Anti-Corruption Programme Design and Governance
Programme elements
An anti-corruption programme should be proportionate to risk but must cover top-level commitment, risk assessment, policies and procedures, governance, training and communication, third-party management, financial controls, whistleblowing, monitoring and remediation. ISO 37001 and the UK Bribery Act guidance’s six principles are useful benchmarks.
Governance
The board owns the programme. A senior compliance officer needs authority, independence and direct reporting access. Business units own first-line risk; compliance provides challenge and oversight. Decisions on high-risk agents, gifts and donations should be documented.
Proportionate design
A small company may use simpler approvals and training, but it still needs a policy, a risk assessment, controls over payments and a route to raise concerns. “Zero tolerance” should mean no bribery, not a blanket ban on all hospitality.
Worked example
A mid-sized manufacturer sells through distributors in three high-risk countries. Its risk assessment identifies government tenders and customs clearance as highest risk. It introduces enhanced distributor due diligence, a gift register, finance approval for agent fees and annual board reporting. Training is mandatory for sales and finance. This is proportionate because controls target the identified risks.
Traps
A paper policy with no testing. Giving compliance responsibility to sales. Measuring success only by training completion. Failing to update the programme after a merger, new market or investigation.