Acrux : Whistleblower Policy

For personal use only

ACRUX LIMITED

WHISTLEBLOWER POLICY

For personal use only

WHISTLEBLOWER POLICY

1. OVERVIEW OF THE POLICY

The Directors and management of Acrux Limited and its related bodies corporate (the 'Company') are committed to maintaining good standards in corporate governance, ethics and behaviour in all of the Company's activities, including the Company's interaction with its shareholders, current and former employees, business partners, customers, suppliers, the community and the environment in which the Company operates.

The Company recognises its responsibilities as a developer of pharmaceutical products and that it must conduct its business in accordance with the law, and with locally and internationally accepted practices and procedures.

All employees of the Company play an important role in establishing, maintaining and enhancing the reputation of the Company by ensuring observance of the high standards of ethics and behaviour to which the Company is committed. The Company requires that its employees display the highest levels of professionalism in all aspects of their work to facilitate the Company's compliance with its Code of Conduct and all applicable laws.

As part of this the Company is also committed to maintaining a culture where those involved with our business are encouraged to raise concerns about any misconduct or any improper state of affairs of which they become aware, and can do so safely. A whistleblowing program is an important aspect of detecting poor or unacceptable practice and misconduct in an organisation.

This Policy should be read in conjunction with the Company's Statement of Corporate Governance Principles and Code of Conduct which can be found on the Company's website (www.acrux.com.au) in the corporate governance section under the headings 'Statement of Corporate Governance Principles' and 'Code of Conduct'. This Policy prevails to the extent of any inconsistency between it and the Code of Conduct or Statement of Corporate Governance Principles.

2. INTERPRETATION, OBJECTIVES AND PURPOSES 2.1 Purpose

The purpose of this Policy is to encourage those involved with our business to raise their concerns if they become aware of any misconduct or any improper state of affairs.

This policy explains the protections available to those who raise concerns and when those protections will apply, and outlines the support that will be provided to those that raise their concerns.

2.2 Interpretation In this Policy:

• ASIC means the Australian Securities and Investments Commission;
• Company means Acrux Limited and its related bodies corporate;
• Corporations Act means the Corporations Act 2001 (Cth);
• Protected Disclosure means a disclosure that benefits from the protections set out in the Whistleblower Protection Laws and this policy, and includes disclosures made in relation to those matters set out at paragraph 4.1 of this Policy, together with public interest disclosures and emergency disclosures, as defined in the Corporations Act;
• tax affairs mean affairs relating to any tax imposed by or under, or assessed or collected under, a law administered by the Commissioner of Taxation; and
• Whistleblower Protection Laws includes the Corporations Act and Taxation Administration Act 1953 (Cth).

Page 2 of 8

For personal use only

2.3 Benefits of this policy

An effective whistleblowing program can result in:

1. more effective compliance with Whistleblower Protection Laws;
2. a healthier and safer work environment;
3. more effective management;
4. improved morale;
5. more efficient fiscal management of the Company; and
6. an enhanced perception and the reality that the Company is taking its governance obligations seriously.

3. WHO CAN MAKE A PROTECTED DISCLOSURE?

Any person who holds, or has held any one of the following positions can make a Protected Disclosure:

• an officer of the Company;
• an employee of the Company;
• a secondee or volunteer of the Company;
• a person who supplies goods or services to the Company, or an employee (or former employee) of such a supplier;
• an associate of the Company, within the meaning of the Corporations Act; or
• a relative or dependent of any of the persons referred to above.

Each such person making a protected disclosure under this Policy is referred to in this Policy as the

'Whistleblower'.

4. WHAT MATTERS CAN BE INCLUDED IN A PROTECTED DISCLOSURE?

4.1 Disclosures that are protected by this Policy and the Whistleblower Protection Laws

A disclosure will qualify as a Protected Disclosure, if it is made by a Whistleblower who has reasonable grounds to suspect that the information disclosed concerns misconduct, or an improper state of affairs or circumstances in relation to the Company or one of its related body corporates. The matters that may be included in a Protected Disclosure are broad, and may include (but are not limited to):

• Misconduct in relation to the Company, including fraud, negligence, default, breach of trust, breach of duty, unethical conduct and systemic or serious breaches of the Company's Code of Conduct or Corporate Governance Principles.
• Breach of the Corporations Act or other laws administered by ASIC by the Company, its officers or employees. Such conduct includes victimising a person who has, or is thought to have made a Protected Disclosure.
• Breach of any other Commonwealth laws, punishable by 12 months or more imprisonment by the Company, its officers, or employees.
• Conduct by the Company, its officers or employees that represents a danger to the public or to the financial system.
• Misconduct or an improper state of affairs or circumstances in relation to the tax affairs of the Company or an associate of the Company (as defined in the Income Tax Assessment Act 1936).
• Any attempt to conceal or delay disclosure of any of the aforementioned conduct.

4.2 Disclosures that are not protected by this Policy and the Whistleblower Protection Laws Disclosures about other matters will not be Protected Disclosures and will not qualify for protection under the Corporations Act. Complaints regarding service levels, Policy decisions, or other work-relatedgrievances with people in the Company are not Protected Disclosures and are instead dealt with through the employee grievance procedure outlined in the Company's Human Resources Manual.

A personal work-related grievance may still qualify for protection if:

• it includes information about misconduct, or information about misconduct includes or is accompanied by a personal work-related grievance (mixed report);
• the relevant entity has breached employment or other laws punishable by imprisonment for a period of 12 months or more, engaged in conduct that represents a danger to the public, or the disclosure relates to information that suggests misconduct beyond the Whistleblower's personal circumstances;

Page 3 of 8

For personal use only

• the Whistleblower suffers from or is threatened with detriment for making a disclosure; or
• the Whistleblower seeks legal advice or legal representation about the operation of the whistleblower protections under the Corporations Act.

Deliberate false reports are not Protected Disclosures and are strongly discouraged.

5. PROCEDURE FOR MAKING AND INVESTIGATING PROTECTED DISCLOSURES

5.1 Whistleblower Protection Officer

The Company will appoint an appropriately qualified and suitable senior employee to the position of Whistleblower Protection Officer. The Whistleblower Protection Officer may be contacted on [e-mail].

The role of the Whistleblower Protection Officer is to safeguard the interests of a Whistleblower in terms of this Policy, the other policies of the Company and any applicable legislation.

The Whistleblower Protection Officer has direct, unfettered access to independent financial, legal and operational advice as required for the purposes of effectively carrying out the role.

5.2 Whistleblower Investigations Officer

The Company will appoint an appropriately qualified and suitable senior employee to the position of Whistleblower Investigations Officer. The Whistleblower Investigations Officer may be contacted on [e-mail].

The role of the Whistleblower Investigations Officer is to investigate any disclosures to determine whether the disclosure is a Protected Disclosure, and to determine whether there is evidence in support of the reported conduct.

The Whistleblower Investigations Officer has direct, unfettered access to independent financial, legal and operational advice as required for the purposes of effectively carrying out the role.

The Whistleblower Investigations Officer will not be the same person as the Whistleblower Protection Officer.

5.3 Reporting

A Whistleblower may make a Protected Disclosure to the Whistleblower Protection Officer. The Company recommends that this be done in person or in writing marked 'Confidential'.

If for any reason it is not appropriate to report to the Whistleblower Protection Officer, the Whistleblower may also make a Protected Disclosure by contacting:

• another officer or senior manager of the Company, including the Chief Executive Officer or Managing Director of the Company; or
• an auditor or a member of an audit team conducting an audit of the Company.

If the Protected Disclosure relates to improper conduct in the Company's tax affairs, internal disclosures may also be made to:

• an officer or senior manager of the Company;
• any other employee or officer who has functions or duties relating to the tax affairs of the Company; or
• a registered tax agent providing tax agent services to the Company.

These persons are eligible recipients for Protected Disclosures and their roles include receiving disclosures that qualify as Protected Disclosures.

Page 4 of 8

For personal use only

The Whistleblower Protection Officer, or other eligible recipient to whom the Protected Disclosure is made, may ask the Whistleblower how they think the matter might best be resolved. If the Whistleblower has any personal interest in the matter, it is essential that this is made known to the Whistleblower Protection Officer, or other eligible recipient, at the outset.

The Whistleblower making a Protected Disclosure will not be expected to produce irrefutable evidence to support the concerns raised. All that is required is that the Whistleblower has reasonable grounds to suspect the existence of the misconduct, or an improper state of affairs that is the subject of the Protected Disclosure. It is in the Company's interests to hear of suspicions of any potential misconduct or improper state of affairs at the earliest possible opportunity. A Whistleblower can still qualify for protection as a whistleblower under the Corporations Act even if their disclosure turns out to be incorrect.

Whistleblowers will also qualify for protection as whistleblowers under the Corporations Act if they make external disclosures about the matters set out in section 4.1 of this policy to:

• ASIC or another Commonwealth body prescribed by regulation;
• A legal representative for the purpose of obtaining legal advice or legal representation about the operation of the whistleblower provisions in the Corporations Act (even in the event that the legal practitioner concludes that a disclosure does not qualify for protection under the Corporations Act); or
• A journalist or a parliamentarian, in each case in limited circumstances described as either an "emergency disclosure" or "public interest disclosure" in the Corporations Act.

It is important for a Whistleblower who intends to make an "emergency disclosure" or a "public interest disclosure" to a journalist or a parliamentarian to first understand the criteria for such disclosures that are set out in the Corporations Act. In order to qualify, a disclosure must first have been made to ASIC or a prescribed body, and written notice provided to the body to which disclosure was made. In the case of public interest disclosure, at least 90 days must have passed since the previous disclosure. Whistleblowers should contact an independent legal adviser before making a public interest disclosure or an emergency disclosure.

5.4 Investigation

The key steps that will be taken following the receipt of a disclosure are: (1) assessment; and (2) investigation of the disclosure.

Firstly, the disclosure will be assessed by the Whistleblower Protection Officer to determine:

• Whether it qualifies as a Protected Disclosure; and
• Whether a formal, in depth disclosure is required.

This first "assessment" phase will ordinarily be completed within 5 working days of disclosure, however the time frame may vary depending on the nature of the disclosure.

Secondly, if the disclosure is considered by the Whistleblower Protection Officer to be a protected disclosure, the disclosure will be thoroughly investigated by the Whistleblower Investigations Officer. The Whistleblower Investigations Officer will endeavor to:

• investigate the Protected Disclosure within a reasonable period of time;
• follow thorough, objective, independent and fair investigation procedures and, where possible, protect the privacy of employees who are mentioned in a Protected Disclosure;
• avoid conflicts of interest in carrying out the investigation;
• keep information relating to Protected Disclosures (including the identity of the Whistleblower) confidential, except as permitted or required by law or permitted under this Policy; and
• where appropriate to do so, and if the Whistleblower can be contacted, provide the Whistleblower with regular updates. The frequency and timeframes of any updates will depend on the nature of the disclosure.

Page 5 of 8