The Openness Act - Explanation of due diligence assessments

Our business and operating area is organized as follows:

Cefalo AS is a Norwegian IT consulting company with headquarters in Oslo. The company mainly provides consultancy services via its subsidiary Cefalo Bangladesh Ltd with headquarters in Dhaka, Bangladesh. Commercial operations and customer processes are mainly done in Cefalo AS, while service production mainly takes place in Cefalo Bangladesh Ltd.

Cefalo Bangladesh Ltd has locally rooted management in Dhaka who work closely with the management of Cefalo AS, with a focus on follow-up of service deliveries to Cefalo AS's customers. The commercial relationship as a supplier/subcontractor between the companies in the group is regulated in a separate agreement. The management of Cefalo AS carries out 6-12 visits to Cefalo Bangladesh Ltd per year, and has individual and team-based follow-up of all consultants, as well as administrative personnel.

We have established the following guidelines and routines to handle actual and potential negative consequences for basic human rights and decent working conditions:

The board and management of Cefalo AS have undertaken to carry out continuous due diligence assessments and review documentation of these at least every six months. As a company with a subcontractor in Bangladesh, we recognize the importance of conducting thorough due diligence assessments to ensure compliance with the Transparency Act and promote responsible supply chains. We are committed to taking all necessary steps to ensure that our business and our subcontractors operate in accordance with relevant standards for labor rights, human rights and environmental considerations.

Cefalo AS has established a Code of Conduct for employees and subcontractors/business partners. This sets basic requirements for ethical standards, impact on the environment, safety in the workplace, protection of human rights for employees and anti-corruption measures. We have also carried out an analysis and overall risk assessment of subcontractors and business partners in Bangladesh and Norway, as a basis for which suppliers we ask to commit to and sign our Code of Conduct. We recognize that due diligence assessments are an ongoing process, and we are committed to continually improving our practices based on new knowledge, experiences and best practices. Our aim is to ensure a responsible and sustainable supply chain and contribute to promoting labor rights, human rights and environmental protection in Bangladesh.

With this as a background, Cefalo AS has chosen to focus on our investigations against Cefalo Bangladesh Ltd, as well as some selected business partners in Norway and Bangladesh. In 2023, Cefalo AS has carried out detailed investigations at Cefalo Bangladesh Ltd to uncover any risk areas and actual negative impacts on Cefalo's business operations. All consultants in Cefalo Bangladesh Ltd have signed the same Code of Conduct as employees in Cefalo AS. Towards our business partners, the focus has been directed towards anchoring Cefalo's Code of Conduct, while at Cefalo Bangladesh Ltd, several in-depth investigations have been carried out with the intention of uncovering any negative consequences.

Specifically, in 2023 several detailed investigations were carried out in Cefalo Bangladesh Ltd - among other things

• Anonymous employee surveys that focus on employee satisfaction, general working conditions, cases of discrimination or other unfortunate conditions. This type of survey is carried out as standard twice a year.
• An external analysis of Cefalo Bangladesh Ltd's employees' contractual terms and conditions against local legislation.
• An external analysis of security conditions at the offices from which Cefalo Bangladesh Ltd operates.
• Internal investigations and audits in relation to privacy and general working conditions.

The investigations have been carried out by internal resources, as well as external parties who are experts on local conditions in Bangladesh.

Through our due diligence assessments, we have uncovered the following actual negative consequences:

No significant negative consequences for Cefalo AS's business operations have been uncovered through investigations and due diligence assessments. Minor deviations have been identified, and measures have been implemented.

Cefalo considers the presence and commercial operation of service businesses as a generally positive contribution to Bangladesh's economic development. Cefalo employs more than 200 technologists with good working conditions, and manages the business and employees according to Norwegian management principles - a short path to management, equality, openness and an emphasis on a good balance between leisure and work. This is documented via regular employee surveys, as well as feedback from employees and former employees on services such as Glassdoor. Overall, Cefalo AS contributes to setting a high standard for working conditions via Cefalo Bangladesh Ltd via its position in the market as one of the most attractive workplaces for technologists in Dhaka. Furthermore, Cefalo contributes to the education of poor children and young people in Bangladesh via various support schemes.

In addition, we have uncovered the following significant risk of negative consequences:
Bangladesh as a country has challenges in terms of workers' rights, corruption and human rights in general, among other things documented by the Global Rights Index. There is widespread poverty, but the country is undergoing strong economic development - something that Cefalo's business operations also contribute to.

Reports from the Global Rights Index point to the textile industry, which employs approximately 4.5 million people in Bangladesh, as the most problematic part in terms of the protection of workers' rights. The Bureau of International Labor Affairs in the USA has further defined the following products that Cefalo Bangladesh Ltd may have purchased - directly or indirectly - locally in Bangladesh as problematic in relation to the use of child labor and "forced labour": bricks, furniture with steel components, clothing products, glass, soap , poultry and salt. When operating in Bangladesh, these are products you cannot avoid acquiring in the local market, directly or indirectly, despite the fact that some of them are defined as products with risks attached to them. There is therefore a risk that Cefalo AS has purchased products from suppliers who do not operate in accordance with the requirements of the Transparency Act and Cefalo's Code of Conduct.

In order to stop the negative consequences that have been discovered, we have implemented the following measures:

The investigations have resulted in a list of measures that have either been implemented or will be implemented in Cefalo Bangladesh Ltd during 2023. This includes adjustments to the standard employment contract, physical measures at office premises to increase the level of security, inclusion of Cefalo Bangladesh Ltd in Cefalo AS's system for internal control according to GDPR's requirements and accountability of the management and board of Cefalo Bangladesh Ltd according to the requirements of the Transparency Act.

In order to limit the significant risk of negative consequences, we have implemented the following measures:

Cefalo Bangladesh Ltd buys - directly or indirectly - products the Bureau of International Labor Affairs in the USA has defined as potentially problematic locally in connection with the operation of office facilities and food service to employees. Given Cefalo's limited relative size locally in these markets in Bangladesh, as well as the fact that the problems are largely systemic, it is considered that Cefalo has limited opportunities to influence these suppliers directly. Cefalo AS and Cefalo Bangladesh Ltd are obliged through the Cefalo Code of Conduct to choose responsible partners. Key partners have been asked to commit to following our Code of Conduct, and those who do not commit to this will be considered for replacement.

Implemented measures have produced the following result or expected result:

Physical security at offices in Bangladesh has increased, several information security measures have been implemented that have reduced the risk of breaches of the privacy of our employees, and suppliers are monitored more closely in terms of accountability and quality. Attention to the use of responsible partners has increased and is rooted in the board and management of both Cefalo AS and Cefalo Bangladesh Ltd.