Agents, Blanket Approvals and a Dual-Hatted Compliance Officer
A 900-employee chemical distributor is applying for ISO 37001 certification. Eight months ago it formed a joint venture in a country its own bribery risk assessment places in the highest-risk band; the assessment itself was last revised in 2021 and does not mention the JV. Of 62 business associates, six are agents paid commission on public-sector contracts, yet due diligence questionnaires have been returned only by nine distributors and by none of the agents. The gifts and hospitality register shows four entries above the company's USD 250 threshold, all covered by a single blanket approval letter signed by the sales director in January and valid for the whole year. An internal audit report from 14 months ago raised the same blanket approval; management's written response was risk accepted. The certification scope statement reads head office and all controlled entities worldwide. The compliance officer, in post for eight months, is also the regional sales manager for the two highest-risk markets.
1. Assess whether the bribery risk assessment and the due diligence arrangements meet ISO 37001. Which requirements are engaged, and what is your provisional conclusion?
Read the worked answer
Three requirements are engaged, and on this evidence none of them is met.
Clause 4.5 (bribery risk assessment). The standard requires the assessment to be reviewed regularly and when significant changes occur. Creating a JV in a jurisdiction the organization itself classes as highest risk, eight months ago, is exactly such a change. The assessment on file predates it, so the controls are no longer being designed from a current picture of risk. Test whether the assessment is used operationally or is a document produced for the certification file: ask who commissioned it, whether the JV was risk-assessed before formation, and whether the result changed any control.
Clause 8.2 (due diligence). Due diligence must be risk-based and applied to business associates in proportion to risk. Nine questionnaires back out of 62, and none from the six commission agents selling into public-sector contracts, is the inverse of risk-based selection. Commission-only agents on government business are the archetypal high-risk category.
Clause 8.5 (implementation by business associates and controlled entities). The organization remains responsible for implementing controls over business associates; an agent paid on success is the case the clause exists for.
Provisional conclusion: likely a major nonconformity. Note the reasoning precisely: the finding is not that a bribe was paid, and it is not the auditor's role to conclude that. It is that required control processes are absent in the riskiest part of the operation.
2. The client's adviser argues the January blanket approval is a legitimate control because every gift is recorded and the sales director outranks every recipient. How do you evaluate this against the standard and what evidence do you obtain?
Read the worked answer
The adviser is confusing recording with controlling. Clause 8.7 requires controls so that gifts, hospitality, donations and similar benefits are reasonable, bona fide, offered in good faith, not intended to improperly influence the recipient, and do not create a conflict of interest, with records kept and approval at an appropriate level of authority.
A single annual letter moves approval to whoever holds the letter and removes judgement at the only moment when judgement is possible: when the gift is offered, in front of a specific recipient, with knowledge of what decisions that recipient is about to take. Rank is irrelevant; what matters is whether the approver can see the risk. The letter also cannot be risk-proportionate: four entries above threshold could be trivial courtesies or could be a pattern aimed at one procurement official, and the mechanism cannot tell the difference.
Second, internal audit raised exactly this 14 months ago and management accepted the risk. Clause 8.8 requires the organization to take appropriate action where anti-bribery controls are inadequate. Risk acceptance is only meaningful if taken at the appropriate level of authority, documented, and based on an analysis of the residual risk. Obtain that analysis; if it does not exist, the acceptance is an assertion, not a decision.
Evidence to obtain: the four register entries with recipient, role and any pending decision; the approval letter; interviews with recipients and the sales director; the 2021 risk assessment's treatment of hospitality; internal audit's report and management response; and whether top management or the governing body saw the issue (which also bears on 9.3).
3. What is the significance of the compliance officer's dual role, and how would you pursue it during the audit?
Read the worked answer
Clause 5.3 gives the compliance function responsibility and authority for the anti-bribery management system, and the standard expects that function to be able to act independently of commercial pressure. Combining it with a revenue-carrying sales role in the two riskiest markets creates a structural conflict: the person responsible for saying no to a transaction is measured on the revenue that transaction generates.
The test is not the job title but whether the function can actually stop something. Pursue it this way:
- Obtain the terms of reference and the job description, and establish to whom the compliance officer reports and how independence is documented.
- Sample high-risk decisions in the two markets (an agent engagement, a large gift, a consultancy agreement) and trace whether compliance sign-off could be, or was, overridden.
- Look for vetoes: has the function ever refused or escalated anything? Check the concerns log under 8.9 and investigation records under 8.10 for cases involving the sales side.
- Check whether the risk assessment identifies the conflict and whether management review has considered it.
Then frame any finding factually and at the level of the process, for example: the compliance function is performed by a person with a conflicting commercial role, with no documented independence and no evidence that its authority has ever been exercised against a commercial interest. Avoid personal criticism of the individual; the finding is about the design of the role, not the person.