Scoping Out the Project Sites
A listed renewable-energy contractor has 1,200 employees, five subsidiaries in three countries, and a growing EPC business. It is initiating an ABMS. The draft scope covers 'head office and sales functions in Country A' and expressly excludes EPC project sites in Country B and a 60%-owned joint venture in Country C that uses local agents to obtain permits. Last year a JV agent paid USD 20,000 to a municipal official; the JV's minority partner handled the matter internally with a warning. The steering committee consists of the CFO, the sales vice-president and a part-time legal counsel; no project or country managers are members. The context analysis is a two-hour workshop and a 2019 corruption index. Top management has signed a one-page zero-tolerance statement. The project director asks whether the scope is defensible and what must happen before planning.
1. Evaluate the draft scope. What should be included, and why?
Read the worked answer
The scope is not defensible as drafted. ISO 37001 requires the organization to define the ABMS scope, but that boundary must reflect the organization's context, activities, and bribery risks, not simply exclude the hardest areas. EPC sites in Country B involve permits, officials, subcontractors, and site-level discretion; the JV in Country C has already produced a USD 20,000 payment to an official. Excluding both leaves the highest-risk operations outside the system and signals that the ABMS is a head-office exercise. The 60% JV is controlled by the group and uses agents on its behalf, so it should be included or subjected to specific, documented controls at the interface. I would include all subsidiaries and project sites where the group exercises control, and define clearly how the JV and its agents are covered. If the group genuinely cannot control a JV, it still needs influence controls, monitoring, and disclosure. A phased implementation is acceptable; an inaccurate scope statement is not.
2. What is wrong with the steering committee and the context analysis, and how should they be strengthened?
Read the worked answer
The steering committee is top-heavy and commercially biased: the CFO and sales vice-president are joined by a part-time lawyer, while the project and country managers who see the risks are absent. That weakens ownership and practical decision-making. The ABMS owner should have authority and direct access to the governing body, and the committee should include operations, HR, finance, legal, and high-risk country representation. The context analysis is too thin: a two-hour workshop and a 2019 index cannot capture internal issues such as incentives, culture, prior incidents, and capability gaps, or external issues such as sector risk, regulators, agents, and business partners. It should be a structured, documented process using multiple sources and updated when circumstances change. Top management's one-page statement is not leadership by itself; leadership is shown through resources, decisions, agenda time, and modeling. Before planning, the group should fix scope, governance, context, and initial risk assessment.
3. What must happen before planning begins?
Read the worked answer
Before planning, the group needs a sound initiation baseline. That means: settle a defensible scope and document the justification for any exclusion; appoint an ABMS owner with authority and access to the board; establish a steering structure with operational representation; complete a proper context analysis covering internal and external issues and interested parties; ensure top management commits resources and integrates anti-bribery into existing processes; investigate the JV incident and capture lessons; and carry out an initial bribery risk assessment at activity level. A gap analysis against ISO 37001 will show what already exists and what must be built. The project plan should then set milestones, owners, budget, training, communication, and monitoring. Starting planning before these basics are in place tends to produce a documented system that does not change behavior, which will not survive certification scrutiny or a real incident.