Implementation of an ABMS based on ISO 37001
What this domain tests
The largest operational domain: Clause 7 (support) and Clause 8 (operation). Expect scenario questions asking which control applies and whether it is adequate.
Support (Clause 7)
Resources, competence, awareness and training, communication, and documented information. Training must be risk-based and role-based: procurement, sales, customs-facing staff and the ABCF need different content from back-office staff. Records of attendance and assessment are evidence.
Operation (Clause 8)
- Due diligence (8.2) on business associates and on transactions or projects assessed as higher risk. It is a process, not a one-off onboarding form: refresh at defined intervals and on trigger events.
- Financial controls (8.3): segregation of duties, approval limits, accurate books, no off-book or secret accounts, controls over cash and third-party payments.
- Non-financial controls (8.4): procurement, hiring, conflicts of interest, and other non-financial selection and approval decisions.
- Anti-bribery commitments (8.5): contracts with business associates should require them to commit to equivalent controls, with audit or termination rights.
- Gifts, hospitality, donations and similar benefits (8.6): defined thresholds, prior approval, a register, and a prohibition where the benefit is or could be perceived as bribery.
- Managing inadequacy of controls (8.7): when a control cannot prevent or detect bribery, act - strengthen it, compensate, or stop the activity.
- Raising concerns (8.8): confidential channels, protection from retaliation, and a route to escalate.
- Investigating and dealing with bribery (8.9): a defined process, competent investigators, documented outcomes and consistent consequences.
Worked example
A distributor asks for a large cash "marketing support" payment before a tender. Adequate response: complete due diligence, refuse cash, require a contract and invoice, pay only to the distributor's named bank account, obtain ABCF approval, and if the request persists, escalate and consider termination. The reasoning is that the payment structure, not the stated purpose, is the red flag.
Traps
Due diligence only at onboarding; "tick-box" online training with no role targeting; a whistleblowing line with no non-retaliation provision; a gift register with no thresholds or approvals; treating Clause 8.7 as optional.