Ethics Helpline Reporting FAQs

If you see or hear something that doesn’t seem right, please let us know. A qualified Palo Alto Networks (herein “PANW” or “the Company”) professional will help address your concerns and answer your ethics and compliance questions.

At PANW, you have many options for reporting a concern and receiving guidance on our compliance policies and procedures. This FAQs document will cover some basics.

1. When should I report a concern?
2. What if I have a question or feedback?
3. How do I report a concern or get an answer?
4. What information should I include in my report?
5. What is the Ethics Helpline?
6. Is reporting confidential?
7. Can I remain anonymous?
8. Do I tell my manager?
9. Will I be punished for reporting a concern?
10. What happens once I submit a concern?
11. How long will the investigation take?
12. What happens if I’m wrong?
13. What happens if my concern is substantiated?
14. Will I know the final outcome of my concern?

1. 1. When Should I Report a Concern?

   If you see or hear something you believe isn’t right, may violate a law, contradicts the PANW Code of Business Conduct and Ethics, or any other Company policy or procedure, report it to our Global Ethics Team (“GET”). If you are a people manager and learn of an ethics concern from a member of your team, ask them for details and if you are unsure how to address it, report it to GET. Never investigate the issue yourself. Our professionally trained investigators will do that for you.

   Some common issues to report include workplace harassment, discrimination, fraud, bribery, kickbacks, conflicts of interest, fair competition and business dealings, loss or theft of confidential information, improper business courtesies, fraudulent expenses or theft of Company assets, and many others. If you are uncertain what our Code, policies, and procedures require, first speak to your manager if you’re comfortable doing so, but if you don’t receive an answer or remain unsure, come to us (ethics@paloaltonetworks.com) and we’ll help you resolve your concern and ensure compliance.

   
   
   

2. 2. What if I have a Question or Feedback?

   We understand that sometimes you may be unsure about what is required or want to provide feedback about our ethics program. We are here to help, or find someone who will. Do not hesitate to contact us via the Helpline or directly via ethics@paloaltonetworks.com and we will make sure you get answers to questions about our ethics policies, procedures, guidelines, controls, and processes. Likewise, we appreciate all good faith feedback on how we can improve our valued culture of ethics and integrity.

   
   
   

3. 3. How Do I Report a Concern or Get an Answer?

   You can report your concern or have your question answered through either the Helpline website, or toll free by phone, where you will be asked for details of the concerns/improper conduct, the names of individuals involved and any supporting documents you may have. You can also reach out to us directly at ethics@paloaltonetworks.com. All reporting options offer you the option of remaining anonymous if you wish.

   
   
   

4. 4. What information should I include in my report?

   Include all material information relating to your concern that you believe will help us address it timely and effectively. To the extent you know, please include what you believe is wrong, who is involved, who knows about the issue, who may provide helpful information, when you first learned of the issue, how long you believe it's been going on, where it’s taking place, and why you believe someone is engaging in this conduct. Attach any documents you believe may be relevant or identify where you believe the investigators can look to find relevant information.

   
   
   

5. 5. What is the Ethics Helpline?

   Our Ethics Helpline by EthicsPoint is an independently managed confidential reporting tool created and managed by NAVEX, Inc (“NAVEX”). It provides reporters the ability to inform the Company of any concerns and/or misconduct, including confidentiality. EthicsPoint is available to reporters 24 hours a day, and has professional translators available to assist reporters who want to call and report a concern in their native language. NAVEX will share with PANW only the information you provide and is contractually obligated to implement proper security measures to protect your personal information and to process your information in accordance with all applicable laws and regulations. NAVEX is registered and self-certified with the US-EU Privacy Shield and the US-Swiss Privacy Shield for HR and non-HR data. For more information, please refer to the EU-US Privacy Shield or Swiss–US Privacy Shield website available under: https://www.privacyshield.gov/.

   
   
   

6. 6. Is reporting confidential?

   We keep all reports confidential to the extent possible. Investigating concerns often involves interviewing relevant individuals and we cannot therefore promise complete confidentiality. However, please know that we exercise appropriate caution, sharing only need-to-know information with the smallest possible audience required for conducting a credible investigation. We require all witnesses to keep our discussions in confidence and to respect our fact-finding process and the individuals involved. We handle all material investigative information in accordance with our Employees Privacy Policy.

   
   
   

7. 7. Can I remain anonymous?

   Yes, we allow reporters to make reports anonymously and promise those who wish to remain anonymous that we will not take any proactive steps to identify them, where legally permissible. NAVEX does not generate or maintain any internal connection logs with IP addresses and has no information linking your reporting device. When submitting an anonymous report, please provide us with contact information or log-into the Helpline periodically using the code provided to you by NAVEX. You can also create an anonymous email account and use it to communicate with us via ethics@paloaltonetworks.com, but please remember to check that account for correspondence.

   Please note that in some cases, knowing your identity can help us protect your anonymity. For example, if the information you are sharing was only available to a small group of people, knowing your identity may help us design the investigation in a manner that does not reveal your identity. However, whether you wish to remain anonymous or not, is solely up to you. We will address all good-faith reports containing sufficient information irrespective of whether or not the reporter is anonymous.

   
   
   

8. 8. Do I tell my manager?

   You are always welcome to escalate your concern to your manager or another trusted manager. They will ensure your concern is properly routed to the appropriate Company investigator. However, there is absolutely no need to tell your manager or another manager if you are uncomfortable.

   Sometimes a reporter feels comfortable going to a manager initially, but later decides they no longer want to discuss the issue with the manager. If that happens and a manager asks you about status, simply tell them that you’ve been instructed by GET or ER to not discuss the issue with anyone and refer them to us for additional information.

   Remember, raising your concern to the Helpline or to us directly at ethics@paloaltonetworks.com will ensure timely routing of your report to trained investigators who will help address your concern.

   
   
   

9. 9. Will I be punished for reporting a concern?

   PANW strictly prohibits retaliation against good faith reporters. Our commitments to protection of reporters is outlined in our Global Code of Business Conduct and Ethics found here, as well as in other Company policies. Anyone who engages in retaliation is subject to discipline, up to and including termination of employment. If you believe you have been a victim of retaliation for raising a good faith concern, please report this to us immediately.

   
   
   

10. 10. What happens once I submit a concern?

    PANW takes all good faith reports seriously and investigates them thoroughly. An experienced investigator assesses each report, and where appropriate, initiates an investigation. We may ask to speak with you or request you provide additional details to ensure we properly understand your concern and can address it expeditiously. In some instances, we may need additional information to enable a thorough and impartial investigation.

    If you report a concern and for some reason do not hear back from us, please contact us again. It is possible that we were unable to contact you for additional information, which can happen when for example someone submits a report by phone without providing any contact information or forget to check the Helpline using the code provided by NAVEX.

    Please make sure you keep the report key provided by NAVEX and remember your password. To ensure security and confidentiality, NAVEX will not provide anyone with prior keys or passwords. However, you can simply re-file your report, noting that it is related to a prior submission, but that you lost your key or forgot your password.

    Each investigation is different, but in most cases, our investigators will review documents, interview witnesses, and take other appropriate steps to reach a determination. Once we reach a conclusion, we will debrief relevant staff and, where we determine a violation of Company policy took place, we will help determine and implement the right corrective action for the circumstances. Our goal is to correct the situation and mitigate or prevent misconduct from occurring again. We rely on good faith reporters to escalate their concerns to us so we can operate safely, effectively, and in accordance with our expectations set for in our policies, in addition to all applicable laws and regulations.

    
    
    
    

11. 11. How long will the investigation take?

    Rest assured that we investigate matters as expeditiously as possible. However, the more complex the matter, the longer it may take us to complete our fact finding. Additional factors, some outside of our control, may also impact the length of an investigation. These can include total volume of cases, availability of witnesses, or time it takes to process or translate key evidence.

    If you have additional information relevant to the investigation, please reach out and provide it to investigators. You are welcome to check-in periodically, but please know that in general, investigators will not be able to tell you how long they will need to complete their work and constantly asking for updates can delay appropriate resolution of your concerns.

    
    
    

12. 12. What happens if I’m wrong?

    In short, nothing. It doesn’t matter if we ultimately determine that no one did anything wrong. So long as you’re not reporting something in bad faith, i.e., falsely and maliciously, it doesn’t matter if you are wrong. Never investigate on your own. As soon as you believe something is wrong, report it and the Company will assign a trained investigator to address the issue.

    Please come to us with any good faith concern or if you have any questions relevant to ensuring we do business ethically. If you honestly believe something is not right, report it so we can address it. For example, a report may result in clarifying our policies or procedures, or creating training that may take the reported scenario into account. This is how we make sure our Company, employees, and business partners fully understand and meet the highest ethical standards demanded by our management and our Board of Directors.

    
    
    

13. 13. What happens if my concern is substantiated?

    The Company takes action in accordance with all applicable legal and privacy requirements to resolve acts of misconduct, including among others, coaching, imposition of discipline, corrective actions, remediation, training, or adjustments to our controls, guidelines, policies, and/or procedures.

    
    
    

14. 14. Will I know the final outcome of my concern?

    Please periodically check the Helpline or contact information you provided for us to keep in touch with you. As a matter of course, we will be happy to let you know where we stand in connection with addressing your concern and will notify you once we’ve finished our work, even where you reported anonymously. Legal and privacy requirements, including the need to protect confidentiality and anonymity of relevant parties may limit our ability to share information with you. However, we will do our best to let you know the outcome and where possible, inform you where your report has led to improvements.