Scene 1

supplier  engagement  guidebook UKI  Owners: ISM, IOS

Scene 2

P2P PROCESS  BUSINESS NEED  PREFERRED SUPPLIER SOURCING METHODOLOGY GENERAL DATA PROTECTION METHODOLOGY QUALITY RISKS  IR35 RISKS  H&S RISKS  CONTRACTS  NEW VENDOR REQUESTS  NEW VENDOR REQUEST FORM  NEW VENDOR REQUEST VALIDATION  NEW VENDOR ADD AND CHANGE PROCESS FOR INDIRECT VENDORS PURCHASE ORDER REQUESTS  INVOICES  PAYMENT TERMS & URGENT REQUESTS  CORPORATE CARDS  TRAVEL BOOKING  P CARDS  CONTACTS & USEFUL LINKS

Supplier Engagement Guidebook UKI |   July  2021   |   Confidential, for Internal Use Only

Scene 3

BUSINESS NEED Identification of new goods/ services

PREFERRED  VENDORS Requestor aligns with ISM, is preferred vendor available?

SET UP PREFERRED VENDOR Requestor to contact IOS to set up vendor  in SAP

NO PREFERRED VENDOR  Enter supplier selection process

SOURCING METHODOLOGY RFI, RFP, or    direct negotiation

PREFERRED VENDOR                AVAILABLE IOS to raise PO

RAISE PO Once vendor approved, IOS to raise PO

INVOICING  Supplier sends invoice to AP with PO number

Acronyms: ISM = Indirect Supply Management                                                                    PO = Purchase Order              IOS = Internal Operation Support                                                                        P2P = Procure to Pay RFP = Request for Proposal                                                                                       AP = Accounts Payable

AWARD CONTRACT  Negotiate and award contract through Ariba in line with legal

AWARD PREFERRED STATUS  Vendor listed as preferred on Ariba Portal

Scene 4

Please ensure that ISM is involved in the  early stages of goods and needs identification , this will ensure a smooth procurement of your requirement.

Acronyms: ISM = Indirect Supply Management                                                                          P2P = Procure to Pay GDPR = General Data Protection Regulation

Benefits  Market and category expertise Procurement can check for preferred suppliers with pre negotiated contracted rates  Negotiation with new vendors to help save money against budget  Speed up the P2P process by identifying blocks early Early identification of risks such as quality and GDPR Awareness of unethical tactics

ISM Contacts; Ela Drummond    - UKI Strategic Sourcing Specialist  Malgorzata (Gosia) Moleda   -   Senior Sourcing Supervisor, North Western Europe Region

Scene 5

Suppliers are designated as preferred by ISM when they are part of a sourcing strategy, after having been competitively bid or vetted as sole source. Business should be conducted with preferred suppliers when available. Preferred suppliers usually have a contract in place, should be marked as preferred in Ariba SLP and can be defined on global, regional, or local level. In some categories of spend we can only use the preferred Global, EMEA or local supplier, this may be company policy or strategy, examples include, but are not limited to;

In order to check if you  can set a supplier up  as preferred, please contact ISM   ISM CONTACTS: Ela Drummond    - UKI Strategic Sourcing Specialist  Malgorzata (Gosia) Moleda   -   Senior Sourcing Supervisor, North Western Europe Region

Professional Services Consulting
Office Supplies
Human Resources Services
Industrial
Travel, Meetings + Events
Supply Chain & Logistics
Facilities
Marketing/MarComm/Communic...

In order to check if a preferred supplier is already available, please contact Ariba  PURCHASING PORTAL: Ariba  For additional support please contact IOS:  IOS CONTACT: IOS Team

Print – must  use Paragon Creative and Digital – selection of preferred vendors available   Permanent Recruitment – must use AMS   Office Supplies – must use Lyreco  Travel – must use KDS

You can check for preferred suppliers by logging into Ariba  Medtronic Purchasing Portal:  Ariba  Please login with your Medtronic enterprise ID

Scene 6

Please check the following policies on the  Medtronic Policy Portal  Global PO Payment Policy Involve Indirect Supply Management EMEA for all engagements with annual spend of 250K or more and all Professional services engagements regardless of spend Global Procurement Policy Engage with preferred suppliers for Learning & Leadership Development services Learning & Leadership Development services Engage with preferred suppliers for Translation Services Translation services Engage with preferred suppliers for Promotional Print and Promotional Items Print Policy (EMEA) EMEA Promotional Items Policy

Scene 7

RFI An RFI is a  Request for Information

Market a monopoly Single source arrangement Lower spend  Other

High spend, strategic, complex projects  Hard data for analysis and comparison required  Need comparison of responses, costs and vendors  Solicit bids for a project to support negotiation

ISM will support you in aligning sourcing strategy with business need.

Little knowledge of product/services/market Need to support information gathering in a structured way .

RFP An RFP is a  Request for a Proposal

ISM Contacts; Ela Drummond    - UKI Strategic Sourcing Specialist  Malgorzata (Gosia)  Moleda   -  Senior Sourcing Supervisor, North Western Europe Region

Scene 8

Acronyms: GDPR   = General Data Protection Regulation              GSO = Global Security Office

General Data Protection Regulation (GDPR)

WHAT ARE GDPR RISKS? Sharing of Personal Data  Sharing of Business Data  Connection to Medtronic network or systems

The following questions should be considered; Will the supplier be provided or have any information that could identify an individual?  Will there be a network connection made to join Medtronic network to the supplier network?  Will the supplier have remote access to the Medtronic network or data?  Will there be any exchange of Medtronic business data between Medtronic and the supplier?

Where  there is a GDPR risk the requestor should complete the  Security and Privacy Intake Request

OUTCOME Once the review is complete, a final security risk outcome will be awarded. A detailed report will be provided to the requestor providing a breakdown of the issue, risk, rating, recommendation and date for review.  Where a GDPR risk is identified, ISM will include the Data Protection exhibit in the contract.

IN SCOPE An application provided by a Third Party Medtronic relying on a vendor to protect data Legal binding agreement with Third Party Direct impact to a Medtronic product Medical device capable of collecting and/or transmitting personal info  Connectivity between Medtronic and external systems Firmware, driver, or code signing Architecture or design changes Code changes Connectivity and/or URL changes Upgrade, migration, or consolidation of applications  Changes data classification or previous GSO assessment A mobile application developed by Medtronic An application hosted in the cloud Changes to internal or external authentication Using standard single sign on (SSO) Using an email address to log into an external application Access to request certificates or encrypt data Vendor impersonating email as 'medtronic.com' (DMARC) or sending email as 'medtronic.com’ Need to identify or remediate security vulnerabilities

Scene 9

Table

Description automatically generated

The inside of a building

Description automatically generated

A picture containing indoor, toy, room, sitting

Description automatically generated

A picture containing table, indoor, glass, wine

Description automatically generated

A store inside of a building

Description automatically generated

A picture containing cabinet, sitting, brown, library

Description automatically generated

A picture containing star, light

Description automatically generated

A group of people in a room

Description automatically generated

A picture containing diagram

Description automatically generated

A person sitting on a table

Description automatically generated

A picture containing person, person, looking, sitting

Description automatically generated

A picture containing text

Description automatically generated

Text

Description automatically generated

Graphical user interface, text, application

Description automatically generated

*Where risk is listed as TBA, further questions may be required depending on their product or patient related impact

Where there is a potential quality risk, ISM will engage the quality department for review. If there is a quality impact a risk level may be assigned to that supplier, please see table 1 and examples of high-risk categories. For certain high-risk categories, vendors may be subject to;  Quality review and supplier audits  Internal and external audits SOPs Additional contracts The  Supplier Management Procedure   can be found on the  QMS portal

QUALITY CONTACT; Valeria Till  – Quality Systems Specialist

Acronyms: ISM = Indirect Supply Management      SOP = Standard Operating Procedure         QMS = Quality Management System

Scene 10

WHAT IS IR35? IR35 is another name for the off payroll working rules. It’s designed to assess whether a contractor is a genuine contractor rather than a disguised employee for the purposes of paying tax. IR35 is designed to prevent workers from avoiding tax by operating as contractors. WHAT IS CHANGING? Under the off-payroll rules from April 2021, the responsibility for determining a contractors IR35 status falls with Medtronic as the end client receiving the service.  Medtronic will now be responsible  for determining the IR35 status of its off-payroll workers and will be  held liable for the costs of tax avoidance  where the determination is incorrect REQUESTOR RESPONSIBILITIES CXC Global are our preferred partner who support us through this process and mitigate the risk to Medtronic. An assessment will need to be initiated on your contractor through the CXC Comply tool.

In Scope;     Consultants Contingent Workers Indirect Vendors (One man band) HCPS                              …registered in the UK

If you need to initiate an assessment, please contact;  IR35 Contacts  CXC Jo  Pover   – Client Services Manager 07506 516 377

Scene 11

If you think your project has a H&S risk, please contact;

Health and Safety risks will need to be assessed by the EHS department   Examples include, but are not limited to;  Facilities/Building Equipment, Equipment Maintenance and Construction Services Utilities (water/gas/electric), Cleaning/Landscape services and Waste removal  Sterilization Services & Consumables  Chemicals (except adhesives) Freight/Transportation Lease cars & Airfare Packaging Consumables  Consumables related to Research & Development, Laboratory & Cleanroom and Mammals & Cadaver Mammal/Animal Covid related risks Radiation

H&S CONTACT; Kate Brown  - EHS Supervisor

Scene 12

Once a supplier has been through the vendor selection process with ISM, they will be awarded a contract.  ISM should be involved in all stages of contract set up and negotiation.    Contracts should be issued on 60 day payment terms for UKI and 90 days for other countries in EMEA.  Agreements should be signed by an authorized   legal signatory as defined by Medtronic  Final signed agreements are stored by ISM on the Ariba Contracts Portal.

A long form contract (rather than just a Purchase Order) is required when any of these criteria are met: Medtronic needs any warranties; or Medtronic needs to own any intellectual property rights; or Medtronic needs confidentiality assurances from supplier; or Licensing is involved including any IT, cloud, or hosting services, or patents; or The item or service that is purchased is an integral or critical part of a device or Medtronic service to customers; or Customization in any way of any good or service; or Medtronic requires continuity of supply; or The supplier will have access or connection to Medtronic devices or systems; or The supplier will have access to or store or process personal data or protected health information; or The supplier will have access or store business sensitive confidential information; or Any contract with significant risk (e.g., installing heavy equipment, any construction or participating in any activity where there is a medium to high risk of injury, death, property damage, third party claims, environmental hazards, etc.). A Purchase Order may be used if the above items are not implicated.  A “long form contract” is any contract that is fully executed by both parties.

Examples of standard contracts; MSA (Master Services Agreement) – Multiple supplier use  SOW (Statement of Work) – To be used with MSA, details scope of work  Standalone Agreement – one time supplier use  CDA – Confidential Disclosure Agreement

Where we require additional protection, additional contract exhibits may be required;  Data Protection Exhibit Insurance Exhibit Technology Services Exhibit  Marketing Services Exhibit Business Consultancy Agreement  Travel Exhibit  Invoice Requirement

ISM CONTACTS; Ela Drummond    - UKI Specialist  Malgorzata (Gosia)  Moleda   -  Senior Sourcing Supervisor, North Western Europe Region

ACRONYMS: ISM = Indirect Supply Management                                              IOS = Internal Operation Support                                                 PO = Purchase Order

Scene 13

BUSINESS CASE Once a request for new goods or services is identified, you must engage with ISM as early as possible and prior to selecting a supplier. ISM can support you with the RFP process and support negotiations.  The preference is for preferred suppliers to be used as these suppliers have pre negotiated rates and contracts.  Where a preferred supplier is not available, you must engage with ISM.

ISM will assess; Is there a preferred supplier available?  Do we have a contract?  Has ISM been engaged in the vendor selection process through Ariba?  Is an RFP required? What is the associated quality risk?  What is the GDPR risk?  Are there any IR35 associated risks? If there is a quality risk the quality department needs to be engaged for assessment.  If there is a GDPR risk, you will need to initiate a GSO review with the GSO team. Please remember, as policy Medtronic's payment terms are  60 days .  All new vendors will be informed of the 60 days payment terms when they are set up on the system.

ACRONYMS: ISM = Indirect Supply Management                        GDPR  = General Data Protection Regulation                IR35 = Tax Regulation                                                          GSO  = Global Security Office       QA = Quality Assurance                                                    RFP = Request for Proposal

Scene 14

Company code for which the supplier will be used:  Description of the goods/service provided: Why is the goods/services needed? Please explain why an existing supplier cannot be used: Will the supplier be used more than once?  Who from ISM has been involved? When is the goods/services needed? What is the anticipated spend with the supplier over the next 12 months?

Will the procured item/service potentially impact product quality and/or reliability? Will the procured item/service potentially impact decisions related to product quality or quality compliance? Will the procured item/service be included in any quality verification, validation and/or registration activity?

Please make sure to align with your local EHS representative before creating a supplier that provides any of the following: Facilities/Building Equipment, Equipment Maintenance and Construction Services Utilities (water/gas/electric), Cleaning/Landscape services and Waste removal  Sterilization Services & Consumables  Chemicals (except adhesives) Freight/Transportation Lease cars & Airfare Packaging Consumables  Consumables related to Research & Development, Laboratory & Cleanroom and Mammals & Cadaver Mammal/Animal

ACROYMS: EHS = Environmental Health & Safety

Scene 15

The following information should be sent to IOS to support supplier validation; Full validation requirements can be found here Please note this detail needs to be on company letterhead paper and in PDF format only. Please ensure the PDF letterhead contains a signature and provide a pro forma invoice OR bank statement.  NB: All these details are mandatory; the Vendor Master Team will not be able to submit the request without them.  Once the IOS team has collected the required information, they will route new vendor request will to the IPC team. The IPC team is the procurements operations department, it is their role to validate the supplier and gather approvals from ISM. Once approved with ISM the IPC team will send it to the Vendor Master team to be set up in SAP.  Once actioned the vendor number is then provided back to the IPC team.

ACRONYMS: ISM = Indirect Supply Management                 IOS = Internal Operation Support IPC = Indirect Purchasing Center

Name of Bank  Account Number Sort Code IBAN  SWIFT Code VAT Number Company Registration Number Email address

Scene 16

New vendor add & change process for Indirect Vendors

2. Inputs details  of request  via  intake form

Gather input Get any required  validation documentation

Intake form Intake form contains high level information Only for  indirect vendors

Submit request to VM Fill out VM form Submit to VM

7 . Receive confirmation from VM & inform requester

Review Review request Get  ISM approval  if required

Communicate Receive confirmation from VM Inform requester

Acronyms: ISM = Indirect Supply Management                   IPC = Indirect Purchasing Centre                 VM = Vendor Management

Scene 17

The global Indirect Purchasing Center (IPC) is an organization that manages all purchase order (PO) requests and other buying activities for indirect goods and services. IPC will be contacted by the IOS team for topics like: 'How to' questions on Medtronic Purchasing Portal (Ariba)/SAP system functionality.  Questions related to Procurement policies or procedures.  Requisition status and adjustments requests.  PO status and adjustments requests.  Invoice mismatch status requests.  Status of your Request/Ticket. Indirect vendor adds and changes Please note that in the first instance, IOS should still be you first point of contact for these queries.

Scene 18

IOS CONTACT;  IOS Team ECATS CONTACT;  ECATS Team  – PO for HCP related Spend

Requestors must raise the purchase order with IOS  prior  to goods and services being received in order to be complaint and avoid escalations. This ensures that there is an approval  of the expenditure. Any  invoice raised retrospectively must be signed off via email from EMEA Financial Controller, Ward Duchossoy.  Indirect goods and services are purchased through Ariba with a PO using preferred suppliers. In order for a supplier to be awarded preferred status, you must work with Procurement throughout the supplier selection and contracting process in line with the  Global Procurement Policy . ​

ACRONYMS: ISM = Indirect Supply Management                 IOS = Internal Operation Support          PO = Purchase Order                                                   HCP = Healthcare Professional

In order to raise a purchase order, it is mandatory that you provide the  IOS team  with the following information. P lease ensure all required information is provided in order to prevent delays in raising your PO;  Vendor name and vendor number if known: A PDF quotation/pro forma invoice from the supplier on their headed paper (*must  not  be an invoice) : Check full amount is included on the quote including correct currency and VAT if applicable. (Where raising an annual or framework PO, the new yearly amount and previous years spend is required): Cost centre: Select which Medtronic Company code: UK 3700/Ireland 3800/Covidien 3812 Suppliers Email address: Full, detailed description of the goods/service: Business Rationale of the spend: PO Requesters name (if you are requesting on behalf of someone else): Manager approval if necessary:

Scene 19

Where should suppliers send invoices? Suppliers should send invoices directly to Accounts Payable:  invoice@medtronic.com Supplier invoice queries should be sent to:   fsscaccountspayable@medtronic.com   /  AP: (+31)45-5668222, option 1                             Internal invoice queries should be sent to the  PTP Team             Medtronic operates a  No PO, No Pay policy . Therefore, if an invoice is issued without a correct purchase order, it will not be PTP compliant and will be rejected and sent back to the supplier.   Exceptions to the policy can be found in the  Global PO Payment Policy  Payment runs are made on Tuesdays and Thursdays

AP CONTACT;  Supplier Invoice Address Supplier Invoice Queries / (+31)45-5668222, option 1                            PTP CONTACT; PTP Team

ACRONYMS: PTP = Procure to Pay                IOS = Internal Operation Support          PO = Purchase Order

Scene 20

PAYMENT TERMS Medtronic’s payment terms in the UK and Ireland  are  60 days,  this is company policy. All new vendors will be informed of the 60 days payment terms when they are set up on the system.

ACRONYMS: IOS = Internal Operation Support

URGENT REQUESTS In exceptional circumstances an urgent payment request may be required. This will need to be signed off by the Financial Controller, Ward Duchossoy.  Please note that in some circumstances this request may be rejected and a PO should always be raised prior to requesting goods and services.  The urgent request template will need to be completed by the requester and provided to the PTP Team. For urgent requests please contact  UK&I PTP .

Scene 21

Corporate credit cards can be used across Medtronic to support business spending and expenses where the employee is on business travel. This can be inside or outside of the employees country of employment.  Examples of spend include; business lunch and  individual meal expenses. AMEX cards can be used to book travel such as airfare, train or hotel costs through the travel booking tool. Please see  Travel Policy .  If you would like to apply for a corporate credit card, please send your request to the  IOS Team . Please include your line managers  approval.

P2P Guidebook |   May  2021   |   Confidential, for Internal Use Only

AMEX HELPDESK;   0800 917 8031 or +44 1273 622 600

Scene 22

KDS Neo should be used to book business travel, this includes the following;  Hotels  Trains  Airfare  Taxis  Hire Cars Please note, you must have approval from your line manager  before booking your trips in KDS.

Link for tool for all countries except Ireland Link for tool for Ireland

KDS HELPLINE; GBT Online Team: + 44 203 788 3610

Please see user guide for information on;  How to book a trip  How to book a multi trip  How to Modify/cancel  a trip More

Scene 23

P-CARD EFFICENCIES  Increase employee convenience and satisfaction Reduce workload, allowing increased focus on more strategic, value-adding activities Improve accuracy No  new vendor request s  & no PO creations Easy payment method – physical card (MasterCard) Small suppliers not waiting 30/60/90+ days for payments Expense Express - u se of the system that I know HIGHLIGHTS : Internal spend only ( not HCP related) 1 card = 1 cost centre      (NB: this does not necessarily mean that all cost centres have a card) Monthly limits

P-Card is a name for purchasing cards. P-cards ( Bank of America)  are used in Medtronic where spend is below £5k in the following categories;

Typical examples of when a P-card should be used are:  Flowers, landscape services  Office supplies that could not be fulfilled by OneSource catalogs or other Procurement systems Janitorial supplies Participation in seminars / Fairs / Membership and Dues Minor repairs services / minor facility services Catering / cafeteria services for employees Publications of annual newspapers / Books

Scene 24

POLICYS  Global Procurement Policy   Global PO Payment Policy  Travel Policy

CONTACTS IOS TEAM IOS T eam PTP Team AP TEAM Invoice submission:   invoice@medtronic.com Invoice queries:  fsschelp@medtronic.com ISM TEAM Ela Drummond – Strategic Sourcing Specialist Malgorzata (Gosia ) Moleda – Strategic Sourcing Supervisor NWE QUALITY Valeria Till  - Quality Systems Specialist  EHS TEAM Kate Brown  - EHS Supervisor IR35 TEAM IR35 Mailbox  – Client Services Manager Jo Pover  – Client Services Manager ECATS TEAM ECATS Team  – PO for HCP related Spend

Expense Policy Policy Portal Promotional Print  EMEA Promotional Items

ACRONYMS   ISM Indirect Supply Management IOS Internal Operation Support GDPR General Data Protection Regulation IR35 Tax Regulation (Off Payroll Working Rules) HCP Healthcare Professional RFP Request for Proposal RFI Request for Information PO Purchase Order P2P Procure to Pay GSO Global Security Office IPC Indirect Purchasing Centre VM Vendor Management

WEB LINKS  Ariba QMS portal   Supplier Management Procedure    KDS KDS Ireland  Expense Express   PTP Value Stream