This article is for the legal, procurement, and vendor-risk teams reviewing RapidRatings. It covers the policies RapidRatings maintains, how employees and subcontractors are controlled, how compliance training is managed and measured, and how senior management and the board oversee the program. For how members' financial data is used and protected on the FHR Exchange specifically, see How Your Financial Data Is Used and Shared, Information Security Overview, and Non-Disclosure Agreement.
RapidRatings operates a risk-based approach to its compliance and regulatory program by evaluating risks from a user, services, and geographical perspective. The program is aligned with national and international laws relevant to the jurisdictions in which RapidRatings operates, including anti-money laundering, anti-bribery, and whistleblower protection regimes.
Policies in place
The following policies and procedures form the compliance program:
Whistleblower Protection Policy
Anti-Bribery and Corruption Policy
Corporate Social Responsibility Policy
Code of Conduct
Employee Handbook
Employee Non-Disclosure Agreements
Vendor Management Policy
Privacy and Information Security Policies
Do employees and subcontractors enter into an NDA before accessing confidential information?
Yes. All RapidRatings employees sign a Non-Disclosure Agreement as a condition of employment. Any subcontractor with access to RapidRatings confidential information or RapidRatings systems is required to have an NDA in place before beginning services.
Employee NDAs include contractual provisions that prohibit the use of confidential information for personal benefit or the benefit of a third party, both during employment and in connection with information accessed during employment.
Note: this article covers the NDAs between RapidRatings and its employees and subcontractors. For the NDA that applies between RapidRatings and FHR Exchange members, see Non-Disclosure Agreement.
Are background checks carried out on all employees?
Yes. RapidRatings conducts employment eligibility checks on all employees to confirm the legal right to work and reside in the jurisdictions in which RapidRatings has a presence. In the United States, RapidRatings also conducts background checks on all employees, including criminal background checks. Additional checks may be conducted depending on the role.
Is there a dedicated Code of Conduct in place?
Yes. RapidRatings maintains an internal Code of Conduct aligned with internationally accepted standards. All employees are required to abide by it. The core values the Code of Conduct is built on are integrity, mutual respect, teamwork, communication, innovation, customer satisfaction, quality, fairness, compliance, and ethical conduct.
How does RapidRatings protect whistleblowers?
RapidRatings has a Speak Up (Whistleblower) Policy that protects employees who raise concerns about unethical or illegal activity from unfair treatment and provides mechanisms for them to raise those concerns. The policy is complemented by the Code of Conduct and the Corporate Social Responsibility Policy.
The Corporate Social Responsibility Policy is published publicly at rapidratings.com/corporate-social-responsibility-policy.
What information security awareness training is provided?
RapidRatings provides corporate security and data protection awareness training to all employees. Additional, more specific security training is provided to employees in departments where the role demands it, including Client Services and Information Technology.
For the broader information security program this training operates within, see Information Security Overview.
What is RapidRatings' training completion rate?
RapidRatings maintains 100% completion of required compliance training by all employees. All employees, regardless of position, complete initial training and refresher training on information security, data protection, and employment obligations on a scheduled basis.
What level of senior management or board involvement is there in compliance?
RapidRatings operates several internal committees responsible for different areas of commercial, technology, and compliance operations. The committees meet on a regular basis, at a minimum quarterly, and are independent of one another. Each committee has an internal audit function that reviews whether policies and procedures remain current and relevant.
Senior management members sit on these committees. Policy and procedural changes are decided by the committees based on committee review and audit findings.
Is there a regularly updated employee handbook?
Yes. RapidRatings maintains employee handbooks that are reviewed on approximately an annual basis. Specific policies and procedures are reviewed more frequently when triggering events occur, including changes in laws, changes in organizational structure, or changes in technology.
How does RapidRatings manage risk from remote workers?
RapidRatings manages remote-worker risk through a combination of workforce management practices and controls, including the use of tracking and monitoring technology, video conferencing, planning and organization ahead of time, management by objectives, and regular interaction with staff. These are the practices RapidRatings currently uses to address concerns around loss of control, productivity, and security that can arise with remote arrangements.
Getting more detail
If your legal, procurement, or vendor-risk team needs specific documentation to complete a review (copies of RapidRatings' policies, confirmation of specific controls, or evidence of training completion), contact your RapidRatings account representative. For the privacy and regulatory position, see Privacy Regulations FAQs. For the vendors and sub-processors RapidRatings uses to deliver the FHR Exchange, see Vendor and Sub-Processor List.