The Country-Ranking Risk Assessment

The workbook ranks country risk but says little about how bribery could occur inside the business. Country index scores are useful context, but weighting them by sales revenue can understate small, high-risk markets and ignores process risk: hospital procurement, distributor onboarding, customs, gifts, travel, and payments to officials. A single person updating the workbook annually provides no challenge and no link to controls. ISO 37001 expects a documented bribery risk assessment, reviewed at planned intervals and on significant change, that considers likelihood and impact and is used to design controls. I would rebuild it around bribery scenarios by process and third party: who interacts with officials, what advantage could be offered, through whom, and what controls exist. Assess inherent risk, evaluate control effectiveness, and record residual risk with an owner. Involve sales, country managers, finance, and internal audit. The two new markets and the audit finding are triggers to reassess now, not next January.

A credit check and a signed declaration are not risk-based due diligence. They confirm financial standing and obtain a promise, but do not reveal ownership by officials, beneficial owners, reputation, government links, or red flags. The audit finding that four distributors are owned by relatives of hospital procurement officials is exactly the kind of risk due diligence should surface. Distributors should be tiered by risk, with enhanced due diligence for high-risk markets, public-hospital sales, and agent/intermediary models. That means ownership and beneficial-ownership checks, official-status screening, references, adverse media, and ongoing monitoring, supported by audit and termination rights. The commission design also undermines controls: 60% tied to signing within 30 days, when onboarding averages 45 days, pressures staff to skip checks. Incentives should reward compliant onboarding and not penalize the time needed for due diligence. The four cases require immediate review, escalation, and possible suspension or termination.

'Zero bribery incidents' is an outcome that the organization cannot fully control, and it can discourage reporting because any reported incident appears to fail the objective. '100% training completion' measures activity, not competence or behavior. Neither is a strong management objective. Better objectives would be measurable, monitored, communicated, and tied to the risk assessment: for example, 100% of high-risk distributors complete enhanced due diligence before contract; all payments to high-risk intermediaries are independently reviewed; high-risk staff pass a scenario-based competence assessment; overdue risk treatments are reduced to an agreed level; and reports to the whistleblowing channel are investigated within defined timelines. Objectives should have owners, baselines, and review points. They should also include a speak-up measure, because a low number of reports can indicate fear rather than good conduct.