Who Owns the ABMS? Reporting Lines at a Defence Contractor
Norbury Systems, a 4,200-employee defence contractor, is preparing for its first ISO 37001 certification audit. Its six-person compliance team sits inside the legal department and reports to the General Counsel, who personally chairs the tender evaluation committee for a EUR 120 million ministry of defence award and signs off win/loss pricing decisions. The role designated as ABMS manager has been given to the head of internal audit, on the grounds that 'audit knows the system best'. The CFO chairs a risk committee that sets bribery risk appetite and receives all compliance indicators. Top management approved the anti-bribery policy in a one-line board minute and delegated 'all ABMS matters' to the compliance team without additional budget. The governing body receives no compliance reporting, and the action list from the last management review has been open for 14 months. Internal audit's plan for the current year does not include the ABMS.
1. Which requirements govern the independence and status of the compliance function, and does Norbury's arrangement conform?
Read the worked answer
It does not conform: the compliance function lacks the independence that clause 5.3.2 presumes.
Clause 5.3.1 requires top management to appoint a member of management with responsibility and authority for the ABMS, with direct access to the governing body. Clause 5.3.2 requires the compliance function to have the authority, resources and independence to operate, including access to personnel, records and premises, the ability to raise concerns with top management and the governing body, and no duties that conflict with its compliance role.
At Norbury the compliance team reports to the General Counsel, who chairs the tender evaluation committee and signs off pricing. Those are precisely the decisions the ABMS must be able to challenge. Independence does not require the function to sit outside the organisation - it requires that the person with ultimate compliance authority is not the same person whose commercial decisions are being overseen. A functional line to the CEO or the audit committee chair, with a reporting line to the board, would satisfy the requirement; the current line does not.
The budget position compounds the problem. A compliance function without resources cannot exercise the authority the standard assumes, and 'delegating all ABMS matters' without resourcing is delegation without power. An auditor would be expected to raise this as a nonconformity, likely major, against 5.3.1 and 5.3.2.
2. Is it acceptable for the head of internal audit to hold the ABMS manager role and also be responsible for auditing the ABMS?
Read the worked answer
No. One person cannot own the ABMS and audit it.
Clause 9.2 requires internal audits at planned intervals to determine whether the ABMS conforms to the organisation's own requirements and to ISO 37001, and whether it is effectively implemented and maintained. The audit programme must be planned, and auditors selected so that objectivity and impartiality are preserved. A person cannot audit their own work; the conflict is structural, not a matter of personal integrity.
Making the head of internal audit the ABMS manager has two consequences:
- The design and operation of the ABMS become the responsibility of the internal audit function, so any ABMS audit is self-assessment.
- Internal audit's independence - the source of its value to the governing body - is compromised for every future review, not just this one.
Organisation size does not change the principle. ISO 37001 permits internal audit to be outsourced or performed by a competent independent party, and in smaller organisations it is normal to use a different role or an external provider. And note that competence is a separate question: the justification given ('audit knows the system best') is exactly the reasoning that creates the conflict.
Fix: appoint a member of management other than the head of internal audit as the ABMS owner under 5.3.1, and keep the audit of the ABMS at arm's length from the compliance line.
3. What must the governing body and top management actually do, and what is the likely certification consequence of the current position?
Read the worked answer
Governing-body oversight is a requirement, not a formality.
Clause 5.1.2 requires the governing body to exercise reasonable oversight over the implementation of the ABMS and to receive information on its performance at planned intervals. In practice that means:
- approving the anti-bribery policy and a named, resourced owner of the ABMS;
- receiving regular reporting on bribery risk, incidents, investigation outcomes and monitoring results - not a one-line minute;
- overseeing the independence and resourcing of the compliance function;
- ensuring management review (9.3) produces decisions that are tracked to closure.
Top management (5.1.1) must ensure the ABMS is integrated into business processes, that resources are provided, and that the policy is communicated and followed.
Likely certification consequences: a major nonconformity for the absence of effective governing-body oversight and the conflicted reporting line, plus findings against corrective action (10.1) closed-loop discipline and management review (9.3). A major nonconformity normally blocks certification until corrected and verified. The 14-month open action list is direct evidence of ineffectiveness, which is what the auditor is testing - not whether a process exists on paper.