Initiation of an ABMS implementation
What this domain tests
Initiation covers the decision, mandate and architecture that make the rest of the project possible. In ISO 37001 terms it maps mainly to Clause 4 (context, interested parties, scope) and Clause 5 (leadership, policy, roles, responsibilities and authorities).
Mandate and governance
Top management issues a formal decision to establish the ABMS, appoints a project sponsor and lead, and reserves budget. The governing body's oversight role is defined early, not after procedures exist. The anti-bribery compliance function (ABCF) should not be an afterthought: it needs authority, adequate resources, and a reporting line giving it direct access to the governing body and top management. Where the ABCF also holds operational roles, independence must be considered and documented.
Context and scope
Clause 4 requires determining external and internal issues, the relevant needs of interested parties (regulators, customers, banks, investors, joint-venture partners, employees), and the scope of the ABMS. Scope must be documented; where activities are excluded, the exclusion must be justified and must not mislead users. Certification scope follows the ABMS scope, so a narrow scope limits what a certificate actually covers.
Gap analysis and plan
Compare current arrangements against Clauses 4–10, run a first high-level bribery risk assessment to prioritise, then build a plan with milestones, owners and evidence requirements.
Worked example
A 900-person engineering firm wants certification within nine months. A defensible sequence is: mandate → scope → gap analysis → risk assessment → policy and ABCF appointment → procedures → training → internal audit → management review → certification. The reasoning is that procedures written before the risk assessment tend to be generic and fail proportionality; and scope must precede the gap analysis, because the gap is measured against what is in scope.
Traps
Starting with procedure templates; appointing an ABCF without authority or resources; setting scope to exclude the highest-risk subsidiaries; treating the project as a documentation exercise with no owner at top-management level.