Planning of an ABMS implementation based on ISO 37001
What this domain tests
Planning is Clause 6: actions to address risks and opportunities, the bribery risk assessment, anti-bribery objectives, and controlled planning of changes. The exam tests whether you can design a defensible assessment method and connect it to objectives and controls.
Bribery risk assessment (6.1)
The assessment must be documented, repeated at planned intervals, and repeated when significant change occurs - a new country, a new agent, a merger, a new product line, a change in law. The method should identify risks by activity, location, sector, transaction type and business associate; analyse likelihood and impact; evaluate results against criteria you define; and determine treatment. Genuine risk factors include the corruption context of the country, intensity of government interaction (permits, customs, tax, inspections), use of intermediaries and their commission levels, cash payments, gifts and hospitality, donations and sponsorship, conflicts of interest, hiring of relatives of officials, and acquisitions.
Objectives (6.2)
Objectives must be consistent with the anti-bribery policy, measurable where practicable, monitored, communicated and documented. "Improve culture" is not an objective; "95% of high-risk business associates due-diligenced before contracting by Q4" is.
Planning of changes (6.3)
Changes to the ABMS are planned in a controlled way, with responsibilities and resources considered.
Worked example
A sales agent in a high-risk market receives a 15% commission on public-sector contracts, has never been due-diligenced and is paid into a third-party account. Likelihood and impact are both high, so the evaluated risk is high. Treatment: due diligence before renewal, contractual anti-bribery clauses and audit rights, payment only to an account in the agent's name, tiered approval of commissions, and targeted training. Each treatment is recorded with an owner and date, which also supplies evidence for the internal audit.
Traps
A one-off assessment; undocumented or subjective scoring; mixing internal audit findings into the risk assessment; objectives with no measurement; failing to re-assess after an incident or acquisition.