Modern slavery webinar: tools and case studies for Modern Slavery Act compliance

Since the first modern slavery statements were published a year ago, we have gained perspective on what companies can do to fight slavery in the supply chain and the benefits of a robust anti-slavery programme. On Tuesday 26th September at 12:00pm, Richard Beale will be joining VinciWorks to discuss the practical aspects of modern slavery compliance and answer any questions you may have.

Register now

Meet the expert

Richard BealeRichard Beale is the Global Director of Supply Chain at Marshalls plc. and has over 20 years of experience managing global supply chain and procurement in the FMCG, retail, financial services, private equity and manufacturing sectors. At Marshalls, Richard is piloting a cutting-edge supplier education programme focusing on the elimination of modern slavery.
Continue reading

Download your modern slavery whistleblowing policy template

Hands showing freedom from modern slavery

Ensuring an organization promotes an anti-slavery culture is now more vital than ever. Organisations must therefore ensure their staff feel comfortable bringing up any concerns they have regarding slavery. All staff should be familiar with the organisation’s modern slavery statement and be able to identify a red flag worth raising with their employer. VinciWorks has therefore created a modern slavery whistleblowing policy template that can easily be updated to suit your organisation and staff.

Continue reading

The importance of Personal Protective Equipment (PPE) at work

The importance of Personal Protective Equipment (PPE) at work

What is PPE?

PPE stands for Personal Protective Equipment and is defined in the Personal Protective Equipment at Work Regulations as:

‘All equipment (including clothing affording protection against the weather) which is intended to be worn or held by a person at work which protects them against one or more risks to their health and safety’.

Examples of PPE equipment in the workplace include hard hats, goggles, high visibility jackets, safety footwear, safety harnesses, and respirators.

Who should provide PPE?

The provision of PPE in the workplace is covered by the Personal Protective Equipment at Work Regulations 1992. Under this legislation, employers have duties concerning the selection, provision, maintenance, storage and correct use of personal protective equipment. Employees must be appropriately trained on how to use the PPE required for each specific task. The cost of providing PPE must be covered by the employer and employees should not be expected to contribute in any way, towards the provision or maintenance of PPE.

Employees also have a duty regarding the use of PPE. Under the work regulations, employees must take reasonable steps to ensure that PPE provided is used properly and responsibly. Additionally, workers must wear PPE in accordance with an instruction which has been provided to them. Inspection before use should be made by the user and any defect or concern about the equipment reported to the appropriate line manager. PPE should be returned to the designated storage unit after use. Employees should only undertake work in which they have been suitably trained and qualified to perform.

Whilst PPE is important in reducing the risk of injury, employers should only use PPE as a last resort. Risks should be controlled at the source and appropriate controls and measures put in place.

What are the business benefits of providing and using Personal Protective Equipment (PPE)?

The investment and correct use of PPE can help avoid and reduce workplace accidents and sickness. Your business will benefit from a reduction in employee sick days and administration time/costs in recording and reporting illness and accidents. Your organisation will be complying with your health and safety obligations thus, avoiding accidents, HSE investigations, legal costs and compensation payouts.  Additionally, looking after the health, safety, and welfare of your employees will promote a happy workforce, boost productivity and your business reputation. Finally, the initial cost of purchasing PPE is quickly covered by the cost saving in the reduction in staff sickness, absence, and staff attrition.

Training and raising awareness of the importance of personal protective equipment is crucial in protecting staff and your company as a whole.  

The Personal Protective Equipment (PPE) eLearning course explains the responsibilities of employers in the provision, maintenance, and storage of PPE to keep their employees safe in the workplace. It also highlights the responsibilities of the workforce to use PPE consistently and safely.

The online course demonstrates different types of PPE, and how and when to use them. It examines the differences between a hazard – something with the potential to cause harm – and a risk, which combines the likelihood of harm occurring with the extent of that harm. The course includes PPE signage, what it looks like, what it means and what employees have to do when a PPE sign is displayed in their work area.

The course also highlights the benefits and limitations of PPE and the role that training should play in the maintenance and use of PPE so that all employees understand the importance that PPE plays in their protection.

Like all the VinciWorks courses, the Personal Protective Equipment (PPE) course can be customised to meet your needs, enabling your workforce to understand the specific policies and procedures you have developed for your organisation. A designated course administrator can edit the text and images shown in the course, and link to organisation-specific documentation, all at no extra cost

See our full range of courses and request a free trial

Attracting top talent in the age of Tinder

Handshake with city background

How to get millennials to marry your company

Is your firm feeling a bit male, pale and stale? Have millennial hires turned your office into a revolving door, with new faces never staying long enough for you to remember their names? Is the talent pool shrinking, or is the traditional bait just no longer working?

Whatever the causes, failing to attract top talent is one of the top risks consistently identified by firms through VinciWorks Risk Management System. Like an apocalyptic horror novel where the human race ceases to reproduce, the risk of not attracting and retaining top talent is like a ticking clock counting down to demographic disaster. With every retirement party attended and every leaving card signed, another void opens up. It’s hard to know if it can ever be properly filled.
Continue reading

Criminal Finances Act – not just for accountants and lawyers

Tax evasion

The Criminal Finances Act created a corporate criminal offence for failing to prevent the facilitation of tax evasion. Under this revolutionary law, if an employee or a contractor helps someone evade their taxes, that business can be prosecuted for failing to prevent it from happening.

Implementing reasonable procedures to prevent tax evasion is a key defence against prosecution, but it requires a thorough risk assessment, a top-down commitment and a roll out of staff training. Procedures should be proportional to the risks faced, so a law or accounting firm who gives tax advice to their clients will come out as having a much higher risk.
Continue reading

Records Mis-Management: NHS Contractor Puts Thousands at Risk

Records Mis-Management: NHS Contractor Puts Thousands at Risk

In a case of records management gone terribly wrong, more than 700,000 letters to NHS patients were discovered to have been piled up in a warehouse and left or disposed of by the bag-full.

The letters contained clinical correspondence that required re-directing due to patients moving GP surgeries or changing home address. Instead, however, the letters – some of which contained cancer diagnosis, treatment plans, and blood test results – were left unprocessed for up to five years between years 2011 and 2016.

The National Audit Office (NAO) discovered that more than 1,700 patients could have been harmed as a direct result of the shocking oversight; these are patients who might have missed important appointments, treatments, and tests. Additionally, 200,000 records are still to be reviewed by GPs to determine if there was a potential for harm to have happened to the patients involved.

Reports suggest that the issue first surfaced back in 2011, when NHS Shared Business Services (NHS SBS) were tasked to re-deliver a backlog of clinical records, around 8,000 pieces, but were soon overwhelmed when, by 2014, this number had reached 205,000. In June of the same year, a review conducted by NHS SBS put this figure at over 300,000 and highlighted the clinical risk to patients who were not receiving their medical letters. No action was taken by senior management to rectify the problem at this time.

By August 2014 bosses were warned that the letters were being destroyed, but it wasn’t until December 2015 that staff began to properly investigate what the letters contained and discovered the clinically urgent subject matter enclosed within so many.

After a thorough investigation into NHS SBS, the NAO found the following data-handling errors:

  • NHS SBS had become aware of a risk to patients in January 2014, but senior managers did not develop a plan to deal with it or tell the government or NHS England for another two years
  • A label with “clinical notes” written on it had been removed from the room where the files were stored.
  • In August 2015, a member of staff raised concerns the records were being destroyed but nothing was done.
  • NHS SBS finally told NHS England and Department of Health of the problem in March 2016, but neither Parliament nor the public were told.
  • The episode suggested there had been a conflict of interest between the health secretary’s responsibility for the health service and his department’s position as a shareholder in NHS SBS.
  • NHS England said the company had been “obstructive and unhelpful” when it had tried to investigate issue.

As the investigation continues, organisations are left wondering whether they have provided adequate data handling and records management training to their own staff. With good records management training, employees will learn how to comply with the law when it comes to handling and storing data and, in doing so, mitigate the risk of data breaches and reputational damage to their company. VinciWorks offer both UK-based and global records management eLearning courses, alongside a bundle of online data protection training specially designed to build confidence and develop data-handling skills.

SME Hit Hard: Devastating £60,000 Fine Confirms the Importance of Cyber Security Awareness

SME Hit Hard: Devastating £60,000 Fine Confirms the Importance of Cyber Security Awareness

The Information Commissioner’s Office (ICO) delivered a wake-up call of some magnitude recently when it announced a £60,000 fine for Berkshire-based SME, Boomerang Video (an online store which rents video games out).

The company’s website was found to have insufficient cyber-security measures in place, which resulted in the personal data of over 26,000 customers being accessed (e.g. credit card numbers, phone numbers, and home addresses) via a type of cyber-attack known as ‘SQL injection’.

SQL injection is only possible where there is already a security vulnerability (e.g. unencrypted data or insecure decryption keys) and works by allowing cyber-attackers to copy identities, change or destroy existing data, and completely take over the administration of the database server (amongst many other malicious activities). In other words, it is because the company failed to take adequate steps to protect their customers’ personal data that their fine was so severe.

Sally Anne Poole, ICO enforcement manager, said:

“For no good reason Boomerang Video appears to have overlooked the need to ensure it had robust measures in place to prevent this from happening.

I hope businesses learn from today’s fine and check that they are doing all they can to look after the customer information in their care.”

The ICO is the independent regulatory office responsible for upholding information rights in the public interest. The office deals with the Data Protection Act (1998), the Freedom of Information Act (2000), and the Privacy and Electronic Communications Regulations (2003). By May 18th 2018 the office will also be responsible for enforcing the EU-wide General Data Protection Regulation (GDPR), which directs that fines of between 2%-4% of annual turnover are issued for breaches of data protection guidelines. The government has confirmed that the UK’s decision to leave the EU will not affect the commencement of the GDPR.

The ICO’s investigation into Boomerang Video found the following security breaches:

  • Boomerang Video failed to carry out regular penetration testing on its website that should have detected errors
  • The firm failed to ensure the password for the account on the WordPress section of its website was sufficiently complex
  • Boomerang Video had some information stored unencrypted and that which was encrypted could be accessed because it failed to keep the decryption key secure
  • Encrypted cardholder details and CVV numbers were held on the web server for longer than necessary

Is your organisations’ confidential business data secure? Ensure your employees are aware of how to prevent a data breach with our Data Protection and Preventing a Data Breach eLearning courses. For added online security, we can also provide an off-the-shelf cyber security bundle of courses, which includes full and short-course training to ensure your employees, and your organisation, are safe and secure.

New module added to cyber security course – Cyber Security and IT

VinciWorks is constantly updating its courses to keep up with changes in regulations, law and the risks faced by organisations every day. We also pride ourselves on providing completely customisable courses to ensure that each course is relevant to all staff in an organisation.

New module for IT professionals

IT staff in any organisation have the responsibility of ensuring their organisation is technically safe and protected. Some of the recommended steps to achieve this include:

    • Applying software updates
    • Implementing anti-virus and anti-malware software
    • Decommissioning unnecessary services and software
    • Storing passwords safely with a hash function
    • Changing all default credentials

Continue reading

Application of sanctions now broader than ever

New European regulations came into force today, 8 August 2017, that have dramatically expanded the number of businesses who must ensure they follow UK sanctions rules. The European Union (Amendments of Information Provisions) Regulations 2017 make it a criminal offence to fail to report knowledge or reasonable cause to suspect someone is under an asset freeze, or has committed an offence under a financial sanctions regime. VinciWorks has updated their sanctions course to cover these new rules from today.

While the previous failure to report offences only extended to financial institutions, the new law covers:

  • Auditors
  • External accountants
  • Law firms and sole practitioners 
  • Tax advisers
  • Trust or company service providers
  • Casinos
  • Dealers in precious metals and stones
  • Estate agents

Continue reading