diff --git a/Documentation/Association/Board/Decisions/2026/08-17-ConflictOfInterest2026Update.rst b/Documentation/Association/Board/Decisions/2026/08-17-ConflictOfInterest2026Update.rst new file mode 100644 index 0000000..3844646 --- /dev/null +++ b/Documentation/Association/Board/Decisions/2026/08-17-ConflictOfInterest2026Update.rst @@ -0,0 +1,109 @@ +:navigation-title: 09-17 Conflict of Interest Policy 2026 Update +.. include:: /Includes.rst.txt +.. _t3a-board-decision-2026-08-17-conflict-of-interest-2026-update: + +================================ +Board Decision: Conflict of Interest Policy 2026 Update +================================ + +:Start of voting: 17 August 2026 +:Voting deadline: 2 September 2026 +:Decision owner: `Rachel Foucard`_ +:Decision status: ✅ Accepted + +Attendance and voting +===================== + +==================== ============ =========== +Board Member Attendance Vote +==================== ============ =========== +`Olivier Dobberkau`_ In meeting ✅ Yes +`Stefan Busemann`_ In meeting ✅ Yes +`Jochen Weiland`_ In meeting ✅ Yes +`Martin Helmich`_ In meeting ✅ Yes +`Jana Höffner`_ In meeting ✅ Yes +`Thomas Maroschik`_ Not attended ⚫ Recused +==================== ============ =========== + +.. _Olivier Dobberkau: https://my.typo3.org/u/oli4 +.. _Stefan Busemann: https://my.typo3.org/u/stefan.busemann +.. _Jochen Weiland: https://my.typo3.org/u/jweiland +.. _Martin Helmich: https://my.typo3.org/u/mhelmich +.. _Jana Höffner: https://my.typo3.org/u/janahh +.. _Thomas Maroschik: https://my.typo3.org/u/tmaroschik +.. _Rachel Foucard: https://my.typo3.org/u/rakel + +Decision description +==================== + +Facts/Problem +------------- + +The current Conflict of Interest Matrix has proven useful as a reference, but practical experience has shown that it can be improved to better support consistent and objective conflict-of-interest assessments. + +Its current structure relies primarily on predefined combinations of roles and responsibilities. While this approach covers many common situations, it can make the matrix difficult to interpret, requires regular updates when new roles or scenarios arise, and does not always reflect the actual level of risk associated with a given situation. + +Objective +--------- + +The proposed revision aims to simplify the matrix so that individuals can more easily determine whether a conflict of interest is likely to exist or can reasonably be excluded. It also introduces a more flexible approach that focuses on the characteristics of a situation rather than an exhaustive list of predefined cases. This should allow the matrix to remain effective as the organisation evolves, without requiring frequent revisions. New roles like unit leadership roles, officers, and external contractors are added to better reflect the current organisational structure. + +Finally, the revised matrix adopts a risk-based approach. Instead of primarily considering the accumulation of roles or responsibilities, it evaluates the likelihood that a situation could compromise, or reasonably be perceived to compromise, independent and impartial decision-making. This approach is intended to improve consistency, transparency, and long-term maintainability of the Conflict of Interest Policy. + +The policy is also updated to include a clear process for conflict of interest report. This process is updated so that the compliance officer takes over the corresponding tasks of collecting and handling the reporting, but the board keeps the decision making responsibilities. + +The register is also updated according to the annual revision and the last elections. + +Obligations to cooperate +------------------------ + +The implementation of this decision requires cooperation between several stakeholders: + +* **The Board** is responsible for reviewing, discussing, and approving the updated Conflict of Interest documents. +* **The Compliance Officer** is responsible for maintaining the Conflict of Interest Policy, process, register and Matrix, providing guidance on their interpretation, and supporting their consistent application. +* **Board members and all other persons covered by the Conflict of Interest Policy** are responsible for reviewing their own situations against the updated matrix and updating their conflict of interest declarations where necessary. + +This decision only affects the scope of conflicts of interest to be considered and the categories of actors covered by the matrix. It does not modify the existing processes for identifying, assessing, disclosing, or mitigating conflicts of interest, which remain unchanged. + + +Financial and human resources impacts +------------------------------------- + +The proposed update has no direct financial impact and does not require any additional budget. + +No employees, contractors, or volunteers need to be hired or dismissed as a result of this decision. The implementation will be carried out within the existing governance framework and responsibilities. + +The only operational impact consists of a one-time review of existing conflict of interest declarations by the persons covered by the policy to determine whether any additional disclosures are required under the updated matrix. This review is expected to require only a limited amount of time. + +No significant long-term financial or human resource implications are anticipated. + +Resolution/Petitum +------------------ + +The Board of the TYPO3 Association hereby resolves as follows: + +* **Adoption** : The Board adopts the Conflict of Interest policy updates represented by the following information: + * 2026 Conflict of Interests management policy + * 2026 Conflict of Interests Resolution process + * 2026 Possible Conflict of Interest Matrix + * Conflicts of Interests Register (internal document) +* Publication : The adopted Conflict of Interest Policy shall be published on the official TYPO3 Association website in the section dedicated to governance policies and shall become the reference for the application of the Conflict of Interest Policy. + + +Discarded alternatives +---------------------- + +* **Keep the current Conflict of Interest Matrix unchanged**: This option was discarded because practical use of the matrix has shown that some categories are difficult to interpret and that the current structure does not sufficiently distinguish between the existence of a situation and the level of conflict-of-interest risk it creates. +* **Update the matrix only to reflect the new organisational roles**: This option was discarded because simply adding new roles, such as Unit roles and Association Officers, would not address the interpretation and risk-assessment issues identified through the practical use of the current matrix. The annual update was therefore used as an opportunity to clarify and simplify the assessment approach. It would also require increasingly frequent updates as the organisation and its governance structure evolve. + + +Attachments & links +------------------- + +* https://docs.typo3.org/m/typo3/guide-policy/main/en-us/Association/ConflictOfInterest.html + + +Comments +-------- + +none diff --git a/Documentation/Association/Board/PublishingDecisions.rst b/Documentation/Association/Board/PublishingDecisions.rst index 92a8e0b..b01a7b5 100644 --- a/Documentation/Association/Board/PublishingDecisions.rst +++ b/Documentation/Association/Board/PublishingDecisions.rst @@ -33,4 +33,4 @@ The decision paper must be added to the repository via a pull request, which mus 1. Decisions that result in a policy change should be implemented in the same pull request as the decision paper, if possible. -2. An exception to the above are changes to the Bylaws, which require a vote by the General Assembly. In this case, the Bylaws change must be documented by a link to the General Assembly protocol in which the bylaws change was approved. \ No newline at end of file +2. An exception to the above are changes to the Bylaws, which require a vote by the General Assembly. In this case, the Bylaws change must be documented by a link to the General Assembly protocol in which the bylaws change was approved. diff --git a/Documentation/Association/ConflictOfInterest.rst b/Documentation/Association/ConflictOfInterest.rst index 96dbd2b..1504439 100644 --- a/Documentation/Association/ConflictOfInterest.rst +++ b/Documentation/Association/ConflictOfInterest.rst @@ -5,7 +5,14 @@ Conflict of Interest Management Policy ====================================== -*This policy was voted into effect through a Board vote in October 2023. The Possible Conflict of Interest Mapping matrix was updated 3 April 2025. Migrated to the current repository 19 November 2025.* +Document History +================ + +- **2 September 2026:** Policy and Possible Conflict of Interest Mapping matrix updated. +- **19 November 2025:** Migrated to the current repository. +- **3 April 2025:** Possible Conflict of Interest Mapping matrix updated. +- **October 2023:** Policy adopted by the Board. + Goals of the TYPO3 Conflict of Interest Management Policy ========================================================= @@ -46,8 +53,8 @@ There are several types of conflict of interest: * A **potential** conflict of interest exists when an individual has personal interests that could potentially conflict with his or her official responsibilities. * A **perceived** conflict of interest exists when the public may believe that an individual's personal interests could influence the performance of his or her official duties - whether or not this is actually the case. -Code of Conduct -=============== +Duties and Requirements +======================= Any individual falling within the scope of the sensitive processes, critical positions and at-risk operations defined above must : @@ -62,7 +69,7 @@ Priority Matrix The priority matrix is used to weight the severity of a conflict of interest by its probability, and to determine whether action needs to be taken to reduce this priority. -**Only conflicts of interest with a value greater than or equal to 4 should be dealt with using one of the strategies described below.** +**Only conflicts of interest with a value greater than or equal to 4 should be dealt with using one of the strategies described below, with “Avoid or Resign” applying only to level 6.** +-------------------------------+------------+------------+ | Conflict of interest Type | Low (1) | High (3) | @@ -82,35 +89,121 @@ Resolution Strategies * **Recruit:** If it is not practical to restrict your involvement, an independent third party may need to be engaged to participate in, oversee, or review the integrity of the decision-making process. * **Remove:** Removal from involvement in the matter altogether is the best option when ad hoc or recruitment strategies are not feasible, or appropriate. * **Relinquish:** Relinquishing the personal or private interests may be a valid strategy for ensuring there is no conflict with your public duty. This may be the relinquishment of shares, or membership of a club or association. -* **Resign:** It may be an option if the conflict of interest cannot be resolved in any other way, particularly where conflicting private interests cannot be relinquished. +* **Avoid or resign:** It may be an option if the conflict of interest cannot be resolved in any other way, particularly where conflicting private interests cannot be relinquished. Possible Conflict of Interest Mapping ===================================== -+-----------------------+--------------+------------+---------------------------------------------+---------------------------+----------------------------+---------------------------+------------------------------+--------------------------+-------------------------+ -| Type + Severity | Board | BCC | GmbH Employee | TYPO3 Agency / | Same Agency | Direct Under | Same Agency | Direct Under | Team / Committee | -| | Member | Member | (CEO, CTO, CFO, critical roles) | TYPO3 Freelancer | as Board Member | Board Member | as BCC Member | BCC Member | Lead | -+=======================+==============+============+=============================================+===========================+============================+===========================+==============================+==========================+=========================+ -| Board Member | na | forbidden | forbidden | 5 | forbidden | forbidden | 6 | forbidden | 2 | -+-----------------------+--------------+------------+---------------------------------------------+---------------------------+----------------------------+---------------------------+------------------------------+--------------------------+-------------------------+ -| BCC Member | forbidden | na | forbidden | 3 | 6 | forbidden | forbidden | forbidden | forbidden | -+-----------------------+--------------+------------+---------------------------------------------+---------------------------+----------------------------+---------------------------+------------------------------+--------------------------+-------------------------+ -| GmbH Employee | forbidden | forbidden | na | forbidden | 6 | forbidden | forbidden | forbidden | 3 | -+-----------------------+--------------+------------+---------------------------------------------+---------------------------+----------------------------+---------------------------+------------------------------+--------------------------+-------------------------+ -| TYPO3 Agency / | 5 | 3 | forbidden | na | na | na | na | na | 4 | -| TYPO3 Freelancer | | | | | | | | | | -+-----------------------+--------------+------------+---------------------------------------------+---------------------------+----------------------------+---------------------------+------------------------------+--------------------------+-------------------------+ -| Same Agency as | forbidden | 6 | 6 | na | na | na | na | na | 2 | -| Board Member | | | | | | | | | | -+-----------------------+--------------+------------+---------------------------------------------+---------------------------+----------------------------+---------------------------+------------------------------+--------------------------+-------------------------+ -| Direct Under | forbidden | forbidden | forbidden | na | na | na | na | na | 2 | -| Board Member | | | | | | | | | | -+-----------------------+--------------+------------+---------------------------------------------+---------------------------+----------------------------+---------------------------+------------------------------+--------------------------+-------------------------+ -| Same Agency as | 6 | forbidden | forbidden | na | na | na | na | na | 2 | -| BCC Member | | | | | | | | | | -+-----------------------+--------------+------------+---------------------------------------------+---------------------------+----------------------------+---------------------------+------------------------------+--------------------------+-------------------------+ -| Direct Under | forbidden | forbidden | forbidden | na | na | na | na | na | 2 | -| BCC Member | | | | | | | | | | -+-----------------------+--------------+------------+---------------------------------------------+---------------------------+----------------------------+---------------------------+------------------------------+--------------------------+-------------------------+ -| Team / Committee Lead | 2 | forbidden | 3 | 4 | 2 | 2 | 2 | 2 | 2 | -+-----------------------+--------------+------------+---------------------------------------------+---------------------------+----------------------------+---------------------------+------------------------------+--------------------------+-------------------------+ ++-----------------------------+------------------+------------------+------------------------------------------+------------------------------------------+------------------------------------------+------------------------------------------+ +| Type + Severity | BCC member | Board member | Person(1) sharing a financial interest(2)| Person(1) sharing a financial interest(2)| Person(1) sharing a financial interest(2)| Person(1) with a financial interest(2) | +| | | | with a BCC member or having financial or | with a Board member or having financial | with a Unit lead role or having financial| in any TYPO3 agency or TYPO3 freelance | +| | | | hierarchical leverage over them | or hierarchical leverage over them | or hierarchical leverage over them | business | ++=============================+==================+==================+==========================================+==========================================+==========================================+==========================================+ +| BCC member | na | forbidden | 6 | 5 | 6 | 3 | +| | | by by-laws | | | | | ++-----------------------------+------------------+------------------+------------------------------------------+------------------------------------------+------------------------------------------+------------------------------------------+ +| Board member | forbidden | na | 5 | 6 | 6 | 4 | +| | by by-laws | | | | | | ++-----------------------------+------------------+------------------+------------------------------------------+------------------------------------------+------------------------------------------+------------------------------------------+ +| GmbH employee | forbidden | forbidden | 5 | 5 | 5 | 5 | +| CEO, CTO, CFO, | by by-laws | by by-laws | | | | | +| any critical role(3) | | | | | | | ++-----------------------------+------------------+------------------+------------------------------------------+------------------------------------------+------------------------------------------+------------------------------------------+ +| Association Officers(4) | forbidden | forbidden | 5 | 5 | 5 | 3 | +| | by by-laws | by by-laws | | | | | ++-----------------------------+------------------+------------------+------------------------------------------+------------------------------------------+------------------------------------------+------------------------------------------+ +| Unit coordinators, deputies | 6 | 6 | 6 | 6 | 6 | 3 | +| and panel members | | | | | | | ++-----------------------------+------------------+------------------+------------------------------------------+------------------------------------------+------------------------------------------+------------------------------------------+ +| Team / Committee leads | 5 | 5 | 5 | 5 | 5 | 3 | +| and co-leads | | | | | | | ++-----------------------------+------------------+------------------+------------------------------------------+------------------------------------------+------------------------------------------+------------------------------------------+ +| External contractors and | forbidden | forbidden | 6 | 6 | 6 | 3 | +| service providers(5) | by by-laws | by by-laws | | | | | ++-----------------------------+------------------+------------------+------------------------------------------+------------------------------------------+------------------------------------------+------------------------------------------+ + +(1) References to a person's interests include interests held by their close relatives and persons with whom they have a close personal relationship where those interests could reasonably be perceived as influencing the person's judgment. +(2) Financial interest refers to an ownership, equity or comparable economic interest in the agency, and does not include ordinary commercial customer or supplier relationships. +(3) GmbH employee with critical role: Any role or position related to sensitive processes listed in the Conflict of Interest Policy. +(4) Association officers: Data Privacy Officer, Compliance Officer, Trademark Officer, Ambassadors, etc. +(5) For external contractors and service providers, the default impact severity is High. Where the total annual value of the services provided to the TYPO3 Association is below €50,000, the impact may be assessed as Low depending on the nature and significance of the contractual relationship. + + +Reporting a Conflict of Interest +================================ + +Any TYPO3 Association member, TYPO3 GmbH employee, or provider working for the TYPO3 Association or TYPO3 GmbH who becomes aware of a potential conflict of interest may report it to the TYPO3 Association Compliance Officer using `compliance@typo3.org `__. The report may concern the reporting person's own situation or a situation involving another person. + +The Compliance Officer will acknowledge the report within one working week, record it, assess the available information, and prepare a recommendation for the TYPO3 Association Compliance review panel. The Compliance review panel decides whether a conflict of interest exists and, where applicable, determines the appropriate measures in accordance with this policy. + +The person who submitted the report will be informed of the decision. Confirmed conflicts of interest and their management are recorded and periodically reviewed in accordance with the Conflict of Interest Resolution Process. + +Detailed Process +================ + +**This chapter describes how Conflicts of Interest are managed, from declaration to resolution by the TYPO3 Association.** + +Review (1 month after each GA) +------------------------------ + +- The Compliance Officer sends an email to all persons listed in the Conflict of Interest register to ask them either to validate the declared situation, or to inform about any new situation. +- The recipient has 2 weeks to answer about their situation + + - If the situation hasn’t changed, the Board member responsible for the conflicts of interest documentation adds the last update date of the conflict. + - If the situation has changed, the conflict goes through the next steps like a new conflict. + + +Compliance Review Panel members pool (1 month after each GA) +------------------------------------------------------------ + +- The Compliance Officer updates the Compliance Review Panel members pool based on the elected Board and BCC members. +- A public rotation list includes all current Board and BCC members and is initially ordered alphabetically by last name. For each case, the first three eligible persons are selected. Anyone who has a conflict of interest is skipped for that case without losing their place. After serving, Panel members move to the end of the list. + + +Take over (A conflict of Interest is declared) +---------------------------------------------- + +- Any TYPO3 association member, TYPO3 company employee, or TYPO3 Association or Company's provider aware of a conflict of interest can declare it by emailing the TYPO3 Association Compliance Officer at `compliance@typo3.org `__. +- The declaration is received in the OTOBO ticketing system, it is automatically assigned to the Compliance Officer +- The Compliance Officer has 1 working week to add the topic in the next board meeting and answer the member that their declaration is taken over +- The Compliance Officer creates a Reported disclosure record in the register and closes the OTOBO ticket. +- If the Compliance Officer is involved or conflicted, an alternate Case Officer is selected through the same predefined rotation used for the Compliance Review Panel. + +Identify (The next board meeting after the declaration) +------------------------------------------------------- + +- The Case Officer prepares a conflict of interest decision paper with the information needed: + + - The needed information for the decision paper + - The selected members of the Compliance review panel + - The Case Officer recommendations + +- The Compliance review panel must identify the conflict of interest with the help of the Conflict of Interest Mapping and the Conflict of Interest priority matrix +- The Compliance review panel votes (simple majority, no possible abstention) a decision on : + + - Is it a conflict of interest? + - If so, what is its type and impact severity? + +- The Compliance review panel must record the decision in the meeting protocol + +Disclose (Four weeks after the identification of a conflict of interest) +------------------------------------------------------------------------ + +- The Case Officer must update the Conflict of Interest register and if necessary the Conflict of Interest Mapping +- The Case Officer reports about the decision in the next board meeting +- The Case Officer sends an email to the person who reported the conflict of interest to inform them about the decision + +Manage (The next board meeting after the disclosure of a priority Conflict of Interest) +--------------------------------------------------------------------------------------- + +- If the Compliance review panel identified a conflict of interest of any type, the board must decide on actions to avoid the Conflict of Interest, or reduce the Conflict of Interest probability or severity impact +- The possible type of actions are listed in the Conflict of Interest Policy’s Resolution strategies chapter +- The Compliance Officer prepares a decision paper according to the actions +- The Board votes (quorum) the strategies they want to apply +- The Board must record the decision in the meeting protocol + +Monitor (One year after the strategies implementation) +------------------------------------------------------ + +- The Board must validate during a QSA during the conflict of interests policy review that the change is significant and that the strategies were successful. +- The Board must record the validation in the QSA protocol