The 'Community Liaison' Payment in a Port Expansion Tender
Meridian Infrastructure, a 900-person engineering firm headquartered in Rotterdam, is bidding for a USD 48 million port expansion contract in a country ranked 138th of 180 in Transparency International's Corruption Perceptions Index. Its local agent, Talal Trading LLC, has represented the firm for 11 years on a 3% success fee. Three weeks before submission, Talal's invoice includes a USD 60,000 line described as 'community liaison and site access facilitation', payable in cash to a named municipal official's brother-in-law, with no receipts. It is coded to business development and approved by the regional director, who notes that 'this is how the site has always been accessed and the contract is strategic'. Meridian has a CEO-signed anti-bribery policy, a one-page code of conduct, and no due diligence file on Talal beyond a copy of its trade licence. The CFO asks you whether this is a facilitation payment that a narrow policy exception could cover.
1. Is the USD 60,000 payment a facilitation payment under ISO 37001? Justify your conclusion against the elements of the definition.
Read the worked answer
No. On these facts it is a bribe, not a facilitation payment.
ISO 37001 defines a facilitation payment narrowly: a payment to a public official to expedite or secure performance of a routine governmental action to which the payer is legally entitled. All the elements must be present:
- Routine action. Site access in a competitive port tender involves discretionary decisions - selection, land allocation, permits - not a clerk stamping an already-approved document.
- Entitlement. Meridian has no legal right to access the site; it is competing for it.
- Purpose. The money is intended to influence the decision-maker, not to accelerate an administrative step.
- Scale and form. USD 60,000 in cash, with no receipt, is not the small 'grease' sum the concept contemplates.
The recipient is a relative of the decision-maker and the payment is routed through an agent. That is indirect bribery, which ISO 37001 covers as squarely as a direct payment. The hallmarks of concealment - cash, no receipt, a vague description - reinforce the reading.
Even if this had been a genuine facilitation payment, ISO 37001 requires organisations to prohibit them, allowing only a very narrow exception connected to imminent risk to life, health or safety, with subsequent reporting. Commercial pressure and 'it has always been done this way' are never justification.
The answer to the CFO: do not pay, do not approve the invoice, escalate to the compliance function.
2. Which ISO 37001 requirements does the Talal arrangement most directly engage, and what should have happened before the invoice was approved?
Read the worked answer
The engagement turns on due diligence on associated persons, operational control and financial controls.
- Due diligence (8.2). Talal is an associated person. Before and during the relationship Meridian must understand the arrangement (beneficial ownership, reputation, why an agent is needed at all), evaluate the bribery risk, and monitor. A trade licence confirms existence, not integrity.
- Escalation where concerns arise (8.2.3). Where due diligence cannot be completed or reveals risk, the organisation must consider whether to proceed, apply additional controls, or terminate. Unresolved questions about Talal's sub-agents should have stopped the invoice.
- Operational control (8.1). The agent's contract should carry anti-bribery commitments, audit and termination rights, and a rule that no payment leaves the company without substantiation.
- Financial controls (8.7). No cash disbursement without supporting documents, and no approval by a person with a commercial interest in the outcome. The regional director's signature is a control failure, not a control.
- Risk assessment (4.5) and awareness (7.3). Country and sector risk were known but never translated into controls; the director's comment shows the policy was not understood.
The correct sequence before approval: risk-based due diligence, a contract with anti-bribery terms, payment approval by someone independent of sales, red-flag review of the invoice, and a documented decision to reject it.
3. Meridian's anti-bribery policy is signed by the CEO and it has a one-page code of conduct. Does that satisfy the anti-bribery policy requirement? What would you check and change?
Read the worked answer
A CEO signature is not the test; implementation is.
Clause 5.2 requires a documented anti-bribery policy that prohibits bribery, is appropriate to the organisation's purpose and context, commits to meeting applicable anti-bribery requirements, commits to continual improvement, is communicated to personnel and (where appropriate) business associates, and is available to interested parties.
ISO 37001 does not prescribe length or structure, so a short policy is not inherently deficient and a one-page code is not automatically a substitute. The exam-relevant distinction is between having a policy and operating one. Two findings follow from the facts:
- The policy's central prohibition is contradicted in practice by a regional director with no consequence, no training and no link to approval authorities - nonconformity against 5.2 read with 7.3 (awareness) and 8.1 (operational control).
- Specific prohibitions are not reflected in procedures: no rule on facilitation payments, no agent-payment approval limits, no gift thresholds.
What to check and change: confirm the policy explicitly prohibits bribery in all its forms, states that facilitation payments are prohibited, states the compliance function's authority and independence, sets out consequences of breach, and applies to business associates. Then reissue it with training, add the missing procedures, and enforce the approval hierarchy so the document is matched by behaviour.