G.1 How is FFC organized?
FFC is a 501c3 not-for-profit registered in the State of New York.
G.2 How long has FFC been around?
We were founded in 2004.
G.3 Who provides FFC governance?
FFC has an external Board of Directors, and an external Advisory Board. Our annual financial statements are audited by an independent external auditing company. Our tax returns are filed in the state of New York. The FFC Board has an Executive Committee, a Financial Audit Committee and a Technology Committee. The FFC meets all regulatory filing requirements as dictated by the U.S. Federal Government and the State of New York.
G.4 What is the role of the FFC advisory board?
The Advisory Board is made up of individuals that believe in the FFC mission, and that have unique skills that can help FFC research topics of interest to the FFC.
G.5 What is the source of FFC’s funding?
FFC has several sources of funding:
As a nonprofit, FFC qualifies for grants and donations from the government, foundations and individuals that are interested in supporting our mission. For example, the U.S. Department of State was instrumental in helping the FFC establish itself in the early years by providing two grants, and FFC does provide paid compliance research projects to foundations and other non-profits in response to specific tender offers or requests.
FFC receives in-kind support through individuals or business partners that provide pro bono services or donations to help FFC achieve its mission.
FFC members pay an annual license and hosting fee to access the FFC system and services.
Other non-profit clients pay FFC for private database development and operation.
G.6 Where is the FFC located?
Our legal address is at 450 Lexington Ave., Suite 3800, New York, NY 10017. We maintain a business office in Lexington, Massachusetts and operate our finance and administration there. We maintain a customer meeting office in Waltham, Massachusetts on the famous Route 128 noted for its decades of information technology innovation. The FFC customer center is convenient to Boston’s Logan airport, and can be used for customer meetings, design workshops and conferences. Many of the FFC employees are virtual because they work different shifts in different locations or time zones, however, we have a central telephone switch in the United States for members to reach any employee easily. All FFC employees are also available by email and Skype.
G.7 What is FFC’s mission?
The FFC's mission is to faciliate informed ethical business decisions for a better and more livable world.
G.8 What does FFC do?
We build state-of-the-art software that facilitates continuous improvement in social, environmental and security issues. This results in safer, more humane working conditions for supply chain workers. The configurability of the FFC software adapts to each client’s unique needs thus allowing them to execute their own CSR approach. Our software enhances the capacity of business to conduct ethical sourcing more efficiently. We promote sharing of expertise and collaboration between companies to improve workplace conditions.
G.9 How does FFC differ from other multi-stakeholder databases that help members manage compliance?
FFC is standards agnostic and so we have a sophisticated assessment creation tool that allows our members to create and use any number of easily configurable audit and assessments – all without programming. We also support any number of out-of-the-box scoring scenarios, and specialize in “Smart Audits” where the assessments can change dynamically in response to answers to earlier questions. We also support popular CSR assessment standards. As a result our members can use the FFC tools to manage all of their supply chain compliance needs from social and labor, environmental monitoring, construction safety, cargo security safety, and conflict minerals. FFC has its own team of dedicated software development employees in both the United States and in India, and we can respond quickly to emerging compliance requirements. FFC is also a collaboration platform. Members that source in the same factories as other members can voluntarily exchange information on assessment results, plan joint visits and conduct joint assessments and corrective action plans. Finally FFC is an open platform. Members may extract information from the FFC to send to other systems, and they may import and post information to FFC to help develop internal company supply chain analysis reports that include information from multiple systems. In order to foster greater audit sharing between systems, FFC has been leading a a group of interested brands, retailers, multi-stakeholder groups, and compliance software companies in developing the first ever Compliance Audit Interchange Standards with the Association for Retail Technology Standards (ARTS).
G.10 What other organizations does FFC provide database services to?
Since FFC has its own talented team of system professionals we are often asked by other non-profits with similar or complimentary missions to help them with their own system requirements. These organizations are a different type of FFC customer with a dedicated account management and development team. Helping these other nonprofits allows FFC to increase its mission of improving supply chain conditions, but it also can benefit FFC members. This work can give us insight into other compliance approaches and new ideas, and it helps us scale the organization financially and lets us leverage greater buying power for computer equipment and services.
The list of nonprofit customers that FFC provides database development and operational services include the following:
G.11 Can I see the supplier information that these other databases might contain?
No, each of these sites is a private database and the information contained is proprietary to each organization, and it is up to each of these organizations to define their own rules for sharing outside of their database. Of course, if any of these separate organizations wish to exchange information with FFC members, we would be happy to provide the technical solutions and standards to support that data exchange.
G.12 Do you have standard policies?
Yes, we have a Whistleblower policy, Conflict of Interest Policy etc. Here is a list of all the policies.
M.1 What industries does FFC serve?
FFC can support the individual compliance needs of companies from any industry. However to support collaboration with others that might source in the same places of employment, there is greater leverage to be on the same platform as others from the same industry. FFC currently has a concentration of members from the footwear, apparel, retail and outdoor equipment industries.
M.2 What kind of memberships does FFC have?
Here are the different membership categories in the FFC. For more information, please contact us.
M.3 Who are FFC members?
Our members represent the full range of brands and retailers that care about corporate social responsibility. Often they are the industry leaders that are pioneering new approaches to compliance and supplier capacity building, and they need a software partner that can respond quickly to new requirements. Since FFC does not have a single compliance instrument or approach, our members like that they can adapt the FFC to their current compliance processes – be they simple or complex, and not require their company processes to be adapted to a process that FFC requires. Our collaboration environment lets members voluntarily exchange information about common suppliers and develop joint inspections and corrective action plans. This system feature is very beneficial to smaller brands and retailers that may not have compliance teams big enough to cover their entire supply chain.
M.4 How much does it cost to be a member of the FFC?
The fees for membership are published on our web site in the membership section. Our hosting and license fees are based on the size of the member company in terms of annual sales or the value of goods that they may be sourcing. Offering a membership based on sourcing value is useful for retailers that want to use the FFC to monitor their private label manufacturing, but not the products that they are purchasing from brands as they expect the brands to monitor their own supply chains. Members that are also members of our supporting trade Associations (National Retail Federation (NRF), Retail Council of Canada (RCC), and the Worldwide Federation of Sporting Goods Industry (WFSGI) received discounts of 20 percent off our standard license and hosting fees. Depending on the size of your company there may be a one-time set up fee to help new members convert their supply chain data and configure the FFC to meet the specific needs of each member. Fees for supply chain intermediate members, external auditing firms that might like to use the FFC tool for their work, or supplier groups that might like to use the FFC for their own compliance management are not published. If interested please contact the FFC to discuss your circumstances and we will reposnd promptly.
M.5 Do I have to pay extra for future system upgrades or new features?
No. All system improvements are included as part of the annual membership fees. Members do not have to pay for any enhancements that are integrated into the standard FFC tool and available for all members to use. Special development requests for individual members are handled separately.
M.6 How often do you release upgrades to the FFC system?
Regular releases are scheduled monthly. Major technology and business driven innovation implementations are scheduled as necessary.
M.7 Does FFC have user meetings or conferences?
Yes. Monthly webinars are held to discuss various topics, functionality or future enhancements. Training webinars are also offered on a monthly basis. FFC hosts an annual User Group meeting, often scheduled around one of the most popular CSR meeting activity to help members get two CSR meetings for the price of a single trip.
M.8 My company has some unique ideas about how we want to run our corporate responsibility programs. Can FFC be customized easily to satisfy unique company requirements?
The FFC platform is flexible and customizable. You may be surprised to find that the application already supports your company’s specific needs through table setting and configuration with no programming required. When we encounter new requirements we have not seen before, we most often poll members to see if a new member requirement would be useful for all members. If there is interest in a new feature we form a working group around the new requirement, and by multiple companies helping to design a new feature it often becomes an even more powerful solution for all members. FFC develops these multiple member solutions for no charge as part of our product research and development budget. If a member specific requirement is unique to a single member we do offer programming customization, at an very cost effective development rate.
M.9 My company has many brands and subsidiaries. Does FFC require a different license for each brand or subsidiary?
No, a member can establish a single membership under a corporate organization and then offer the FFC solution to all of their brands and subsidiaries to use without the need to have individual companies have their own membership agreement. The FFC configuration and set up tools also allow companies to fit the FFC to their processes and the way they want to do compliance. Members may chose to allow each brand to run their own compliance programs, but our ability to match supply chains to identify companies that source in the same location can help companies with multiple brands coordinate compliance work so two or more brands are sharing results and not conducting redundant audits of the same supplier. Members can also establish sourcing groups that might do purchasing for specific products categories across all brands. When you look at who uses the FFC to do their work, let us assure you we have seen and met the needs of every possible organization permutation companies want to implement.
M.10 Does this mean that I can use the FFC to monitor all of the compliance activities of all of my brands, subsidiaries and divisions?
Yes. We can handle a centralized approach for all brands and subsidiaries, or a decentralized approach with a corporate overview, and a blend of the two based on products or other criteria. As said earlier because of the flexible FFC assessment question management tool, FFC members can have many different assessment types in the same system, and different tools can be applied to different type of products.
M.11 Would I be able to extend this to monitoring of my agents, importers, licensees and other supply chain intermediates?
Yes. Many FFC members have established roles and permissions for all of their supply chain actors to be participants in their overall compliance efforts. What these actors may see and do is totally under the control of the purchasing member.
M.12 Can my sourcing people also use the FFC?
Yes. You may configure a role for others in your company as you see fit. Some of the larger FFC members have created supply chains of thousands of suppliers and thousands of supply chain actors including internal employees in various roles and external parties including licensees, agents and others.
M.13 What happens if my company should sell a brand or division that was part of my overall company membership?
That brand would no longer be included under the company membership, but we would welcome that brand or division to join the FFC as a member. We can also provide services to help the brand configure their own membership and use of the FFC and migrate what data they may wish to split off from their former parent organization.
M.14 If I choose to no longer be an FFC member can I take my data with me?
While we would be sad to see you leave, all member data belongs to the member and the FFC will work with you to export the data into a file format that would allow you to take it with you.
M.15 Why does FFC have trade association memberships?
Trade associations are also membership groups, and as such, their members frequently ask for advice and suggestions on how their members can improve their compliance programs. The trade association members are supporters of FFC, and have a representative on our Board of Directors or Advisory Board. They help us understand compliance industry trends, and emerging needs of their members. Trade association members do not require their members to join the FFC, but if a member does join the FFC voluntarily, we do provide that member a trade association discount. Trade association members may ask FFC to attend meetings and other forums that would benefit from having a multi-stakeholder compliance vendor attend to add industry knowledge and perspective.
M.16 What if I am not a member of these trade associations?
If you are not a member of a trade association with FFC affilation than you cannot qualify for the trade associate discount. However, if your company belongs to another trade association, the FFC would be happy to speak to them about them becoming a trade association member and then you could qualify for the discount.
M.17 We are a global company and my compliance team is scattered all over the globe. Can FFC help me improve communication with my team?
FFC offers multiple ways to improve global team communication. Our alerts and notifications settings enable improved workflow throughout the platform, from scheduling to audit completion. We have document management tools where companies can store all of their compliance documents in one place, and then share them with their teams using the FFC. We support an internal messaging system where members can communicate with their own teams and with other members, and these messages can be exported into a members' internal email system. Multi-language support is also available to create internal documentation and procedures in any language. Member super user administrators can have special reports that help them monitor staff activity and system use.
M.18 I already have my own internal compliance management system and don’t want to use the FFC to conduct audits so what benefit would I get by being a FFC member?
FFC facilitates sharing the data collected by any participant for accessibility and transparency among all participants, in accordance with antitrust and anti-competition guidelines. Sharing members may import or post information to the FFC sharing site and exchange information with other FFC members. This collaboration environment results in a global clearinghouse of factory information, allowing members to identify common needs, prioritize them and attack them together. Doing so will lower costs, reduce labor load, increase learning, improve leverage and enhance performance.
M.19 Do I have to disclose my supply chain for collaboration to work?
Each member submits and maintains their supply chain on the FFC. FFC matches supply chains to ensure that the same factory is not duplicated in our database, and then we build a relationship between each supplier and what members are sourcing there. However, disclosure of what company may be sourcing at a supplier is voluntary for each member. Members can decide to remain “hidden” at all of their suppliers, or hidden at certain suppliers. FFC provides a double blind messaging system for hidden members to communicate with each other, but we will never disclose what company is sourcing at a supplier unless the company wants their name associated with this supplier.
M.20 Are most FFC members hidden then?
Around 60 percent of FFC members are totally transparent with other members as to where they source, and this number is increasing. Members will often begin using as the FFC as hidden and then over time as they become more familiar with how the FFC works they will begin to disclose their company name with certain suppliers or all of their suppliers. This is totally under the control of each member.
M.21 I am a small brand. Would FFC be a good fit for me?
Yes, smaller member companies will benefit from access to resources that they will not have on their own, and the collaboration aspects of FFC help them interact with and learn from larger brands that have very successful compliance programs.
M.22 I am a retailer that does not have my own internal auditors. I use one or more auditors to conduct inspections and they record the results in their own proprietary systems and just give me summary reports. How can FFC help me?
There several ways you can use the FFC. You can post the audits conducted in your behalf to the FFC as PDF files or other file formats and they can be displayed. FFC can also work with the auditing firms to develop an audit data exchange using the ARTS standards using “XML” so you can bring the audit results into the FFC as readable and reportable documents. You can then use the FFC to monitor and report on conditions in your entire supply chain regardless of what company does the assessments. You can also provide external monitors direct access to a role you have configured on the FFC. This would allow you to request audits directly from the FFC and provide you many other benefits. This would also allow you the freedom of switching auditing firms whenever you like and still maintain a consistent approach to how you want your assessments done.
M.23 Does the entire system support changing all screens to a language other than English?
Today, all audit and assessment questions support two languages English and a secondary language. This allows each member to use English as their primary means of sharing and collaboration, but it also allows field workers to view audit and assessment questions in any native language that the member wants to support. This can be very helpful for field workers to properly understand the conditions they are being asked to check for, and to document findings in local language. This would allow translation into English by other staff that may be more proficient in English. All company documents may be created and stored in any language. Data field labels are customizable by each member so companies can use the terminology that best works for their team.
Supply chain management FAQ’s:
S.1 How extensively can I define my supply chain in the FFC?
Factories, Sourcing Groups, Vendors, Licensees and other related partners can all be created within, and granted access to the FFC, with their relationships configured in the system.
S.2 Does that mean I can use the FFC to monitor material suppliers or subcontracted services?
Yes. You may define and monitor workplace conditions to whatever level you wish.
S.3 How will I know much overlap my supply chain has with other members?
Your factory list will be compared to our existing membership database to identify the percentage of overlap within the FFC. We will be happy to do this assessment for you before you become a FFC member for no charge and you will receive a statistical report telling you exactly how much collaboration opportunity you will have with other FFC members. Once you become a member there is a standard view of your supply chain that will display the name of any other FFC member that is active at the same supplier. (However hidden members company name will not be displayed). You may hover your cursor over any and all members listed that source at the same supplier and send them a message (including hidden members in a double blind messaging system).
S.4 Can I use the FFC to search for new suppliers?
Our sharing platform allows you to search factories/farms/workplaces to identify opportunities for collaboration and identify where your factories overlap with other members.
S.5 How do I import my suppliers into the FFC?
FFC has an import utility available for bulk imports. For creation of a single supplier, the online interface allows for quick and easy account generation. The FFC database already has more than 35,000 suppliers in more than 160 countries. It is quite possible the suppliers your source at are already on the FFC and being used by some other FFC member.
S.6 Is the matching of my suppliers an exact match when you are looking for duplicate suppliers?
Duplicate matching is done using a sophisticated computer algorithm that does not need exact spelling to find a match. We consider address and other attributes. We also support the documentation of supplier aliases.
S.7 What happens if I find out later that one of my suppliers is already in the FFC system under a different supplier number?
FFC has a merge utility available to combine two supplier accounts when they are confirmed as duplicates, and this merge creates a historical cross reference to the former supplier records.
S.8 I can see how a common factory file can benefit all members, but what happens when I think I have some new information about the supplier that is more accurate than what is in the supplier master record?
The FFC maintains an “owner” for common supplier master data such as name and address. This may be the member that entered this supplier for the first time. FFC does not allow overriding of “yellow pages” type information without enabling a discussion with the current owner or the FFC. You may request ownership of the supplier record and if granted make the changes you want. Each FFC member also has a private area in each supplier record where they may record and modify the information as they see fit.
S.9 What if I have proprietary information about that supplier I want to store on the FFC, but I don’t want anyone outside of my company to see it?
There is a private section in each supplier account record, where member-specific data may be entered; it will only be visible to your organization and its users. These are customizable fields for the specific use of each member. Members might document what they are sourcing at the supplier, capacity they are using and other indicators of size of the relationship that are useful for reporting. They will often store the internal supplier ID they have assigned to this supplier that is from their ERP or purchasing system so they can generate reports using their internal supplier numbering system.
S.10 Does the FFC allow direct supplier interaction with the system?
Yes. The FFC is a role’s based system that allows each member's administrator to define specific permissions to various user roles such as supplier, vendor and monitor. This gives the member full control over how much or how little information each role can see and act on within the FFC.
S.11 Is it hard for a supplier to use the FFC?
Suppliers have a single log in regardless of how many members source there. The screens the supplier sees only contains the information that you want them to see and act on so they are often very simple.
S.12 Some of my suppliers are WRAP certified. How do I incorporate certification information from other sources into the FFC.
The FFC offers tools so that members may define and create their own custom questionnaires, incorporating documentation or evidence of certification where necessary.
Auditing and Assessment FAQ’s:
A.1 What if I don’t already have a corporate code of conduct? Does FFC have a standard code and approach to auditing?
Yes we can assist you in creating your audit and assessment tools from either standard tools or based on common questions used by most members.
A.2 Are FFC audit types limited in any way?
No. Our customizable audit creation tool allows for multiple audit types to meet every need.
A.3 Can I have more than one type of audit at the same time?
Yes, members can run their compliance programs using a single audit tool, or they can have an unlimited number of audit and assessment tools for any purpose. All of the results are stored in a single database making reporting easy for all conditions in a member’s supply chain.
A.4 Does the FFC have preferred auditors that work for them?
No. Each member chooses the auditors they wish to work with. The FFC supports the use of both internal and external auditors. There are hundreds of audit firms or individual assessors who are already using the FFC on behalf of their clients.
A.5 What tools does FFC provide to help my auditors and / or external monitors work more productively?
FFC provides on offline alternative audit methodology. This allows a field worker to download a member’s assessment instrument to excel and to complete the assessment off line at the supplier location. When completed they may upload the results in an easy and secure file transfer and the FFC posts the results directly into the FFC database as if the assessment was conducted on-line. FFC also supplies specially developed audit tools for member auditor employees run on Android and iPad mobile platforms. These tools use native tablet technology such as GPS to document supplier location, and they make it even easier to attach as evidence of failed conditions (pictures, video and voice) directly to findings. Tablets may also be the only way to support “smart audits” that dynamically change based on the initial findings discovered..
A.6 Can I attach files to an audit as evidence?
Yes, you may attach any types of files, photographs, video or digitized voice files.
A.7 Can I attach confidential information to an audit that I do not want a supplier to see?
Yes, there are private areas within each account for storing information not to be shared. The FFC roles-based permission structure also allows for more granular privacy settings.
A.8 Does FFC give me flexibility in how I score assessments and audits?
Scoring options in the FFC include (but are not limited to) weighted scoring, threshold setting, grade score calculation and much more.
A.9 Does FFC give me flexibility to rank or score my overall suppliers?
Yes. Your supplier designations are completely under member control to establish whatever supplier scoring approach you would like.
A.10 Does that mean I can have different assessment tools to apply to different supplier types or ranks of suppliers?
A.11 How do I use the FFC to establish and track corrective action plans for each supplier?
While defining scoring options for each question, you may identify responses as remediable or not, correct or not. At runtime, the system will automatically generate a corrective action plan entry for each area of non-compliance.
A.12 Does the FFC support tracking follow up action items with alerts?
The FFC’s alert and notification functionality allows each member to define which types of alerts should be automatically sent, to whom and on what schedule.
A.13 Does FFC support workflow?
The FFC’s scheduling, audit capture and corrective action plan management areas are all interconnected and help to move each audit through the workflow from initiation to completed remediation.
A.14 Can I schedule audits using the FFC?
Yes the FFC has a complete scheduling module. It is usually a two-step process where a FFC member requests an announced or unannounced audit from a company employee auditor, or from an external monitoring company. The person assigned confirms acceptance of the audit on that date or proposes an alternate date.
A.15 My company likes to have new suppliers complete a self assessment as the first step in qualifying new suppliers. Does FFC support this process?
Yes. We have a common tool that can be used by any member and we also allow members to customize the self assessment. If other members share supplier self assessments in the sharing area, they would be available to you to view even if you do not conduct self assessments yourself.
Collaboration and Sharing with Other FFC Members FAQ’s:
C.1 Will collaboration with direct competitors on the FFC platform increase my anti-trust risks?
Not if you follow the protocols that FFC has established and are spelled out clearly in our Member Agreement. The FFC has received a business review letter from the United States Department of Justice Antitrust Division. We work closely with probono antitrust counsel from Wiggin and Dana to ensure that members are informed and follow antitrust and anti-competition guidelines. This gives our members increased reassurance when working collaboratively with potential competitors.
C.2 Can I share information with other FFC members that source where I do?
Yes. If you choose to you may voluntarily message other members to initiate collaboration, access shared compliance documents, and share factory/farm/workplace lists and compliance documents anonymously (or not) with other members
C.3 Can I see future supplier visits and audits planned by other members at a supplier that I am also using?
Yes, if they are using the calendar functionality and are willing to share upcoming supplier visits, you can see these scheduled visits easily. This is a common way that members collaborate together to find opportunities for joint visits or collaborative audits.
C.4 Can I actually conduct an audit with other members?
Yes, we call these collaboration audits.
C.5 Can I merge open items from an active audit with another member’s open items to create a new combined collaborative audit?
C.6 Can I easily communicate with other FFC members on the platform?
Yes. FFC offers an internal messaging system to exchange non-competitive information concerning factory compliance with other members.
C.7 Does that mean I have to sign on to the FFC to see and respond to messages and alerts?
No. You will have an option to forward internal messages to your own external email account.
C.8 Can other members see my supply chain?
No. Each member only has access to their own supply chain. However, if another member chooses to be transparent in their supply chain then that information will be available to you.
C.9 I am part of an industry-working group that is helping members of that group work together to solve supply chain issues around special topics. Can FFC help?
Yes. FFC can facilitate working groups via webinars, enabling global discussions. We also can provide private databases for groups of companies that want to work together to collaborate on particular issues even though they are not regular FFC members. Feel free to contact us to discuss your particular group needs.
CA.1 Does FFC have a calendar function and, if so, how is it used?
Yes. Audits scheduled in the system are displayed either in calendar or list format. Current status of each audit is identified on the calendar view.
CA.2 Can you support calendars for individuals, teams, external partners and my entire company?
Other system modules FAQ’s
O.1 Does FFC have a document management system?
Yes. Our platform allows you to store compliance documents of any kind and these documents can be viewable by any role that you have assigned. It is common that FFC members will store code of conduct descriptions in multiple languages that suppliers can down load and print. Some members may store Powerpoint and other training materials for their staff.
Interface to other systems outside of the FFC FAQ’s
I.1 Can I use the FFC to consolidate information from other systems so I can have one supplier dashboard from multiple sources?
Yes. With a Web Services interface, data can be shared between FFC and other systems. Please contact us to discuss your requirements, as the interface you may want has already been developed.
I.2 Can I export the results of reports to Microsoft Office tools like Excel?
I.3 Can you summarize the status of suppliers and export that to my ERP system so my buyers can see the status?
Yes. FFC offers several methods for exporting data from the application, and if needed can work with you to develop an interface to your ERP system.
I.4 What other external systems interfaces has FFC implemented?
FFC took the lead to develop a Compliance Audit Interchange (CAI) charter with the National Retail Federation’s (NRF) Association for Retail Technology Standards (ARTS). This work is still active to try to help companies standardize any interface requirements related to compliance data interchange.
I.5 Are there any other external system interfaces planned?
Yes, this is an ongoing project and we are working on standardizing supplier master data synchronization, import of summarized restricted substance testing, import of audits from other sources and many others.
I.6 What do I do to have FFC consider adding another interface to another system I use?
Contact us at firstname.lastname@example.org to discuss the details.
Reporting and Data Analysis FAQ’s:
R.1 What about reporting? Does FFC support all types of ad hoc reporting as well as executive dashboards?
Yes. FFC offers a variety of reporting tools, including an industry leading data analytics environment from Logi Analytics embedded into directly into our technology.
R.2 Can I develop a report library of frequently runs reports?
Yes. They can either be private or shared with your organization’s users, based on permission settings.
R.3 Can my reports be run on a scheduled basis?
R.4 How long will my historical data stay on the FFC?
Your data will remain in the FFC as long as you want it to stay there. There are no restrictions on how many audits you have or how many years of information.
IM.1 Do I need someone in my company to be an expert in the FFC?
No prior experience is necessary. FFC offers training and support from day one and throughout your membership. You will want to assign a point-person to be your administrator, but we will work with them to build their knowledge and expertise.
IM.2 Is FFC hard to implement?
No, most new members will be up and running in a matter of weeks, once master data has been set up and the system has been configured the way each member wants to use it. All that is needed to access the FFC is any one of the common Web browsers.
IM.3 Do you have any CSR partners that can help me implement a better compliance approach including using the FFC?
We know of some CSR consulting companies that work with small companies to help them implement compliance programs including adopting the use of the FFC. We can introduce some to you if you are interested.
IM.4 What does typical implementation with FFC look like?
Our Audit Management System, allows you to:
We will work with you to discuss each of these items and help you configure the system to meet your specific needs.
IM.5 How long does it take a new member to get benefit from the FFC?
Usually between 2-4 months.
IM.6 How does FFC do member training?
We offer regularly scheduled webinar trainings, online help documentation and training videos, and one-on-one Account Management.
IM.7 If I become an FFC Member what can I do with my existing audit data from my current system?
Depending upon the data structure of your existing audits, you can either upload documents such as PDFs or Word, and post them the your private area of the FFC for viewing. FFC can also custom develop data conversion import utilities to migrate historical data as long as the source system has this information in actual field-by-field data formats.
IM.8 Does FFC offer any kind of supplier training?
Not directly. The FFC trains the member administrators on how to use the FFC. The member administrators develop training programs for other users including suppliers as we have found it is best to have this end user training come from a company representative who can explain both process and system requirements. However we do provide tools and on online help documents and training videos for member administrators and some of these documents can be customized to provide member specific training to end users.
IM.9 Can I put any kind of documentation and e-learning I have developed for my suppliers on the FFC site for them to access it?
Yes. There is a permissions-based document repository available to share documentation with your organization’s users, both internal and external.
IM.10 When I am implementing the FFC, how do I request improvements or enhancements to the system?
FFC maintains an on-line ticketing system called Jira. Each member is given a login to this system. You may make enhancement requests directly, post questions, and see other enhancement requests. Before FFC develops enhancements, we take into consideration your requests and work with you and other members to gather detailed requirements. Enhancements for the benefit for all members are developed by FFC for free as part of our ongoing product development effort.
IM.11 Can I see what other FFC members are looking for in future enhancements?
Yes. You will be able to view other members’ tickets in the Jira system.
IM.12 How does FFC support me after I am live?
You will be assigned an Account Manager who can assist you with any detailed support needs and can submit requests to our help desk. Online help documentation and training videos are available. Live webinars for both training and user group discussions are scheduled on a regular basis.
IM.13 What are the hours of operation of FFC’s help desk and how does it work?
We have an online help desk accessible 24 hours through Jira. The help desk is monitored live via email or phone during the hours of 11:00am-7:00pm IST and 8:30am – 5:30pm EST. We also support a chat line available 24 hours a day.
IM.14 How does FFC respond to any serious system defects or bugs?
Our service level agreements in our standard member agreement spell out our commitment to fixing any identified issues. Any bugs are classified by severity and are transparent to members in our Jira system. We are happy to show these logs to any prospective members as the FFC is proud of our record of software quality.
Information Technology FAQ’s:
IT.1 How secure is my company data on the FFC?
The FFC Audit Production web applications are accessed via HTTPS, a combination of HTTP and SSL/TLS protocols to encrypt communication between the end user’s computer and FFC applications and to securely identify the network web server. All of our servers are secured behind a Cisco firewall. We contract with external security experts to continually monitor all of the FFC servers against external threats.
IT.2 Where are the FFC data centers?
The FFC network and servers are hosted in a SunGard SAS70/SSAE16 data center in Boston, Massachusetts.
IT.3 How robust is the FFC role based security?
Underlying the Audit Platform is the FFC comprehensive system of roles-based administration (RBA) that governs the rights of all logins. At the very top is the super user administrator who is also the security roles manager for their entire user hierarchy within the system. The super user administrator can control, at a very granular level, the access rights to specific assets, such as audits, by policy on a large scale, as well as by exception on a very fine scale. The super user administrator can control access to audit types and to audit requests by security role (e.g., Auditor, Auditee, Database Administrator, etc.), and can then further control access to specific audits using an additional system of audit access control.
IT.4 My company is based in Europe. Do you provide EU data protection safe harbor assurances as part of your contract?
Yes, we can do this on request.
IT.5 Can my internal security team speak to someone at the FFC about system security?
We would be happy to discuss any questions concerning security with your internal team.
IT.6 If I work on a large monitor does FFC automatically scale to fit completely on my screen?
IT.7 What web browsers does FFC support?
FFC supports IE, FireFox, Chrome, Safari and several other popular browsers.
IT.8 How does the FFC ensure that any electronic interfaces with my internal system follow Security best practices?
Any web services that we develop for specific members will follow best practices to multiple layers of authenticity verification.
IT.9 How does FFC monitor response time in different countries around the world?
Yes, we use standardized tools to monitor response time from different countries.
IT.10 How does FFC protect my company’s data. What is your back up approach and is my back up information stored offsite?
SunGard manages networks and server equipment of some of the world’s largest financial institutions. All FFC production servers use RAID 5 mirrored disks, a failure of any drive will automatically roll over to mirrored drives with no loss of access to data until the failed drive is repaired or replaced. FFC conducts database logging on all production databases so all transactions are saved. Daily differential database backups are performed and incremental transaction logs are backed up every 2 hours. Once per week, a FFC full database backup is written. Over and above this, complete disk backups are taken every day by SunGard and stored off-site for a one-week retention period at a profession external storage company called Iron Mountain. All backups are verified and logged by the Network and Communications staff. A recovery test (historical recovery) is carried out on a semi-annual basis, with a one-day-old backup.
IT.11 Is this a cloud application sharing hardware with others?
No, all software developed and maintained by FFC is hosted on servers that are owned by the FFC and not shared with any other company.
IT.12 What is FFC’s scheduled production hours of operation?
The FFC production environment is available 24 hours a day, 7 days a week, except for scheduled maintenance release times and these are announced in advance.
IT.13 What has been FFC’s system availability record in the last 3 years?
Our service level agreements are spelled out right in our member agreement and we have met or exceeded our SLA’s since our inception.
IT.14 How does FFC test new system features and changes and prevent bugs from getting into production?
The production and evaluation/QA-UAT/demo platforms are accessible by members. Evaluation platforms allow FFC and Members to perform final QA and further test proposed software releases after they have passed initial QA but before they have been promoted to the production environment. The “development” instances are only accessible by FFC developers and FFC QA personnel.
IT.15 My company requires that server provider source code kept in escrow in the event of the service provider failure? Can FFC comply with this?
FFC source code is also stored at a third party offsite escrow service for those FFC customers that require this. We update this escrow source service each time there is a change to production software. All production software is identified with a formal release number. There are formal procedures and sign-off required to promote any changes to production software, and release notes are issued to document any changes to production. The standard FFC agreement spells out the details of the escrow agreements.