ISO 37001 LA key terms

Offering, promising, giving, accepting, or soliciting an undue advantage of any value, directly or indirectly, to influence a person's actions improperly, regardless of whether the advantage is actually delivered.

Any benefit, whether financial or non-financial, to which the recipient is not lawfully entitled. It need not be money and need not be large; the improper intent behind it is what matters.

A small payment made to secure or speed up a routine action the payer is already entitled to receive. Many legal regimes criminalise it, so ISO 37001 treats it as a bribery risk requiring prohibition or strict control.

A person holding a legislative, administrative, judicial, or executive office, or acting for a public body or state-owned enterprise, including candidates for office. Bribery involving such persons carries heightened risk.

Benefits such as meals, travel, entertainment, or tokens given to build relationships. Under ISO 37001 they must be limited, transparent, and subject to approval so they cannot be used to disguise improper influence.

A situation where a person's private interests could improperly influence their judgement in an organisational role. It is a recognised bribery risk factor requiring disclosure, declaration, and management.

The set of interrelated policies, processes, responsibilities, and controls an organisation uses to prevent, detect, and respond to bribery. It is the object that ISO 37001 specifies requirements for.

A documented statement of the organisation's commitment to prohibit bribery, setting out principles, prohibitions, and the obligation of all personnel and business associates to comply. It must be communicated and available to relevant parties.

The person or group directing and controlling the organisation at the highest level. ISO 37001 requires it to demonstrate leadership, approve the policy, ensure resources, and review the system's performance.

The person or function assigned responsibility for overseeing the design and operation of the anti-bribery system, advising personnel, and monitoring compliance. It must have authority, resources, and direct access to top management.

A documented, periodic evaluation of the bribery risks the organisation faces, considering its context, activities, transactions, and business relationships, used to prioritise controls and allocate resources proportionately.

The investigative and evaluative steps taken before and during a business relationship to assess the bribery risk posed by a counterparty, and to decide whether to proceed, impose conditions, or withdraw.

Risk-based checks on intermediaries, agents, consultants, suppliers, and other external parties acting for or on behalf of the organisation, covering ownership, reputation, competence, and commitment to anti-bribery controls.

An external party with whom the organisation has, or plans to establish, a business relationship, including contractors, suppliers, consultants, and agents. ISO 37001 requires controls proportionate to their bribery risk.

The principle that the nature and intensity of controls should be proportionate to the assessed bribery risk. Higher-risk activities, countries, sectors, and relationships attract more rigorous due diligence and monitoring.

The level of bribery risk that remains after existing controls have been applied. It is compared with the organisation's risk criteria to judge whether additional treatment is needed.

The protection of persons who report suspected bribery in good faith from dismissal, demotion, or other detrimental treatment. ISO 37001 requires such protection to be built into reporting processes.

The reporting of suspected or actual bribery through confidential channels, including anonymous routes where permitted. Reports must be handled by competent persons and investigated without bias.

Information the organisation must control and maintain, including the anti-bribery policy, risk assessments, due diligence records, training records, and audit results, together with evidence that processes were carried out as planned.

Action taken to eliminate the cause of a detected nonconformity or incident so it does not recur. It includes investigating the cause, implementing changes, and reviewing their effectiveness.

A systematic, independent, and documented process for obtaining objective evidence and evaluating it against agreed criteria to determine the extent to which those criteria are fulfilled.

The set of requirements used as a reference against which audit evidence is compared, such as ISO 37001 clauses, the organisation's own procedures, contractual obligations, and applicable anti-bribery law.

Records, statements of fact, or other verifiable information relevant to the audit criteria. It must be traceable and capable of being confirmed, not merely an auditor's impression.

The body of records, observations, interviews, and test results collected during an audit. It is evaluated against the audit criteria to support audit findings and conclusions.

A statement defining the boundaries of an audit, including the organisational units, locations, activities, functions, and time period covered, and the requirements to be assessed.

A description of the activities and arrangements for a specific audit, covering objectives, criteria, scope, schedule, team assignments, and the sites and interviewees to be visited.

The set of interrelated audits planned for a defined period and purpose. It is managed at a strategic level to cover the whole management system over time and to allocate audit resources.

One or more auditors, supported where needed by technical experts, conducting an audit. Members must collectively possess the competence needed for the audit's scope and criteria.

Freedom from bias and undue influence, meaning auditors do not audit their own work or have a relationship that could compromise objectivity. It is a precondition for credible audit conclusions.

The state of mind and conduct in which an auditor reaches conclusions based only on evidence, without allowing prejudice, interest, or pressure to distort judgement.

The demonstrated ability to apply knowledge and skills to achieve intended results. For ISO 37001 auditors this includes understanding bribery risk, the standard's requirements, and audit techniques.

Selecting a subset of records, transactions, or people to examine when full examination is impractical. Samples must be sufficient and risk-focused to support reliable conclusions.

The result of evaluating collected audit evidence against audit criteria. Findings may indicate conformity or nonconformity and are the basis for reporting and corrective action.

A failure to meet a requirement of the audit criteria, such as a missing risk assessment or an unapproved payment. It is classified, recorded, and followed up to closure.

The fulfilment of a requirement stated in the audit criteria. Demonstrating conformity requires evidence, not just the existence of a procedure on paper.

A periodic, documented review by top management of the anti-bribery system's suitability, adequacy, and effectiveness, covering audit results, risk changes, incidents, and improvement actions.

The formal end-of-audit meeting at which the audit team presents findings and conclusions to the auditee, explains the reporting process, and agrees follow-up arrangements and timelines.

A documented record of the audit covering scope, criteria, findings, conclusions, and any recommendations. It is issued after the closing meeting and forms the basis for corrective action.