ISO 37001 LI cheat sheet

Bribery is the offering, promising, giving, accepting or soliciting of an undue advantage of any value, directly or indirectly, in violation of applicable law, as an inducement or reward for an act or omission in the performance of duties.

ISO 37001 defines bribery to include both active side (offering/giving) and passive side (accepting/soliciting), and covers advantages given or received by or through third parties acting on the organization's behalf.

An anti-bribery management system (ABMS) is a set of interrelated or interacting elements of an organization used to establish policies, objectives and processes to achieve anti-bribery objectives.

Key principles: top-management leadership and commitment, proportionality to bribery risk, due diligence on people and business relationships, and continual improvement based on monitoring and review.

The standard applies to bribery in public, private and not-for-profit sectors and to both domestic and foreign bribery; it does not address fraud, cartels or other competition offences except where they involve bribery.

ISO 37001 is a certifiable management system standard structured on the Annex SL high-level structure, so it shares clause numbering (4-10) with ISO 9001, ISO 14001 and ISO 37001's companion standards.

Proportionality principle: controls and procedures must be reasonable and proportionate to the bribery risk faced, so a low-risk small entity is not required to build the same control depth as a high-risk multinational.

'Reasonable and proportionate' anti-bribery controls are a defence element: the standard expects documented evidence that the organization designed and operated controls proportionate to its assessed risk.

Initiation begins with clause 4 context work: determining external and internal issues relevant to purpose, and identifying interested parties and their relevant requirements.

The scope statement (clause 4.3) must be documented and state which activities, locations, functions and controlled entities are covered, and must be available to interested parties.

Bribery risk assessment (clause 4.5) must be documented, identify bribery risks the organization can control or influence, and be reviewed and updated when significant changes occur.

A decision rule for scope: the ABMS scope need not cover the whole organization, but any exclusion must not reduce the organization's legal or contractual anti-bribery obligations.

Gap analysis against ISO 37001 clauses 4-10 is the typical first diagnostic; its output feeds the implementation plan, resource estimate and timeline.

Leadership appointment of a compliance function or person(s) with responsibility for the ABMS (clause 5.3.2) is an initiation decision, distinct from the governing body's oversight role in clause 5.1.2.

Initiation outputs to document: context analysis, interested-party register, scope statement, high-level bribery risk assessment, and the implementation project plan with owners and dates.

Baseline data collection at initiation includes existing policies, gifts/hospitality registers, third-party lists, contract clauses, incident logs and applicable laws per operating jurisdiction.

Clause 6.1 requires planning to address risks and opportunities identified in the bribery risk assessment, and to integrate actions into ABMS processes rather than treat them as a standalone list.

Bribery risk assessment (clause 4.5) must use a documented methodology that considers likelihood and impact, and must be repeated at planned intervals and on significant change.

Due diligence (clause 8.2) is risk-based: the depth of due diligence on a business relationship must be proportionate to the assessed bribery risk of that relationship.

Anti-bribery policy (clause 5.2) must be documented, prohibit bribery, commit to satisfying applicable requirements, and be communicated to all persons working under the organization's control.

Objectives (clause 6.2) must be measurable where practicable, consistent with the policy, monitored, and supported by plans answering what, who, when and how results are evaluated.

Planning must define the anti-bribery compliance function's authority and independence (clause 5.3.2), including direct access to the governing body where required.

Control planning covers gifts, hospitality, donations and similar benefits (clause 8.4), managing inadequacy of anti-bribery controls in business relationships (8.3), and raising concerns (8.9).

Risk treatment options are avoid, mitigate, transfer or accept; acceptance of residual risk must be by a person with appropriate authority and documented.

Clause 7.2 requires anti-bribery training for persons working under the organization's control whose work poses a bribery risk, and for the compliance function, with records retained as evidence.

Clause 7.3 requires awareness of the anti-bribery policy, the person's contribution to ABMS effectiveness, and the implications of non-compliance including disciplinary action.

Clause 8.2 due diligence applies to projects and activities, business relationships, and persons in control positions; it must be updated at defined intervals based on risk.

Clause 8.5 requires financial controls: segregation of duties, approval thresholds, records of payments, and controls over off-book accounts and improper payments.

Clause 8.6 requires non-financial controls over procurement, operational and commercial processes, including approval of contracts and control over subcontractors and suppliers.

Clause 8.7 requires the organization to ensure controlled organizations and persons it controls comply with the ABMS; where it cannot, it must assess the risk and document the outcome.

Clause 8.8 requires anti-bribery commitments in contracts with business relationships where the bribery risk is more than low, and from controlled organizations where practicable.

Clause 8.9 requires a confidential reporting procedure, accessible to all workers and, where practicable, to third parties, that prohibits retaliation against good-faith reporters.

Clause 8.10 requires documented investigation procedures, investigators free from conflict of interest, and confidentiality of investigations; results are reported to the compliance function and governing body as appropriate.

Clause 9.1 requires monitoring, measurement, analysis and evaluation of ABMS performance, with documented evidence of results and of what is monitored and at what frequency.

Monitoring indicators commonly include number of due diligence reviews completed, gifts and hospitality approvals, training completion, concerns raised, investigations opened and their outcomes.

Clause 9.2 requires an internal audit programme planned by importance of processes and prior results, with auditors who do not audit their own work and results reported to relevant management.

Clause 9.3 management review inputs include audit results, monitoring results, investigation outcomes, risk assessment updates, and performance against anti-bribery objectives.

Management review outputs must include decisions on improvement opportunities, resource needs, and any need to update the bribery risk assessment or the ABMS.

Evaluation must include the effectiveness of controls in business relationships, including whether due diligence findings were acted upon and whether contracts contain required anti-bribery clauses.

Performance evaluation must be documented; absence of records of monitoring and measurement is a common nonconformity at certification audit.

Clause 10.1 requires the organization to continually improve the suitability, adequacy and effectiveness of the ABMS, not merely correct individual failures.

Clause 10.2 requires reacting to nonconformity, evaluating the need for corrective action to eliminate root causes, implementing it, reviewing its effectiveness, and retaining documented information.

Corrective action is distinct from immediate containment: containment addresses the symptom, corrective action addresses the cause and must be verified for effectiveness.

Improvement inputs include internal audit findings, investigation outcomes, monitoring trends, management review decisions, changes in law, and changes in the bribery risk landscape.

Root-cause analysis tools acceptable in practice include 5-why analysis and cause-and-effect analysis; the chosen method should be documented with the corrective action record.

Changes to the ABMS must be managed so that they do not create new bribery risk; clause 6.3 requires considering purpose, consequences and resource needs before change.

Effectiveness of improvement is evidenced by trend data: for example, a decline in repeat findings or in high-risk due diligence gaps after corrective action.

Certification is performed by an accredited certification body; the certification body assesses conformity to ISO 37001 but does not certify that the organization is free of bribery.

Typical certification cycle: application and contract, Stage 1 (readiness and documentation review), Stage 2 (implementation effectiveness), then surveillance audits in years 1 and 2 and recertification in year 3.

Stage 1 assesses ABMS documentation, scope, risk assessment, internal audit and management review readiness; significant gaps can postpone Stage 2.

Stage 2 assesses implementation and effectiveness through interviews, sampling of records, site visits and observation of operational controls.

Pre-audit preparation includes completing at least one full internal audit cycle and one management review, since both are prerequisites auditors verify before Stage 2.

The audit programme must cover the full scope, including remote sites and high-risk business relationships, and audit evidence must be retrievable and traceable to clauses.

Nonconformities are graded major or minor; a major nonconformity normally requires correction and verification before certification is granted.

Audit duration and sampling depend on the number of effective personnel, the complexity of activities and the assessed bribery risk, per the certification body's accredited procedures.