ISO 37001 LI key terms

Offering, promising, giving, authorizing, requesting, agreeing to receive, or accepting an undue advantage of any value, directly or indirectly, to influence someone's actions in breach of duty.

Anything of value, whether financial or non-financial, that a recipient is not lawfully or properly entitled to and that is intended to improperly influence conduct or decisions.

A small payment made to secure or speed up a routine action a public official is already obliged to perform; many organizations prohibit these entirely even where local law tolerates them.

A person holding a legislative, executive, administrative, or judicial office, or exercising a public function, including employees of state-owned enterprises and international organizations, whether elected or appointed.

A structured set of interrelated policies, processes, controls, and responsibilities an organization uses to prevent, detect, and respond to bribery and to comply with applicable anti-bribery obligations.

A documented statement of the organization's commitment to prohibit bribery, setting out principles, expectations for personnel and business partners, and consequences for non-compliance.

The visible, consistent signals from governing bodies and top management that bribery is unacceptable, expressed through decisions, resourcing, and personal conduct rather than written statements alone.

The shared norms, attitudes, and behaviours within an organization that make bribery socially unacceptable and make raising concerns safe and expected.

The person or group with ultimate authority and accountability for the organization's strategy, activities, and compliance, such as a board of directors, which oversees the anti-bribery management system.

The person or group directing and controlling the organization at the highest level, responsible for establishing, resourcing, and integrating the anti-bribery management system into business processes.

The internal and external issues, interested parties, legal obligations, and business circumstances that are relevant to the organization's purpose and affect its ability to achieve anti-bribery objectives.

A person or organization that can affect, be affected by, or perceive itself to be affected by the organization's anti-bribery decisions or activities, such as employees, clients, regulators, and communities.

The documented boundaries of the management system, defining which functions, locations, entities, activities, and relationships are covered, with justification for any exclusions.

A documented, periodically repeated process that identifies bribery risks relevant to the organization, analyses their likelihood and impact, and evaluates whether they require treatment.

The combination of the likelihood that a bribery event occurs in a given activity, location, or relationship and the severity of the resulting legal, financial, and reputational consequences.

The level of bribery risk that exists before any controls are applied, used as a starting point for deciding where controls are most needed.

The bribery risk that remains after existing controls have been applied, which the organization compares against its risk criteria to decide whether further action is required.

The selection and application of measures to modify bribery risk, such as avoiding an activity, adding controls, transferring exposure, or consciously accepting the risk within approved tolerance.

A named person with the authority and accountability to manage a specific bribery risk and the effectiveness of the controls applied to it.

A measure, procedure, or safeguard designed to prevent, detect, or respond to bribery, applied in proportion to the assessed risk of the activity it covers.

Risk-based investigation and evaluation of the integrity, ownership, and bribery exposure of a proposed transaction, project, activity, business partner, or personnel appointment before commitment.

Proportionate checks on agents, consultants, intermediaries, suppliers, and joint venture partners to confirm they do not present an unacceptable bribery risk before engagement and during the relationship.

An external party with which the organization has or plans a business relationship, including contractors, suppliers, agents, consultants, and joint venture or consortium partners.

A log recording offered and received gifts, hospitality, and similar benefits above defined thresholds, enabling review for legitimacy, approval, and consistency with policy.

A situation where a person's private interests, relationships, or outside activities could improperly influence their judgement in performing their role, requiring disclosure and management.

A confidential channel, often allowing anonymous reporting, through which personnel and others can raise suspected or suspected bribery concerns without fear of retaliation, and receive feedback on follow-up.

Measures that prevent retaliation, dismissal, or other detriment against a person who reports a bribery concern in good faith, including safeguards during and after investigation.

The principle and practice that no one who declines to pay a bribe, raises a concern, or cooperates with an investigation may be penalized, demoted, or otherwise disadvantaged for doing so.

The person or team assigned authority to oversee the design, operation, and monitoring of anti-bribery controls, advise personnel, and report on the system's performance to top management.

Measurable, monitored targets set for relevant functions and levels that translate the anti-bribery policy into concrete, time-bound outcomes consistent with the policy.

Ongoing, planned observation and checking of controls and processes to determine whether they are operating as intended and producing the expected anti-bribery outcomes.

The determination of quantitative or qualitative values for anti-bribery performance indicators, such as training completion rates, due diligence coverage, or reported concerns.

An independent, objective, systematic examination of the anti-bribery management system to determine whether it conforms to the organization's requirements and is effectively implemented and maintained.

The planned arrangements for a set of audits, specifying frequency, methods, responsibilities, and scope, taking account of the importance of processes and previous audit results.

The set of requirements, policies, or standards against which audit evidence is compared to determine conformity, such as the standard's clauses and the organization's own procedures.

Records, statements of fact, or other verifiable information that an auditor collects and evaluates against audit criteria to reach audit findings and conclusions.

The result of evaluating collected audit evidence against audit criteria, commonly expressed as conformity, nonconformity, or an observation needing attention.

A failure to meet a requirement, whether a clause of the standard, a legal obligation, or the organization's own anti-bribery procedure, which must be recorded and addressed.

Action taken to eliminate the cause of a detected nonconformity so that it does not recur, including root cause analysis, implementation, and verification of effectiveness.

The recurring activity of enhancing anti-bribery performance by learning from monitoring results, incidents, audits, and changing risks, and by adjusting the management system accordingly.

A planned, periodic evaluation by top management of the anti-bribery management system's suitability, adequacy, and effectiveness, resulting in decisions on improvement and resources.

An independent assessment by a certification body that determines whether the organization's anti-bribery management system conforms to the standard and is effectively implemented.

The initial certification audit phase that reviews documented information and readiness to plan the detailed on-site evaluation, highlighting areas of concern for stage two.

The certification audit phase that evaluates implementation and effectiveness of the management system through sampling of evidence, interviews, and observation of controls in operation.

A document listing the anti-bribery controls the organization applies, with justification for inclusion or exclusion and reference to how each is implemented.