-bis penal code) The regulations stated by articles 316, from 317 to 320 and 322, third and fourth paragraph, also apply to: 1) members of the European Community Commission, of the European Parliament, of the Court of Justice and of the Court of Auditors of the European Community; 2) officials and agents who are hired according to the officials' statute of the European Community or the law for the agents of the European Community; 3) people who have been appointed by member States or any other Public or Private Body in the European Community to perform any function that corresponds to that of officials or agents of the European Community; 4) members and persons appointed working in bodies that where created with any constitutive agreement of the European Community; 5) anyone who performs any function or activity that corresponds to that of a public official or a person in charge of a public service in countries that are members of the European Community. The regulations stated by articles 321 and 322, first and second paragraph, are applied also in case the money or any other form of grant is given, offered or promised: 1) to any person listed in the first paragraph of the here mentioned article; 2) to any person who performs an activity or a function that corresponds to those of a public official or a person in charge of a public service in other foreign States or international public organisations, in case the act was performed to get an unnecessary advantage in international economic transactions, either for themselves or for other people. The people listed in the first paragraph are considered to be the same as public officials in case they perform similar functions, and the same as persons in charge with a public service in any other case.. Corruption of judicial acts (art. 319-ter penal code) If the acts stated in the articles 318 and 319 are performed to give advantage to or damage a part in a civil, penal or administrative trial, imprisonment for a period ranging from three to eight years is the punishment given. This alleged crime happens when the company is involved in any legal action and corrupts a public official (not only a magistrate, but also a clerk of the court or another official). Incitement not to give any declaration or to give false declarations to the Judicial Authorities (art. 377 bis penal code).

8 Unless the fact is considered a more serious crime, anyone who, using violence or threatens, or with an offer or promise of money or any other kind of grant, incites a person who has to give declarations to Judicial Authorities that can be used in a legal action (when there is the right to silence) not to give any declaration or to give false declarations, will be imprisoned for a period ranging from two to six years. The Public Administration According to the penal law, any corporate body who has public interests and performs any legislative, judicial or administrative activity according to public law or acts excercising public authority is commonly defined as Public Administation Only as an example, the following bodies or body categories can be listed as Public Administration bodies: - Schools and Institutes of any kind and educational institutions; - Independent bodies and administrative bodies of the State, such as: - Ministries; - The Chamber of Deputees and the Senate; - Department for Common Policies; - The Authority that guarantees for Competition on the Market; - The Authority for Electricity and Gas; - The Authority that guarantees for Communications; - The Bank of Italy; - Consob (national commission for companies and stock exchange); - The Authority that guarantees the protection of personal data; - Income revenue authority; - Regions; - Provinces; - Municipalities; - Mountain communities, their unions and associations; - Chambers of Commerce for Industry, Crafts, Agricolture and their associations; Any public body that is not economic, be it national, regional or local, such as: - INPS (social security); - CNR (national research associations); - INAIL (social security for accidents on the workplace); - INPDAI (social security for company managers); - INPDAP (social security for workers of the public administration); - ISTAT (national institute for statistical data); - ENASARCO (social security for agents); - ASL (local health authority); - Monopoly of the State and Bodies; - RAI (State Broadcasting Company) Provided that this is only an example, it is important to highlight that not any natural person that acts in connection with and in the context of these bodies is a subject that may perform or may be accused of a crime listed in Section A. In particular, the only relevant figures in this context are those of Public Officials and People in charge of a Public Service. Public Officials Pursuant to art. 357, first paragraph of the Penal Code, a public official is whoever has public legislative, judicial or administrative function. The second paragraph of the article hereby mentioned specifies that, according to penal law a public function is an administrative function that follows the public law and acts exercising public authority and is characterised by the will of the public administration or by its exercising it with

9 public or certifying authority. In other words, a public administrative function is regulated by public law, i.e those laws that pursue a public aim or protect a public interest and that are, therefore, different from private law. Persons in charge of a public service The article 358 of the penal code states that a person in charge of a public service is whoever, with any right, gives a public service. A public service is defined as an activity regulated in the same way as a public function, but without the powers that are characteristic of this latter and consisting in simple ordinary tasks and material tasks. The law has stated a list of typical characters of a public service; the most evident are those of limited companies with public shares. In particular, the following elements are taken into consideration: - the presence of a control activity and a company orientation, as well as the power of appointing and revoking the administrators by the State or other public bodies; - the presence of an agreement or a concession with the public administration; - a financial grant from the Sate; - the presence of a public interest connected with the economic activity. Based on what is stated above, the condition to determine if a person is in charge of a public service or not is not the legal status that a company has or is given, but the tasks to be performed, that must be following public interests or satisfying needs of general importance. SECTION B COMPUTER FRAUD (2) B.1. Susceptible processes in BOLDROCCHI Susceptible processes in BOLDROCCHI, i.e. the Risk Areas connected with computer fraud, are to be found in restricted areas where the staff, when performing their duties, uses an I.T system. In particular, the following risk areas have to be taken into consideration in connection with I.T. Systems: Installation and maintenance of I.T. Systems (software and hardware); Using I.T. Systems as a support for the different work duties; Access to external I.T. Systems. Monitoring the access to I.T. Systems. B.2. General rules for behaviour and implementation The aim of the hereby Section is that all Workers and Company Bodies follow behavioural rules that are in compliance with what is required here, to prevent and stop the here mentioned crimes. In particular, when performing these activities, it is clearly forbidden to anyone listed above to start, follow or take part into any behaviour that represents a computer fraud, be it individual or collective. To avoid these crimes, the company laws on how to use the computer instruments is reminded here and in particular: General Rules for a correct use of the I.T. systems; Operational manuals for the correct use of the I.T. Systems (and in particular, the SIGEA management system); Guidelines on how to manage Company Information; In general, the laws, policies and company procedures for the use of I.T. Systems. To prevent any action that may be a crime pursuant to art. 24-bis of the Decree 231, BOLDROCCHI will implement certain precautional measures and general rules for behaviour, such as: giving correct information on the correct use of the company computer instruments and the risk of

10 perpetrating computer fraud; limiting the access to external networks and I.T. Systems only to that of working needs; controlling the company computer network periodically to detect any anomaly in behaviour. (2) The different types of computer fraud pursuant to art 24-bis of the Legislative Decree 231/01 (except for the crime pursuant to art. 640 quinquies penal code that does not concern BOLDROCCHI) are listed in the Annex. B.3. Specific procedural principles The following procedural princples have to be implemented to apply and carry out the above listed rules for behaviour: I. inform those who use I.T systems about the importance of not disclosing their access credentials (username and password) to anyone and keep them secret; II. give to anyonw who uses I.T. system a specific document in which they promise to make any effort to use the company computer instruments correctly; III. Inform those who use the I.T. systems about the importance of not leaving their computers unattended and the necessity of blocking them with their personal access codes in case they have to leave their workspace; IV. set their computers so that the will be automatically blocked when they are not used for a certain time; V. the internet access (i.e. external access) must be authorised and performed only in authorised ways and with work purposes; VI. use mail servers with a physical access only for authorised staff; VII. Protect any company I.T. system so that no hardware can be installed, that can intercept any information from an I.T. system or among many I.T. systems, or that can stop or prevent any information to be passed; VIII. Install on every computer a firewall and an antivirus software and make it impossible to uninstall them; IX. forbid the installation and the use of any software that is not approved by the company and that is not linked to the work of the staff or of the users; X. limit the access to areas and websites that are particularly dangerous from the point of view of viruses that can damage or destroy I.T. systems and data in a computer (e.g. online or online information websites and files); XI. forbid, in particular, the installation and the use, on the company I.T. system, of sofware, such as P2P, file sharing softwares or istant messaging softwares that allow the exchange of any kind of file through the internet (for example, videos, documents, songs, viruses, etc.) without any possibility for the company to control it; XII. In case a wireless connection is used for the network (i.e. by using Wi-Fi routers), it is important to protect them with an access key, to prevent any third part to have access to the company internet through their routers and commit crimes of which the company staff will be accused; XIII. Implement, where possible, a login process that requires a username and a password with limited access to the system resources, that must also be different according to the different user or user category. It is also important to point out that the art. 24 bis of the Legislative Decree 231/01 considers the corporate body responsibility also in case of the so called false electronic acts. In this sense, every worker of the company and company body must follow certain behaviours so to avoid any false act in general and false electronic acts in particular. For this reason, it is strictly forbidden to electronically send any false, counterfeit or not genuine act. NORMATIVE ANNEX Computer fraud (art. 24 bis Legislative Decree 231/2001) Art. 24 bis considers the company responsibility in connection with the following crimes:

11 Computer hacking (art. 615 ter penal code) Whoever illegaly hacks in an I.T. system protected by security measures or uses it against the explicit or implict will of those who have the right to keep them out, will be imprisoned for a period up to three years. Imprisonment for a period ranging from one to five years will be the punishment in case: 1) the crime is committed by a public official or a person in charge of a public service, with power abuse or violation of the duties connected with their job, or by those who work (also abusively) as private investigators, or those who abuse of their position of system operators; 2) the culprit uses violence against things or people to commit the crime, or if they are clearly armed; 3) a destruction or a damage of the system is caused, or a total or partial interruption of the service, or if the data, the information or the programmes of the system are destroyed or damaged. In case the crimes described in paragraph one and two are committed in an I.T system used by the military forces or connected with public order or security, or public health or civil protection, or in any case connected with a public service, the punishment will be, respectively, imprisonment from one to five years and from three to eight years. In the case mentioned in the first paragraph action will be taken against the offender; in any other case action will be taken as a matter of course. Interception, illegal hindrance or interruption of computer information (art. 617 quater penal code) Whoever illegally intercepts any computer information in an I.T. system or among many systems, or interrupts or blocks them, will be imprisoned for a period ranging from six months to four years. Unless the crime is more serious, the same punishment will be given to whoever reveals to the public, with any means of communication, the whole or part of the content of the communication mentioned in the first paragraph. In the cases mentioned in the first and second paragraph action will be taken against the offender. Nonetheless, action will be taken as a matter of course and the punishment will be imprisonment for a period ranging from one to five years if the crime is committed: 1) to damage an I.T system used by the State or by another public body, or by a company that provides public services or services of public utility; 2) by a public official or by a person in charge of a public service, with power abuse or violation of the duties connected with their job and with abuse of their powers, or by those who abuse of their position of system operators; 3) by those who abusively work as private investigators. Installation of equipment used to intercept, block or interrupt computer information (art. 617 quinquies penal code) Whoever, with the exception of those authorised by the law, installs any equipment used to intercept, block or interrupt any computer information in an I.T. system or among many systems, will be imprisoned for a period ranging from one to four yerars. In the cases pursuant to the art. 617-quater, fourth paragraph, reclusion for a period ranging from one to five years will be the punishment. Damage of information, data or computer programmes (art. 635 bis penal code) Unless it is the case of a more serious crime, action will be taken against whoever destroys, damages, cancels or suppresses any information, data or programmes that do not belong to them and will be imprisoned for a period ranging from six months to three years. If it is the case of the situation in 1) of the second paragraph of the art. 635, or if the crime is committed by abusing of the position of system operator, imprisonment for a period ranging from one to four years will be the punishment and action will be taken as a matter of course. Damage of I.T systems (art. 635 quater penal code)

12 Unless it is the case of a more serious crime, whoever, behaving as stated in the art. 635-bis, or by inserting or transmitting data, information or programmes, destroys, damages and makes (partly or completely) any I.T. system useless or seriously blocks its functions, will be imprisoned for a period ranging from one to five years. If it is the case of the situation in 1) of the second paragraph of the art. 635, or if the crime is committed by abusing of the position of system operator, the punishment will be greater. Damage of I.T. systems of public utility (art. 635 quinquies penal code) If the act mentioned in the art. 635-quater is aimed to destroy, damage or make (partly or completely) an I.T. system of public utility useless or seriously block its functions, the punishment will be imprisonement for a period ranging from one to four years. If the consequence of the act is the destruction or the damage of the I.T. system of public utility or if it is made (partly or completely) useless, imprisonment for a period ranging from three to eight years will be the punishment. If it is the case of the situation in 1) of the second paragraph of the art. 635, or if the crime is committed by abusing of the position of system operator, the punishment will be greater. Computer documents (art. 491 bis penal code) If any of the falsifications mentioned in this chapter are connected with a public or private computer document that can be used as a proof, the instructions given in this same chapter will be followed: those concerning public documents and those concerning private written work. For this purpose, a computer document is any storage device that contains data or information that can be used as proofs or any program that can specifically elaborate data. SECTION C ORGANISED CRIMINALITY (3) C.1. Susceptible processes in BOLDROCCHI After analyising the company processes in BOLDROCCHI it was clear that the risk of committing a crime listed in the art. 24 ter of the legislative decree 231/01 is only partial, because it is not possible to concretely commit the crime and, at any rate, these crimes are already condemned by the norms of behaviour in the Ethical Code. BOLDROCCHI, at any rate, considers it important to control the internal organisation through an adequate separation of the tasks and the processes of management of the relationship with suppliers, agents and partners, by specific controls of the following Risk Activities: selection and choice of the suppliers, agents and partners; management of the financial transactions with suppliers, agents, clients, partners; contracts and investments; management of payments. C.2. General rules for behaviour and implementation The purpose of the hereby Section is that any subject (Workers and Company Bodies, as well as Agents and Partners) respects their roles and responsibilities as stated in the company structure, as well as in the norms/procedures aimed at preventing and stopping crimes according to the extent in which they are involved in the activities for which the crime of organised ciminality, on a national or international level, is possible. In particular, when performing company activities, it is strictly forbidden to anyone to start, contribute to or have any behaviour that, individually or collectively, is considered (directly or indirecly) a crime as described in this section.

13 C.3. Specific procedural principles To prevent any organised crime, BOLDROCCHI will work hard to: I. have a correct and transparent relationship with suppliers, agents, partners and clients, taking into account the laws that regulate the company activities and the ethical principles on which the company activity is based; II. when managing suppliers, adequate task and responsibility divisions must be provided, with particular attention to the offers, the evaluation of the performance and payment; III. Verify the commercial and professional realiability of agents and partners for contracts, commercial agreements or joint ventures; IV. never accept any commercial relationship with customers that are based in or that have any contact with countries that are not considered cooperative, as they do not conform to the international law standards and to the recommendations given by FATF-GAFI (Group for Financial Action against money laundering) or that are included in the so called Black List of the World Bank and the European Commission; V. never take any order, supply of products or make any financial and/or commercial operation (directly or through a third part) with anyone corporate bodies or natural persons whose names where given to the European and international authorities in charge of terrorism prevention; VI. verify that payments are regular, with attention to the name of the receipient/person who ordered the payment and their counterpart corresponding to those who actually perform transactions; VII. Pay third parts only after controls following the company procedures. (3) The different types of organised crime pursuant to art. 24-ter Legislative Decree 231/01 are listed in the Normative Annex. NORMATIVE ANNEX Art 24 ter of the Legislative Decree 231/01 states the company responsibility connected with the crimes pursuant to art. 416, 416-bis, 416-ter and 630 of the Penal Code, the crimes committed by exploiting the conditions pursuant to the before mentioned art. 416-bis or to assist the associations listed in the same article, as well as the crimes pursuant to art. 74 of the Consolidated Act and the Decree by the President of the Republic dated 9 th October 1990, n Criminal associations (art. 416 penal code) When three or more people get together to commit crimes, those who create or initiate the associaton are punished, for this sole reason, with imprisonment for a period ranging from three to seven years. Anyone who takes part to the association will be imprisonrd for a period ranging from one to five years. Bosses are subject to the same punishment as that given to initiators. If the members go round the streets or the country roads carrying weapons, imprisonment for a period ranging from five to fifteen years will be the punishment. The punishment will be greater if the number of the members is higher than ten. If the association is aimed to commit one or more crimes pursuant to articles 600, 601 and 602, as well as article 12, paragraph 3-bis, of the Consolidated Act on immigration and the condition of foreign people, and as in the Legislative Decree dated 25 July 1998, imprisonement for a period ranging from five to fifteen years will be the punishment, in the cases mentioned in the first paragraph and for a period ranging from four to nine years in the cases mentioned in the second paragraph. If the association is aimed to commit one or more crimes pursuant to articles 600 bis, 600 ter, 600 quater, 600 quater 1, 600 quinquies, 609 bis, when the crime is committed against a person of less than 18 years old of age, 609 quater, 609 quinquies, 609 octies, when the crime is committed against a person of less than 18 years old of age and 609 undecies, the punishment will be imprisonment for a period ranging from four to eight years in the cases mentioned in the first paragraph and imprisonment for a period ranging from two to six years in the casese mentioned in the second paragraph.

14 Organisations belonging to mafia (art. 416 bis penal code) Anyone who belongs to an organisation belonging to mafia composed by three or more people, will be imprisoned for a period ranging from seven to twelve years. Those who initiate, direct or organise the association are punished, for this sole reason, with imprisonment for a period ranging from nine to fourteen years. The organisation is to be considered as belonging to mafia when its members use the intimidatory power of this associative tie and the consequent subjugation and code of silence to commit crimes, to aquire, directly or indirectly, management or control of economic activities, concessions authorisations, tenders and public services to get any undeserved profit or advantage for themselves or for other people, or to block or impede free voting rights or to get any vote for themselves or for other people in case of elections. If the association is armed, punishment for a period ranging from nine to fifteen years will be the punishment, in the cases mentioned in the first paragraph, and from twelve to twenty-four years in the cases mentioned in the second paragraph. The association is considered to be armed when those who belong to it have weapons or explosives at their disposal, even if they are hidden or kept in a depot. If the economic activities that are controlled by the members are financed (partly or totally) with the price, product or profit from a crime, the before mentioned punishments are increased by an amount ranging from one third to a half. Confiscation of the objects used to commit the crime and the objects that represent the price, the product or the profit of a crime is mandatory in any case. The laws in the hereby articles are applied also to camorra, 'ndrangheta and other organisations with different local names, also the foreign ones, that pursue the same aims of the organisations belonging to mafia by using the power of the associative tie. Money against votes (art. 416 ter penal code) The punishment mentioned in the first paragraph of the art. 416-bis is also given to those who accept any promise of vote mentioned in the third paragraph of the same article 416-bis against any sum of money. Kidnapping with robbery or extortion purposes (art. 630 penal code) Anyone who kidnaps someone to have an unmerited profit for themselves or for somebody else as the price of release, will be imprisoned for a period ranging from twenty-five to thirty years. If death is the unwanted consequence of the kidnapping, imprisonment for a period of thirty years will be the punishment. If death is caused on purpose, life imprisonment will be the punishment. If an accomplish behaves differently from the others, so that the kidnapped person is free again, without this outcome being the consequence of a price paid, the punishments pursuant to article 605 will be applied. Nontheless, if the person dies as a consequence of the kidnapping but after the release, imprisonment for a period ranging from six to fifteen years will be the punishment. If an accomplish behaves differently from the others so that the crime does not go further or helps the police or the judicial authorities collect key proofs to recognize or catch the criminals, life imprisonment is changed into imprisonment for a period ranging from twelve to twenty years, and the other punishments are shortened by one third to two thirds. When it is the case of an extenuating circumstance, the punishment mentioned in the second paragraph is changed into imprisonment for a period ranging from twenty to twenty-four years; the punishment mentioned in the third paragraph is changed into imprisonment for a period ranging from twenty-four to thirty years. If it is the case of more than one extenuating circumstance, imprisonement cannot last less than ten years after all the shortening in the case mentioned in the second paragraph, and fifteen years in the case mentioned in the third paragraph. The punishment limits mentioned in the above mentioned paragraph can be passed if there are the extenuating circumstances mentioned in the fifth paragraph of this chapter.

15 Organisations aimed at drug or psychoactive drug dealing (art. 74 Decree of the President of the Republic 90/1990) When three or more people get together to commit a number of crimes included in those mentioned by article 73, whoever intitiates, creates, controls, organises or finances the association is imprisoned for this sole reason for a period not shorter than twenty years. Whoever takes part to the association will be imprisoned for a period not shorter than ten years. The punishment becomes greater if the members are ten or more or if one or more members use drugs or psychoactive drugs. If the members of the organisation are armed, the punishment in the cases mentioned in paragraphs 1 and 3, is imprisonment for a period of not less than twenty-four years and, in the case mentioned in paragraph 2, imprisonment for a period of twelve years. The association is considered to be armed when those who belong to it have weapons or explosives at their disposal, even if they are hidden or kept in a depot. The punishment will be greater in case of the circumstance pursuant to letter e) paragraph 1 of the article 80. If the organisation was set up to commit the crimes pursuant to paragraph 5 of the article 73, the first and second paragraphs of the article 416 of the penal code will be applied. The penalties mentioned in paragraphs from 1 to 6 will be shortened by a half to two thirds for whoever acted efficiently to give any proof of the crime and to take away from the organisation anything that can be used to commit the crime. SECTION D COUNTERFEITING AND CRIMES AGAINST INDUSTRY AND COMMERCE D.1.Susceptible processes in BOLDROCCHI Taking into consideration the particular setting of the crimes pursuant to articles 25 bis and 25 bis-1 of the Legislative Decree 231/01, we think the crimes pursuant to articles 473, 474, 513, 513 bis, 514, 515, 517 and 517 bis Penal Code are in theory connected with certain Risk Areas. In particular, the main Susceptible Processes in BOLDROCCHI are the following: - creation of products, models, drawings and technologies; - purchase of goods/parts/components/semifinished and finished products from Italian and foreign suppliers; - trade of products; - relationships with customers; relationships with competitors D.2. General rules for behaviour and implementation BOLDROCCHI wants and asks for the respect of the industrial ownership rights and commercial secrets (theirs or a those of a third part). In particular, internal knowledge is the main resource that must be protected by any worker and subject. The following principles and general prohibitions are applied to Workers, Company Bodies directly and to Agents, Consultants and Partners according to specific contract clauses. In particular, in respect to the principles of the Ethical Code, it is forbidden to: - start, initiate or collaborate to any behaviour that, singularly or collectively, implies, directly or indirectly, the above mentioned crimes (articles 25-bis and 25 bis -1 of the Legislative Decree) - in any case, do anything unlawful that will put the free commercial and industrial activities in danger. D.3. Specific procedural principles