Ethics and Compliance Reporting Procedure

Organization: Igzibo Engineering Solutions, Inc.
Version: 1.0
Status: Living procedure
Effective Date: September 16, 2026
Owner: Igzibo Engineering Solutions, Inc.
Review Cycle: At least annually and after material changes to applicable law, governance requirements, reporting channels, organizational structure, or business operations.

1. Purpose

This procedure establishes the operational process for reporting suspected misconduct, policy violations, legal or compliance concerns, security concerns, conflicts of interest, improper payments, discrimination, harassment, fraud, privacy concerns, and other matters that may require organizational review.

The procedure supports the reporting expectations established by the Code of Business Conduct and Ethics and related governance documents.

2. Scope

This procedure applies to:

• Employees.
• Contractors.
• Consultants.
• Interns and temporary workers.
• Officers and directors where applicable.
• Recruiters and staffing personnel acting for Igzibo.
• Recruiting partners and other representatives.
• Suppliers, vendors, and service providers where applicable.
• Candidates and applicants where the concern relates to Igzibo recruiting or business activity.
• Other persons who submit a concern concerning Igzibo.

Definitions

• Compliance Concern: A suspected violation of law, regulation, contract, policy, standard, procedure, or other binding requirement.
• Good-Faith Report: A report submitted with an honest belief that the concern may warrant review, even if the concern is later determined to be unfounded.
• Igzibo: Igzibo Engineering Solutions, Inc.
• Investigation: A documented process for evaluating facts, evidence, circumstances, and applicable requirements concerning a reported matter.
• Reporter: A person who submits or assists with a report.
• Reporting Channel: An approved method through which a person may submit a concern to Igzibo.
• Retaliation: Adverse action taken because a person made a protected or good-faith report, participated in an investigation, or otherwise exercised a right protected by applicable law.

4. Matters That Should Be Reported

Reports may concern:

• Suspected illegal conduct.
• Fraud or financial misconduct.
• Improper payments, bribery, or corruption.
• Conflicts of interest.
• Falsification or material misrepresentation.
• Discrimination or harassment.
• Retaliation.
• Privacy or personal-information concerns.
• Security incidents or unauthorized access.
• Misuse of organizational resources.
• Intellectual property concerns.
• Client or contractual compliance concerns.
• Recruiting misconduct or unauthorized candidate representation.
• Supplier or recruiting-partner misconduct.
• Material violations of Igzibo policies, standards, or procedures.
• Other conduct that may materially harm Igzibo, its personnel, candidates, clients, suppliers, or other stakeholders.

Immediate danger, suspected criminal activity, or emergencies may require contacting appropriate emergency, law-enforcement, or other external authorities as permitted or required.

5. Reporting Channels

Igzibo must maintain at least one designated reporting channel through which concerns can be submitted.

The currently designated channel should be published through the applicable Igzibo website, workforce materials, contracts, or other official communications.

Depending on the matter and available mechanisms, a report may also be made to:

• A manager or supervisor.
• A designated compliance or ethics contact.
• A designated executive or organizational owner.
• Another channel established for privacy, security, human-resources, or client-specific concerns.

A person is not required to report a concern to an individual whom they reasonably believe is involved in the concern.

6. Reports Concerning the Chief Executive Officer or Other Senior Personnel

If a concern involves the Chief Executive Officer (CEO), an owner of the reporting channel, or another person who would ordinarily receive or control the report, the concern should be routed to an alternative authorized recipient where available.

The recipient must avoid allowing the subject of the report to control the intake, investigation, disposition, or access to the report except where necessary and authorized.

7. Information to Include

A reporter should provide, when reasonably available:

• What happened.
• When and where it occurred.
• Who was involved.
• Who may have relevant information.
• Relevant client, project, contract, or system.
• Supporting documents or other evidence.
• Whether the matter is ongoing.
• Any immediate safety, security, legal, or client risk.

A reporter is not expected to establish the facts or determine whether a violation occurred before making a good-faith report.

8. Intake and Acknowledgment

The designated recipient should:

1. Receive the report.
2. Record the date and basic nature of the concern.
3. Preserve submitted evidence.
4. Determine whether immediate action is required.
5. Assess whether the recipient has a conflict of interest.
6. Assign an appropriate owner or investigator.
7. Acknowledge receipt where contact information is available and acknowledgment is appropriate.

Reports should be handled consistently and without unreasonable delay.

9. Triage and Escalation

The responsible reviewer should assess:

• Potential legal or regulatory impact.
• Safety concerns.
• Security or privacy impact.
• Client impact.
• Financial impact.
• Reputational or operational impact.
• Potential conflicts of interest.
• Whether immediate containment is necessary.
• Whether specialized legal, security, human-resources, or other expertise is required.

Material matters should be escalated to the appropriate organizational authority.

10. Confidentiality

Reports and investigation information should be handled discreetly and shared only with persons who have a legitimate need to know.

Confidentiality cannot be guaranteed in all circumstances. Disclosure may be required by law, necessary to conduct an investigation, or necessary to protect people, systems, clients, or organizational interests.

Reporters should avoid broadly distributing allegations or investigation materials outside authorized channels.

11. Anonymous Reports

Where the designated reporting mechanism supports anonymous reporting, anonymous reports should be accepted and reviewed according to the same general triage principles.

Igzibo may be unable to request clarification or provide status information when the reporter cannot be contacted.

12. Non-Retaliation

Igzibo prohibits retaliation to the extent required by applicable law against a person for making a good-faith report, participating in an authorized investigation, or exercising a legally protected right.

A report made in good faith does not become improper merely because the concern is not substantiated.

Knowingly false or malicious reports may be addressed through appropriate corrective action, subject to applicable law and the circumstances.

13. Investigation Coordination

Investigations should be proportionate to the nature and risk of the matter.

The investigator or responsible reviewer should:

• Define the scope.
• Preserve relevant records.
• Identify relevant persons and systems.
• Collect and evaluate available evidence.
• Maintain appropriate documentation.
• Protect confidential information.
• Escalate newly identified material issues.
• Document findings and recommended actions where appropriate.

Legal matters should be coordinated with qualified legal counsel when appropriate.

14. Corrective and Remedial Action

Depending on findings, Igzibo may take actions including:

• Correcting a process or control.
• Removing or restricting access.
• Providing training.
• Recovering funds or property.
• Correcting records.
• Addressing client or contractual obligations.
• Disciplinary action.
• Contractual remedies.
• Reporting to appropriate authorities where required or authorized.
• Other remedial measures appropriate to the circumstances.

15. Security, Privacy, and Client Incidents

Reports involving security incidents, personal information, client information, or suspected data exposure must also be handled under the applicable:

• Security Incident Response Procedure.
• Data Classification and Handling Standard.
• Client Data Processing Standard.
• Privacy Notice.
• Employee and Contractor Privacy Notice.
• Candidate and Applicant Privacy Notice.
• Applicable client contract or incident-notification requirement.

The most specific applicable incident process should be followed where one exists.

16. Records

Reports, intake records, investigation materials, findings, and corrective-action records must be handled according to the Records Retention and Disposal Standard.

Records subject to legal hold or another preservation obligation must be preserved.

17. Conflicts of Interest

A person involved in receiving, investigating, or deciding a matter must disclose a material conflict and should be removed from the relevant role when appropriate.

The subject of a report must not control its investigation or final disposition unless an appropriate authorized determination establishes otherwise.

18. External Reporting

Nothing in this procedure prohibits a person from contacting a government agency, law-enforcement authority, court, regulator, or other external body when permitted or required by applicable law.

Igzibo personnel must not obstruct legally protected reporting.

19. Roles and Responsibilities

Reporters

Report concerns in good faith and provide reasonably available information.

Reporting Channel Owner

Maintain the designated reporting mechanism, protect access, document intake, and route reports appropriately.

Investigator or Reviewer

Conduct or coordinate an impartial and appropriately scoped review.

Management

Support corrective actions and protect against retaliation.

Legal or Specialized Advisers

Provide specialized advice where the matter involves legal, regulatory, privacy, security, employment, contractual, or other specialized issues.

20. Exceptions

Exceptions to this procedure require documented authorization and must not conflict with applicable law or legally protected reporting rights.

21. Relationship to Other Governance Documents

This procedure should be read together with:

1. Code of Business Conduct and Ethics.
2. Conflict of Interest Policy.
3. Anti-Bribery and Anti-Corruption Policy.
4. Equal Employment Opportunity and Anti-Discrimination Policy.
5. Supplier, Contractor, and Vendor Code of Conduct.
6. Recruiting Partner Code of Conduct.
7. Recruiting and Candidate Management Policy.
8. Privacy Notice.
9. Employee and Contractor Privacy Notice.
10. Candidate and Applicant Privacy Notice.
11. Security Incident Response Procedure.
12. Records Retention and Disposal Standard.
13. Technology Acceptable Use Policy.
14. Technology and Third-Party Service Security Standard.

22. Enforcement

Failure to follow this procedure may result in corrective action, access restrictions, contractual remedies, or other appropriate action, subject to applicable law.

Version History