The 'Clinical Training Workshop' at a Public Hospital Tender
Kestrel Med sells imaging equipment to public hospitals. A regional health authority tender worth USD 9 million closes in ten days. The sales director proposes sponsoring a 'clinical training workshop' in Dubai for 14 clinicians and 3 procurement officers at USD 7,800 per head, covering business-class flights, a resort venue, two half-day sessions and three leisure days. The invitation emails were sent from the procurement officers' personal accounts. The distributor asks that the sponsor invoice be issued to the distributor rather than to the hospital. Separately, the sales director wants to approve a 22% 'volume rebate' backdated to the previous quarter to bring Kestrel's bid under the evaluation threshold, which he can do because he holds delegated authority to approve discounts up to 25%. Hospitality approvals rest with the sales director, and Kestrel's gift register has no thresholds and recorded nothing in the last financial year.
1. Is the Dubai workshop acceptable under ISO 37001's requirements on gifts, hospitality and donations? Set out the factors you would apply.
Read the worked answer
No. It fails the tests in clause 8.4.
Clause 8.4 requires documented procedures governing gifts, hospitality, donations and similar benefits so that they are reasonable, bona fide, lawful, and not offered or accepted to obtain an improper advantage. The assessment is contextual:
- Timing. The event falls inside a live tender, for decision-makers at the authority awarding it. This is the strongest single indicator.
- Recipients. Procurement officers who will evaluate Kestrel's bid, plus clinicians who influence specifications.
- Value and content. USD 7,800 per head, business-class travel, a resort venue, two half-day sessions against three leisure days - the clinical content is incidental to the destination.
- Transparency. Invitations from personal email accounts and an invoice routed to the distributor are indicators of concealment.
- Approval. The sales director, who is incentivised by the deal, decides; there are no thresholds and no register entries.
A useful benchmark: would the organisation be comfortable if the full itinerary, cost and attendee list were published, or released under procurement disclosure rules? Here, plainly not.
This does not prohibit all training support. A defensible alternative is a programme delivered at the hospital, open to all relevant staff, of modest value, approved by compliance rather than sales, and logged in the register.
Correct handling: reject the proposal, record the decision, and treat the personal-email and invoice-routing details as red flags requiring review of the distributor relationship.
2. Evaluate the backdated rebate and the invoice routing against the financial and non-financial control requirements.
Read the worked answer
Both are control failures, and the rebate is plainly improper.
The backdated rebate. The stated purpose - bringing the bid under the evaluation threshold - reframes a discount as a payment to influence the outcome of a public procurement. Two separate problems arise:
- Record integrity. Backdating a rebate misstates the period in which the transaction occurred. Financial controls (8.7) require transactions to be accurately and completely recorded, authorised at the right level, not concealed, and not routed through off-book or misleading entries.
- Approval authority. Delegated authority to approve discounts up to 25% is authority over price, exercised in the company's commercial interest. It is not authority to accept an anti-bribery risk. Where a transaction is red-flagged, approval must move to someone independent of sales who is accountable for the bribery risk and empowered to refuse.
The invoice routing. Invoicing the sponsorship to the distributor rather than the hospital obscures who received the benefit and who paid. Intermediaries must never be used to channel benefits to decision-makers, and this also engages due diligence on the distributor (8.2): a partner willing to front a concealed payment is itself a risk.
Practical answer: the rebate may only be approved on its commercial merits, in the correct period, by someone with authority over the bribery risk. The routed invoice cannot be issued at all. Both matters go to the compliance function and the CEO.
3. The gift register recorded nothing last year. What does that tell you, and what corrective action would you require?
Read the worked answer
An empty register is a finding, not a clean bill of health.
Clause 8.4 requires the procedures and their operation: thresholds, approval levels, a register of benefits given and received, and periodic review. The register exists, so the document is in place; nothing recorded in a year of selling capital equipment to public hospitals is implausible. There are two readings, both bad:
- Benefits are being given outside the system, so the register captures only what is declared; or
- The register is a formality and nobody reviews the underlying activity.
Either way, monitoring (9.1) is not detecting the pattern, and an auditor will test exactly this: not 'is there a register?' but 'does the recorded activity match how this business actually sells?'
Corrective action:
- Set thresholds and approval levels - modest hospitality pre-approved by line management; anything above a defined value or involving public officials requires compliance approval; anything during a live tender is prohibited.
- Require each entry to record recipient, employer, role, purpose, value and approver.
- Review the register quarterly against tender activity and the sales pipeline, and report exceptions to top management and the governing body.
- Train sales staff on why the rule exists, not just what it is (7.3); the proposals show the message has not landed.
- Extend the rule to indirect benefits given through distributors and agents - which is where this risk actually lives.
The corrective action should address the cause: delegated authority that lets a conflicted person approve a benefit to a decision-maker.