ISO 37001 LI flashcards

36 cards. Read the term and the definition here. The deck at the top of this page is optional.

Bribery definition

Offering, promising, giving, accepting or soliciting an undue advantage of any value, directly or indirectly, in violation of applicable law, as an inducement or reward for an act or omission in the performance of duties.

Active versus passive bribery

Active bribery is offering, promising or giving the undue advantage; passive bribery is requesting, agreeing to receive or accepting it. ISO 37001 addresses both sides within its scope.

ABMS definition

A set of interrelated or interacting elements of an organization used to establish anti-bribery policies and objectives and processes to achieve those objectives, including governance, risk assessment, controls and evaluation.

Proportionality principle

Anti-bribery controls and procedures must be reasonable and proportionate to the bribery risk the organization faces, so control depth scales with assessed risk rather than being uniform for all activities.

Annex SL structure

The common high-level clause structure for ISO management system standards: clauses 4 to 10 covering context, leadership, planning, support, operation, performance evaluation and improvement, enabling integration across standards.

Third-party bribery exposure

Bribery risk arising when intermediaries, agents, consultants, joint venture partners or suppliers offer or receive advantages on the organization's behalf, requiring due diligence and contractual controls proportionate to that risk.

Scope of ISO 37001

Applies to bribery in public, private and not-for-profit sectors, domestic and foreign, and to bribery by or against the organization or its personnel and business relationships; it excludes fraud and competition offences as such.

Context of the organization

Clause 4 requirement to determine external and internal issues relevant to purpose and direction, and interested parties with relevant requirements, as the basis for designing the anti-bribery management system.

ABMS scope statement

A documented statement of the activities, functions, locations and controlled entities covered by the anti-bribery management system, available to interested parties and justified by the organization's bribery risk profile.

Gap analysis purpose

A structured comparison of current practices against ISO 37001 clauses 4 to 10, producing the baseline that drives implementation priorities, resource estimates, timelines and the initial risk assessment.

Compliance function appointment

Clause 5.3.2 requires assigning responsibility and authority for the ABMS to a person or function with independence, resources and direct access to the governing body where needed.

Interested party register

A documented list of parties relevant to the ABMS, such as regulators, customers, employees, agents and investors, with their relevant anti-bribery requirements and how the organization addresses them.

Implementation project plan

The initiation output that converts gap analysis results into sequenced tasks with named owners, deadlines, resources and dependencies, covering policy, risk assessment, controls, training and evaluation.

Bribery risk assessment

Clause 4.5 requirement for a documented, repeatable assessment identifying bribery risks the organization can control or influence, using likelihood and impact, reviewed at planned intervals and on significant change.

Risk treatment options

The four responses to assessed bribery risk: avoid the activity, mitigate through controls, transfer through contracts or insurance, or accept residual risk at an authorized level with documented justification.

Anti-bribery policy content

Clause 5.2 requires a documented policy prohibiting bribery, committing to satisfy applicable requirements, providing a framework for objectives, and communicated to all persons working under the organization's control.

Anti-bribery objectives

Clause 6.2 requires measurable objectives consistent with the policy, monitored and communicated, with plans specifying what will be done, resources, responsible person, timeframe and evaluation of results.

Risk-based due diligence planning

Clause 8.2 requires due diligence depth on projects, activities, business relationships and control persons to be determined by assessed bribery risk, with defined triggers for updating the assessment.

Gifts and hospitality controls

Clause 8.4 requires rules and approval thresholds for gifts, hospitality, donations and similar benefits so that they are not used to obtain undue advantage, with registers or records as evidence.

Anti-bribery training requirement

Clause 7.2 requires training for persons whose work poses bribery risk and for the compliance function, appropriate to roles and risk, with records retained as evidence of completion and content.

Financial controls clause

Clause 8.5 requires controls over financial transactions, including segregation of duties, approval levels, accurate records and prohibition of off-book or improperly recorded payments and accounts.

Non-financial controls clause

Clause 8.6 requires controls over procurement, commercial and operational processes, such as supplier approval, contract review and oversight of subcontractors, proportionate to assessed bribery risk.

Controlled organizations clause

Clause 8.7 requires the organization to ensure entities it controls implement the ABMS requirements, or where it cannot, to assess the resulting bribery risk and document the assessment outcome.

Anti-bribery contract clauses

Clause 8.8 requires anti-bribery commitments in contracts with business relationships where bribery risk is more than low, and with controlled organizations where practicable, allowing termination for breach.

Raising concerns procedure

Clause 8.9 requires a confidential reporting channel for workers and, where practicable, third parties, with protection against retaliation for good-faith reports and advice on how to report.

Investigation procedure

Clause 8.10 requires documented processes for investigating suspected bribery, investigators without conflicts of interest, confidentiality, and reporting of outcomes to the compliance function and governing body.

Monitoring and measurement

Clause 9.1 requires determining what to monitor, methods, timing and who analyses results, with documented evidence, covering both control operation and progress toward anti-bribery objectives.

Internal audit programme

Clause 9.2 requires planned audits at defined intervals, considering process importance and prior results, with objective auditors who do not audit their own work and results reported to management.

Management review inputs

Clause 9.3 inputs include audit and monitoring results, investigation outcomes, risk assessment status, changes in issues and interested-party requirements, and performance against anti-bribery objectives.

Corrective action verification

Clause 10.2 requires reviewing and verifying that corrective action eliminates the root cause of a nonconformity, with documented evidence of the action taken and of its effectiveness.

Continual improvement requirement

Clause 10.1 requires ongoing enhancement of ABMS suitability, adequacy and effectiveness, driven by evaluation results, changing bribery risk and management review decisions rather than only by fixing failures.

Stage 1 certification audit

The first certification body assessment, reviewing ABMS documentation, scope, risk assessment and readiness of internal audit and management review, to decide whether Stage 2 can proceed.

Stage 2 certification audit

The certification body assessment of implementation and effectiveness, using interviews, record sampling and site observation to verify conformity across the full scope before certification is granted.

Surveillance audit cycle

Post-certification audits typically conducted annually in years one and two, with recertification in year three, confirming continued conformity and effective correction of nonconformities.

Major nonconformity

An audit finding that affects the ABMS's ability to achieve intended results or indicates a significant control failure; correction and verification are normally required before certification.

Audit duration factors

Certification audit time depends on the number of effective personnel, complexity and variety of activities, sites, and assessed bribery risk, determined by the accredited certification body's procedures.