Build a strong team to comply with conflict minerals rule

There is no mistaking the effect that a new regulation regarding conflict minerals will have on manufacturers and their suppliers. Tracing the commonly used minerals of tin, tungsten, tantalum, and gold through intricate global supply chain networks will be no easy task.

“This is one of the most complex compliance projects we’ve ever seen,” Steve Starbuck, Ernst & Young’s leader in the Americas for climate change and sustainability services, said during a recent webcast.

In August, the SEC approved disclosure rules requiring annual reporting on whether U.S. public companies use conflict minerals originating in the Democratic Republic of the Congo (DRC) or neighboring countries. The rule represents an unusual effort to prevent human rights abuses through securities regulations, as it aims to cut off funding for warlords accused of committing atrocities in those countries.

The first Conflict Minerals Reports are due May 31, 2014, to report on the 2013 calendar year, so companies are moving quickly to determine proper due-diligence policies and put them into place. The SEC has estimated that the rule will apply to about 6,000 public companies.

Company compliance teams will ask suppliers worldwide to explain how they acquired tin, tungsten, tantalum, and gold, which can be used for products ranging from computer hardware to garment zippers to jewelry.

The SEC has estimated initial compliance costs of $3 billion to $4 billion. That doesn’t include the cost for companies further down the supply chain.

“It relates to, probably, many more companies than people had assumed,” said Colleen Cunningham, CPA, a former CEO of Financial Executives International. “In addition to half the SEC registrants, [U.S. public companies] also have maybe hundreds of thousands of other suppliers that might need to put in some procedures to determine where they are sourcing these minerals to be sure they can provide some sort of certification to their clients. So it’s going to be much more widespread than folks probably anticipated.”

In some cases, complying might require a company to do its best to certify where thousands of suppliers acquired materials. Many companies will need to have their due-diligence processes audited, perhaps by CPA firms.

E&Y consultants suggest that companies build compliance teams that should include a wide range of key functions, including finance, engineering, IT, and communications.

The team leader must have management’s backing so employees across the company will make compliance a priority, Starbuck said. “Busy people are going to be asked to be burdened,” he said. “And we need to make sure they know it’s important.”

This article discusses why the rule was created, some best practices for compliance, and the new audit requirement that is included in the new rule.

Aimed at warlords

To understand the purpose of the conflict minerals requirements, it’s useful to examine their roots.
 
The Dodd-Frank Wall Street Reform and Consumer Protection Act, P.L. 111-203, was created in large part to correct banking procedures that helped lead to the financial crisis. Section 1502 of the law had nothing to do with the financial crisis, but was added to help prevent human rights violations occurring in Africa.

Warlords in the DRC finance their operations by mining tin, tungsten, tantalum, and gold. They use forced labor and commit atrocities against local populations in the process, according to human rights groups.

The regulation aims to cut off funding for the warlords by eliminating markets for the products of their mines. Human rights groups celebrated the regulation, but some industry groups expressed concern about the costs. When the SEC adopted the regulation in August, two dissenting SEC commissioners expressed concern that the commission was exceeding its mandate in a well-intentioned attempt to prevent human rights violations through business regulation.

A legal challenge from the National Association of Manufacturers and the U.S. Chamber of Commerce filed in the U.S. Court of Appeals for the District of Columbia Circuit seeks to have the rule modified or set aside in whole or in part.

But companies overwhelmingly are continuing on the compliance track despite the legal challenge because they believe customers are going to demand it, Starbuck said. “It’s an issue companies are going to have to deal with, even if the rule goes away,” he said.

Three-step process

The SEC describes a three-step process for manufacturers to use to determine whether their products are “DRC conflict free.”

First, companies must determine whether tin, tungsten, tantalum, or gold are used in or critical to the functionality of their product. This can require some judgment, particularly with regard to packaging.

“If you’re [a food distributor] and you’re storing biscuits in tins, is the tin necessary to the functionality of the biscuit? It’s kind of tricky to determine whether it applies or not,” Cunningham said. “They added that, ‘necessary to the functionality of the product,’ in the final rule, and I think that’s created a lot of confusion for folks.”

If a company determines that no conflict minerals are present in its products, no further action is needed. In addition, any conflict minerals that were either fully refined or located outside of the DRC and its neighboring countries before Jan. 31, 2013, are exempt from the rule.

But if conflict minerals that don’t meet that Jan. 31 exemption are present, companies must go through the second step, which requires a reasonable country of origin inquiry (RCOI) regarding the minerals.

Should the company determine that none of the conflict minerals used in its products come from the DRC or its neighboring countries, that information and a description of the RCOI process must be disclosed to the SEC on a new Form SD.

If the company has reason to believe it has used conflict minerals from the DRC or neighboring countries that did not come from recycled or scrap sources, it must move to the third step in the process. The third step requires the company to conduct due diligence on the source and chain of custody of its conflict minerals.

This due-diligence process should determine whether the issuer’s minerals directly or indirectly benefited armed groups in the DRC or its neighboring countries. The rule requires use of a recognized due-diligence framework; the only such existing framework was created by the Organisation for Economic Co-operation and Development (OECD).

Such companies must file a Conflict Minerals Report as an exhibit to Form SD. The Conflict Minerals Report must include the country of origin of the minerals and a description of efforts to pinpoint the exact location where the minerals originated. Any minerals whose purchase funded armed groups and are not “DRC conflict free” must be listed in the report.

A company must have its Conflict Minerals Report audited by an independent auditor, and include a statement in the report certifying that the audit was conducted.

How to proceed

Fulfilling these due-diligence requirements by researching the chain of custody for hundreds or even thousands of suppliers can be a large undertaking for a company.

According to E&Y, best practices include setting up a governance structure and developing a charter, work plan, timeline, and budget. Internal information must be sent to employees, training sessions can be conducted if necessary, and the audit committee and board of directors should be kept in the loop, according to information E&Y presented in its webcast.

Management can assess targets and timelines, and a plan for risk management, and corrective action also can be drafted, according to the E&Y webcast. E&Y offered the following guidance for engaging suppliers:

• Review procurement policies and supplier diligence practices.
• Consider including broader elements in a supplier code of conduct.
• Develop procedures for suspending or terminating suppliers that do not comply with your sourcing policies.
• Benchmark your supply chain policy against those of your competitors.
• When considering acquisitions, keep conflict minerals in mind.

Rich Goode, an E&Y senior manager for climate change and sustainability services, said going through this process is an arduous task. That’s why he said companies that are questioning suppliers about conflict minerals might also want to use this point of contact as an opportunity to discuss other important issues such as environmental initiatives.

“You might as well do this and do it right,” Goode said.

Other suggestions from E&Y include:

• Using technology to identify red flags for further investigation. These can include smelters that use conflict minerals from many countries of origin, including the DRC or one of its neighbors.
• Leverage industry associations for guidance. IPC, an electronics industry association, is among those presenting strategies and tools for compliance.
• Although the rule does not require keeping reviewable business records, such records may be useful in demonstrating compliance.

Audit requirements

The audit of a company’s due diligence can either be a performance—which does not have to be conducted by a CPA firm—or an attestation engagement performed by a CPA firm. U.S. Governmental Auditing Standards, also known as GAGAS or The Yellow Book standards, will govern the audit.

This audit will not assess the effectiveness of due diligence or give an opinion on whether minerals that are not DRC conflict free exist in a company’s supply chain. Rather, the audit will assess whether the design of a company’s due-diligence activities complies with the due-diligence framework, and whether the description of the due-diligence measures matches the steps that were taken.

Starbuck said every company he has talked to plans to have the attestation engagement conducted. This will create an opportunity for CPA firms.

“There’s a general sense that it will be the financial statement auditor [who gets selected to do a company’s conflict minerals audit],” Starbuck said.

Reputational risk

Even though companies will have to take thorough measures to identify the source of their conflict minerals, the rule does not prevent manufacturers from using conflict minerals mined by warlords.

Rather, the intent of the regulation is to require disclosures that could harm the reputations of companies that, through their supply chains, finance armed groups in Africa. Cunningham said it remains to be seen how issuing reports that say their materials are not conflict free will affect companies’ reputations.

Cunningham, who is vice president and controller at Zoetis, a Pfizer subsidiary that develops and manufactures animal medicines and vaccines, said her company does not use conflict minerals. She said some companies might file reports that acknowledge use of conflict minerals but say they are working toward ensuring that they are DRC conflict free and describe their process for achieving that goal.

It also may be difficult for companies to determine with certainty where all their materials originate. The new rules provide a grace period of two years, and four years for smaller companies, where they can describe minerals as “conflict undeterminable.”

Companies that have a chief compliance officer many times are turning over leadership of this task to that person, according to Cunningham. But she said that leadership can come from a variety of functions, including the general counsel, internal audit, finance, and procurement.

Starbuck said this complicated compliance task at any company should involve a variety of departments and personnel. “As complex as this is, you need to have a team that’s pulled together to manage this,” Starbuck said. “And that team needs to be empowered.”

—Ken Tysiac (ktysiac@aicpa.org) is a JofA senior editor.