Assurance Process and Key Considerations

3.1 Planning and Assurance Engagement Risk Assessment

Objective: Assessing the engagement risk and setting the assurance plan

The objective of this phase is to assess the suitability of the assurance criteria and obtain an understanding of the Refiner's business, sector, industry and environment, its reporting policies, practices and performance, and the intended users of its report, to identify the risk of material non-conformances on which to focus the audit procedures. In this phase, the Assurance Provider undertakes desktop research supplemented by other procedures to:

• Assess the Refiner’s interpretation and application of the Guidance, and evaluate the suitability of the assurance criteria
• Review the Refiner’s general control environment with respect to responsible sourcing.

Assurance Providers follow the criteria set out in Step 1 of the Guidance: Establish strong company management systems to assess engagement risk. However, while the planning phase is a key step to managing assurance risk and engagement efficiency, the effectiveness of the assurance plan, including the nature, timing and extent of the planned procedures with respect to emerging material non-conformances, should be reconsidered throughout the engagement as an iterative process.

When assessing the suitability of the criteria, the Assurance Provider should be aware of the following:

• Professional scepticism – the need to maintain an independent and sceptical mindset, and entertain a realistic possibility that management’s assertions may be misstated
• Management bias – there may be reputational and commercial consequences to non-conformance
• Cultural considerations – the requirements of the Guidance may not be easy for companies to apply across all their operations, and there may not always be a
  cultural fit with certain territories. The Assurance Provider needs to preserve a mindset that does not consider inconsistent application of the Guidance
  and/or unethical behaviour to be acceptable for certain areas.

Guidance (ISAE 3000 / RGG)

Obtain an understanding of the Refiner’s operating environment
Identify the intended users and their information needs

Key considerations

Business and organisational structure:

• Parent, subsidiaries, affiliates and their activities and locations
• Names and locations of refineries, and types of precious metals-bearing material received and processed
• Base metal refining operations to determine whether precious metals-bearing material could be mining byproducts
• Units or operations that are actively contributing to precious metals activities, processes and systems, including off-site offices, processing facilities and/or storage areas
• Material processing method
• Participation in other precious metals supply chain initiatives and commitment to ESG
• Publicly available information on business partners and precious metals supply chain practices
• General industry or market developments that may require specific attention
• Prior year’s Compliance Report and Assurance Report
• Prior year’s Management Report and Corrective Action Plan
• Precious metals supply chain policy and procedures
• Other internal or external audit / assurance engagement relevant for aspects of the LBMA assurance (e.g., antimoney laundering audits, bribery and corruption audits, ESG audits)
• Prior and current year (if possible) Country of Origin Annex.

Guidance (ISAE 3000 / RGG)

Adopt and commit to a policy for gold supply chain due diligence

Key considerations

Policy evaluation:

• Gap assessment of the Refiner’s policy against Step 1.1 of the Guidance including:
  - OECD Annex II risks
  - Environmental, Social and Governance risks
  - Minimum criteria to be addressed in the policy document
• Policy implementation:
  - Policy implementation and monitoring processes, including:
  o Effective date and formalisation process
  o Frequency of review and update process
  o Internal and external communication
  o Monitoring of policy awareness and understanding
  o Publication of policy
  o Incorporation of previously identified corrective actions where relevant.
• Note 1: In practice, Refiners may have a suite of policies which cover the Guidance requirements, including codes of conduct, procurement policy, human rights policy, anti-money laundering and cash transactions policy, and anti-bribery and corruption policy. In some cases, the Refiner may have a principles-based policy for external publication with detail referenced in additional internal policies and/or process documents. The auditor should review these collectively to ensure all requisite elements of the Guidance are covered.
• Note 2: Policies may not always reflect updates to the Guidance or the OECD Due Diligence Guidance. For example, recent additions in the RGG regarding environment and sustainability, and payments of taxes, fees and royalties due to governments in the OECD guidance are frequently missing from Refiners’ policies.
• Note 3: Refiners may make a policy commitment to de-risk certain sources of gold, e.g., artisanal and small-scale gold or gold from certain jurisdictions. Note that this is not in line with the principles of the Guidance and the OECD Due Diligence Guidance.
• Note 4: Frequently, supply chain policies are not published. Not only is this a requirement of the Guidance, ISAE 3000 also requires the Assurance Provider to ensure that the policy (or the assurance criteria) is publicly available. In practice, Refiners may publish the high-level principles-based policy document. In this case, the Assurance Provider must ensure that sufficient detail on the policy and processes is included in the Compliance Report for the intended user’s understanding.

Guidance (ISAE 3000 / RGG)

Board-level oversight

Key considerations

• Board composition
• Experience and qualifications of members to provide sufficient oversight
• Refiner’s overall performance, improvements and focus areas for supply chain due diligence
• Relevant statistics on high-risk supply chains. Regular follow-up and monitoring of documented risk mitigation strategies
• Monitoring of third-party assurance findings and Corrective Action Plans.
• Note 1: For larger organisations, the Board may delegate oversight of the responsible sourcing programme to a Board sub-committee. It is important for the Assurance Provider to assess whether there is sufficient senior level understanding and decision-making capacity within this committee.
• Note 2: Assurance Provider should assess whether the Board is carrying out its responsibility as defined in the RGG appropriately. Good governance practice is for the Refiner to have formal Board agendas and meeting minutes, and meet on a regular basis (in line with corporate governance requirements or other Board committee schedules). The Assurance Provider may consider obtaining relevant evidence by inspecting Board minutes or interviewing the Board chair.

Guidance (ISAE 3000 / RGG)

Compliance Officer responsibility

Key considerations

• Job description, capacity and team composition
  - Compliance Officer’s skills and experience to oversee the supply chain due diligence process
  - Ongoing professional development
  - Day-to-day role
  - Reporting lines
  - Individual and team capacity to fulfil the role.

Guidance (ISAE 3000 / RGG)

Training

Key considerations

• Skills, experience and ongoing development:
  - Breadth of skills, relevance of experience and capacity of personnel to cover all aspects of the Guidance, including threat finance and ESG factors
  - Quality and frequency of internal training material to ensure all aspects, including money laundering, OECD Annex II, and ESG, are appropriately addressed
  - Training attendance and understanding monitoring.

Guidance (ISAE 3000 / RGG)

Payment through official banking channels

Key considerations

• Payment’s policy and procedures:
  - Possibility of cash transactions to be undertaken
  - Controls assessment to ensure that all cash transactions made are in line with Refiner policy and LBMA RGG version 9.
• Accounting entries and reconciliations.
• Note 1: Some Refiners with retail businesses in certain jurisdictions (e.g., Japan) have long-standing practices of conducting cash transactions with domestic public consumers. These are conducted in line with local regulatory and legislative requirements, and Refiners should be able to demonstrate compliance with these requirements.

Guidance (ISAE 3000 / RGG)

Cooperation with government authorities

Key considerations

• Regulatory engagement procedures
• Compliance audits and/or fines
• Media reports.

Guidance (ISAE 3000 / RGG)

Maintaining records

Key considerations

• Record retention policy and practice.

3.2 Testing

Objective: Executing procedures to collect sufficient appropriate evidence

In this phase, the Assurance Provider executes procedures to collect sufficient appropriate evidence to determine that:

• The Refiner’s Step 2 risk assessment and classification procedures, systems and controls are appropriately designed and implemented to prevent and detect illicit precious metals-bearing material in the supply chain
• The Refiner’s Step 3 risk mitigation procedures, systems and controls are appropriately designed and implemented such that identified risks are appropriately addressed
• The Refiner’s Step 5 Compliance Report and Country of Origin Annex describes the design, implementation and performance of the processes and controls during the reporting period in line with the Assurance Provider’s understanding.

Key Considerations for Step 2: Risk Assessment and Classification

The RGG version 9 outlines the minimum requirements for Refiner’s due diligence procedures and provides relevant templates in the Refiners Toolkit. Assurance Providers are required to use their experience and subject matter knowledge in assessing whether the Refiner’s processes, systems and controls are appropriately designed, as well as to assess whether these processes, systems and controls have been appropriately implemented.

Guidance (ISAE 3000 / RGG)

Conduct supply chain due diligence to identify potential risks

Key considerations

Location risk assessment:

• Inclusion of RGG minimum requirements
• Quality of sources used to inform the risk criteria (external vs internal; recognised vs unknown; third-party independence and reputation)
• Breadth of sources used to inform the risk criteria (coverage should include conflict risks, sanctions, gold transit routes).
• Note 1: Country risk assessment sources are continuously updated, the organisation’s process should reflect this
  - Review of suitability of sources (method and frequency).
• Note 2: Assurance Providers should have knowledge of responsible sourcing challenges in various jurisdictions and provide appropriate challenge to the Refiner’s process and risk assessment results. This can be done through:
  - Conducting own media searches
  - Keeping abreast of the items in the Responsible Sourcing newsletter and other sources
• Note 3: In circumstances where judgement is applied by the Refiner, the Assurance Provider needs to understand the process the company has followed to be comfortable with the company’s conflict assessment conclusions. For example, consider whether:
  - Other reference sources applied by the company are reliable and appropriately used
  - There is other publicly available information not considered by the company that indicates an operation may be located in a ‘conflict-affected or high-risk’ region (e.g., from recent political instability, performing a media search).

Supplier and type of material risk assessment:

• Walk-throughs of supplier risk assessment process design:
  - Inclusion of RGG minimum requirements:
  o Use of relevant LBMA KYC Questionnaires and Due Diligence Checklists, or
  o Inclusion of the minimum requirements in the Refiner’s own KYC checklist
  - Process followed for unobtainable supplier information
  - Compliance Officer review and sign-off procedures
  - Access controls over information management systems.
• Sample testing of supplier files:
  - Verifying supplier list is complete by comparing against formal supplier database or management system
  - KYC and Due Diligence forms completed with all supporting evidence gathered
  - KYC and Due Diligence forms reviewed by Compliance Officer
  - Risk Classification completed correctly as zero-tolerance, high-risk or low-risk per LBMA the Guidance.
• Note 1: Artisanal and small-scale mines may not always be legalised but should be legitimate. These operations may not have documented policies and procedure documents; however, the Refiner’s due diligence should support that relevant responsible production practices are implemented.
• Note 2: Owned mines (i.e., mines within the same corporate group as the Refiner) are expected to undergo risk-based due diligence on threat financing as well as ESG factors. An independent internal assessment may be conducted by Refiners on the anti-money laundering, anti-bribery and corruption, and ESG policies and practices of their mines, which may include:
  - Review of cash transactions for suspicious activities
  - Review of the human resources records to assess below minimum age and wage resources
  - ESG performance metrics
  - Known issues with stakeholders (regulators, communities, workers).
• Note 3: Owned mines may include third-party stock, which may be from high-risk locations or suppliers, and controls to manage third-party stock should be reviewed during the due diligence process.
• Note 4: For by-products, the RGG makes specific reference to the World Customs Organization’s Revised Kyoto Convention Annex K to determine the point of separation of gold from the mineral base, and hence the origin of the gold by-product. This is interpreted as follows:
  - Goods produced wholly in a given country shall be taken as originating in that country
  - Where two or more countries have taken part in the production of the goods, the origin of the goods should be determined according to the substantial transformation criterion. Regarding the substantial transformation criterion, the ad valorem percentage rule could be used. Such rules are based on the dutiable value/price.
  For example, copper is mined in Chile, the gold is extracted from the copper by a smelter in Japan, purchased by a trader in South Korea and then sent to an LBMA refinery. The country of origin for the LBMA refinery would be Japan as: 1) there are two countries in the production of the gold that is received by the LBMA refinery (Chile and Japan); and 2) the value of the product after smelting in Japan is higher than before processing in Japan. Therefore, the country of origin for the LBMA Refiner is the country of the smelter and not the country of extraction (as the Refiner receives a transformed product and not minerals) and not the country of the trader (who does not add value to the metal).
• Note 5: While the origin of recycled gold is defined as the point in the gold supply chain where the gold is returned to the Refiner or other downstream intermediate processor or recycler, the Refiner should make all reasonable attempts to evaluate the supply chain as far upstream as possible to determine potential risk. Where there may be potential risk in a supply chain, the Assurance Provider should assess whether the Refiner has made all reasonable efforts to identify and manage this risk.

Guidance (ISAE 3000 / RGG)

Monitoring of Transactions

Key considerations

• Completeness of supplier list / transactions lists
• Shipping / transportation document (waybill / airway bill, pro-forma invoice)
• Note 1: The procurement process may not be integrated with the supply chain due diligence process, e.g., transport of material could be diverted to a high-risk country, but the due diligence process is not updated. Good practice would include the Refiner assessing the security processes around transportation (secure packaging, reputable transportation company, armed guards), reconciliations between goods delivery notes and goods received notes, and requiring prior alerts for any changes to routing.

Guidance (ISAE 3000 / RGG)

Classify supply chains based on risk profiles

Key considerations

• Note 1: Sample testing should focus on medium- and low-risk classifications to assess under-reporting.
• Note 2: Large Scale Mines are not automatically considered low risk as they may be situated in high-risk jurisdictions or have high-risk organisational structures.
• Note 3: Local supply chains may also not always be low risk as the supplying counterparty may have complex organisational structures or supply high-risk material.

Guidance (ISAE 3000 / RGG)

Enhanced Due Diligence

Key considerations

• On-site visit
  Walk-throughs of on-site visit process:
  - Frequency of site visits (new suppliers and existing)
  - Determination of site visit scope aligned to due diligence findings
  - Subject matter experience of personnel conducting site visits
  - Inclusion of RGG minimum requirements:
  o Use of relevant LBMA Site Visit Reports or
  o Inclusion of minimum requirements in Refiner’s own site visit checklist
  - Process followed for unobtainable information
  - Compliance Officer review procedures
  - Access controls over information management systems.
• Sample review of Site Visit Reports:
  - Scope and coverage (i.e., all relevant aspects of threat financing and ESG factor risks are covered as identified in
  the initial due diligence)
  - Competency of employee or independence of independent third-party assessor to undertake required scope
  - Follow-up process and internal communication of issues identified
  - Review of On-Site Visit Report.
• Note 1: Site may not include as assessment of the ESG factors. The scope of the site visit should include all potential risks identified during the initial due diligence.
• Note 2: Good practice is for Refiners to conduct ongoing site visits on a rotational basis to high-risk suppliers, although not stipulated in the RGG.
• Additional EDD measures: LBMA minimum requirements have been considered by the Refiner.
• Note 3: Refiners are expected to obtain an Independent Assurance Report from intermediate refiners with high-risk supply chains, and existing suppliers have been given until July 2023 to commission this assurance to provide sufficient time to establish appropriate systems and processes. In the interim, the Refiner is expected to continue to assess the potential risk in the supply chain and deploy effective measures to manage this. Assurance Providers should discuss interim measures being undertaken by Refiners for these supply chains.

Key Considerations for Step 3: Mitigation Strategies

The risk management strategy is a critical component of the five-step process. Suspension and continuation of the relationship with improvement plans is likely to be more subjective based on the Refiner’s risk appetite. However, the Assurance Provider is required to exercise appropriate judgement based on experience and subject matter knowledge in assessing whether the risk management strategy and any improvement plans are appropriate and meet the objectives of the LBMA Programme.

Key Considerations for Step 5: Annual Reporting

Ultimately, assurance is provided on the disclosures contained in the Refiner’s Compliance Report and the Country of Origin Annex (Refiner’s Reports). The Assurance Provider is required to assess whether the Refiner’s Reports contain sufficient information regarding the Refiner’s application of the LBMA Responsible Sourcing Guidance, as well as actual performance, in particular the results of the risk assessment and risk mitigations steps during the assurance period.