Continual improvement of an ABMS based on ISO 37001
What this domain tests
Clause 10: nonconformity and corrective action, and continual improvement. The exam distinguishes correction from corrective action, and tests whether improvement is a system rather than an annual event.
Nonconformity and corrective action (10.1)
When a nonconformity occurs - a control not implemented, a due diligence gap, an unreported incident - the organization must react (contain, correct, deal with the consequence), evaluate the need to eliminate the cause so it does not recur, implement the action, review its effectiveness, and update the bribery risk assessment if the change affects risk. Documented information is required for the nature of the nonconformity, actions taken and results.
Correction fixes the symptom; corrective action addresses the cause. Closing a ticket after a training record is re-filed without asking why records went missing is a correction only, and exam answers that stop there lose marks.
Continual improvement (10.2)
Improvement is ongoing and should draw on incidents and investigations, audit findings, monitoring data, management review outputs, changes in law and regulation, and trends in bribery typologies. Improvement concerns the suitability, adequacy and effectiveness of the ABMS, not just tidiness of documentation.
Worked example
Three gift-register breaches occur in one region in a quarter. Correction: record and review the gifts, remind the individuals. Root-cause analysis finds thresholds were unclear and culturally misread, and approval sat with a manager who was also the beneficiary's supervisor. Corrective action: publish local thresholds with examples, move approval to an independent role, deploy a simple approval tool. Effectiveness is verified by re-measuring breaches over the following two quarters and updating the risk assessment for that region.
Traps
Treating correction as corrective action; closing actions without verifying effectiveness; limiting improvement to the annual management review; failing to update the risk assessment after incidents or legal change; blaming individuals without addressing the control design.