Whistleblower Policy Overview The _________________(________) Code of Conduct Policy requires that the directors, officers and employees of __________ observe the highest standards of business and personal ethics in the conduct of their duties and responsibilities. As employees and representatives of __________, we are obligated to fulfill our responsibilities honestly and with integrity and we must comply with all applicable laws and regulations. Co-workers are often the first to realize that there may be something seriously wrong within an organization. However, they may decide not to express their concerns because they feel that speaking up would be disloyal to their colleagues or to the organization. They may also fear recrimination, harassment or victimization. In these circumstances, they may feel it would be easier to ignore the concern rather than report what may just be a suspicion of wrong doing. The purpose of this policy is to make it clear that all __________ employees, officers and directors can report wrong doings or suspected wrong doings without fear of reprisal or retaliation. This Whistleblower Policy is intended to encourage and enable employees, officers and directors to raise serious concerns within __________ rather than merely overlooking a possible problem. Policy Description Co-workers are usually the first to know when something is going seriously wrong. A culture of turning a "blind eye" to such problems means that the alarm is not sounded and those in charge do not get the chance to take action before real damage is done. Whistle blowing can therefore be described as giving information about potentially illegal or improper practices - i.e. wrong doing. No Retaliation No director, officer or employee who in good faith makes a report or raises a concern under this Policy shall suffer harassment, retaliation or adverse employment consequence “provided that the information is disclosed in good faith, the discloser believes the information to be substantially true, does not act maliciously or make false allegations, and does not seek personal or financial gain”. Anyone who retaliates against someone who has in good faith reported a wrong doing or suspected wrong doing will be subject to discipline up to and including termination of employment. This Whistleblower Policy is intended to encourage and enable employees, officers and directors to raise serious concerns within __________. Auditing The Whistleblower Program - Internal Audit Internal Audit will conduct periodic reviews of the Whistleblower Compliance Program and the Director Internal Audit will provide periodic updates to the Board Audit & Risk Management Committee, as appropriate. Whistleblower Policy Accounting and Auditing Matters The Chief Risk Officer shall report all reported concerns or complaints regarding corporate accounting practices, internal controls or auditing to the Board Audit & Risk Management Committee, which is mandated with addressing such reports. The Chief Risk Officer shall immediately notify the audit committee of any such complaint and work with the committee, and internal and external resources as required, until the matter is resolved. Definitions Employee or personnel means any individual who is full time, part time, casual, contract or elected personnel, including staff, contracted employee agents, management, executive and elected directors. Wrong doing: Wrong doing can occur at any level in an organization and involves any unlawful, illegal or otherwise improper behavior and can include: An unlawful act, whether civil or criminal; To knowingly breach federal or provincial laws or regulations; A breach of or failure to implement the Conduct Policies or any other __________ policies; Unprofessional conduct or conduct that is below recognized, established standards of practice; Questionable accounting or auditing practices; Unfair discrimination in the course of employment or provision of services; Assuming risks which are outside the policies or normal business practices of __________. This list is not definitive, but it is intended to give an indication of the kind of conduct which might be considered "wrong doing". Chief Risk Officer's Role The Chief Risk Officer has specific responsibility for ensuring that all reports he or she receives of suspected violations of Conduct Policies or any other wrong doing that come through the Whistleblower are investigated and resolved. As appropriate, the Chief Risk Officer shall advise the Board Chair, President and CEO, and / or the Board Audit & Risk Management Committee (“ARM Committee”) of complaints and allegations concerning such violations. The Chief Risk Officer has direct access to the ARM Committee and is required to report to the ARM Committee quarterly. All Whistleblower reports will be fully documented and subject to periodic review by Internal Audit (see “Auditing The Whistleblower Program”). Obligations Reporting Responsibility It is the responsibility of all employees, officers and directors to comply with the Conduct Policies and to report wrong doing or suspected wrong doing in accordance with this Whistleblower Policy. Whistleblower Policy Reporting Violations The Conduct Policies suggest that employees share their questions, concerns, suggestions or complaints with someone who can address them properly. In most cases, an employee's supervisor is in the best position to address an area of concern. However, if you are not comfortable speaking with your supervisor or you are not satisfied with your supervisor's response, you can also speak to anyone in management whom you are comfortable approaching. You can also report suspected wrong doing to the Chief Risk Officer, who is responsible for ensuring that all such reports are thoroughly investigated and appropriate action is taken. All complaints must be made to Coast prior to [or simultaneously with] any complaint being made to any outside agency or authority. Reports may be made to the Chief Risk Officer in the following manner: Telephone: ____-_____-_______ Email: _______@___________.___ Confidential Mailbox: Attention: Chief Risk Officer __________ understands and accepts that there may be instances where a person may wish to report a possible wrong doing anonymously. However, it must be appreciated that it will be easier to follow up and verify complaints if the complainant is prepared to give his or her name. Acting in Good Faith __________ is proud of its reputation and uses substantial and adequate resources to investigate any report of wrong doing or suspected wrong doing. However, anyone filing such a report must be acting in good faith, have an honest belief that the complaint is well founded and have reasonable grounds for believing, that the information disclosed indicates wrong doing. __________ will regard failure to comply with any requirements of this Policy or the making of any deliberately false or malicious allegations as a serious breach of the __________ Code of Conduct Policy which may result in disciplinary action, up to and including dismissal for cause. Confidentiality Reports of violations or suspected violations will be kept in accordance with the Code of Conduct Policy and will be kept confidential to the extent possible, consistent with the need to conduct an adequate investigation. The Chief Risk Officer will acknowledge receipt of each reported violation or suspected violation within five business days. All reports will be promptly investigated and appropriate corrective action will be taken if warranted by the investigation.