The 38-Person Freight Forwarder That Bought 92 Procedures
Vanterpol is a 38-employee freight forwarder with revenue of EUR 14 million, headquartered in Antwerp, with a six-person office in a high-risk country where customs clearance generates 40% of group profit. After losing a key client, the CEO bought a 92-procedure ABMS template from a consultancy. The procedures assume a five-person internal audit department, an ethics committee and a global whistleblowing platform; Vanterpol has none of these. The bribery risk assessment is the consultancy's oil-and-gas client's assessment with the names changed. Staff describe the system as 'paperwork', and the compliance officer is the part-time finance manager. The CEO wants to market the firm as 'ISO 37001 certified - bribery-proof', and proposes to exclude the overseas customs office from the ABMS scope because 'the certification is for European clients and the office is too small to matter'.
1. Can the overseas customs office legitimately be excluded from the scope of the ABMS?
Read the worked answer
No. The office cannot be carved out to make certification easier.
Clause 4.3 requires the scope of the ABMS to be determined and documented, considering the organisation's context (4.1), the requirements of interested parties (4.2), and its activities, functions and boundaries. The scope must describe what the organisation actually does.
The customs clearance office is part of Vanterpol: same legal entity, same personnel, same profit pool, and it generates 40% of group profit. Excluding it would exclude the highest bribery risk in the business. ISO 37001 does not permit that, and a certification body would not accept it. The resulting certificate would misdescribe the organisation's boundaries - a misrepresentation to exactly the clients whose reassurance the CEO is seeking.
Where exclusion is legitimate: activities genuinely outside the organisation, such as an unrelated legal entity with no controlling relationship, or a function with no bearing on bribery risk. Where a relationship exists but control does not, the activity is not excluded - it is managed through due diligence and contractual controls (8.2).
If Vanterpol wants a narrower market-facing statement, the honest route is a clearly worded description of which parts of the business the certificate covers. That is a communication decision (7.4), not a scope exclusion.
Recommendation: include the overseas office. If it lacks controls, that is the finding to fix before the audit rather than hide behind scope.
2. Is the 92-procedure system a nonconformity? Assess it against the principle that controls must be reasonable and proportionate to bribery risk.
Read the worked answer
The problem is not the number of procedures - it is that they do not fit the organisation and are not used.
ISO 37001 deliberately expresses controls as 'reasonable and proportionate' to the organisation's bribery risk (4.5, 6.1). It prescribes no document count. The failures here:
- Risk assessment (4.5) was not performed by Vanterpol. It is another client's assessment with the names changed. A risk assessment must reflect the organisation's own activities, geography, third parties and transactions; copying it removes the basis on which every other control should be designed - which is why the procedures assume an audit department and ethics committee that do not exist.
- Documented information (7.5) that nobody can follow is not controlled information in any meaningful sense; availability and suitability are the point.
- Competence and awareness (7.2, 7.3): staff call the system 'paperwork'. That is direct evidence it is neither understood nor applied.
- Operational control (8.1): the controls that would actually matter for a forwarder - due diligence on customs brokers and agents, a ban on cash payments, approval of disbursements, red-flag review of clearance fees - are not visible.
Proportionality cuts both ways: a 38-person firm needs a system it can run. A pragmatic ABMS might consist of ten to fifteen controlled documents - policy, risk assessment, due diligence, gifts and hospitality, financial controls, raising concerns, investigation, training records, monitoring and corrective action.
The corrective action is a rebuild driven by a genuine risk assessment, not deletion of documents to reduce the count.
3. Can the CEO market the firm as 'ISO 37001 certified - bribery-proof'? Explain what certification actually attests.
Read the worked answer
No. Certification attests to a management system; it does not certify that the firm is free of bribery.
What certification means: an independent body has assessed that the ABMS conforms to ISO 37001 at the time of audit - policy, risk assessment, due diligence, controls, monitoring and corrective action. It is a statement about the system's design and implementation.
What it does not mean:
- that no bribery has occurred or will occur;
- that the organisation has a legal defence - certification may be relevant evidence of adequate procedures where such a defence exists, but it is not conclusive;
- that the risk assessment was sound or that controls are effective in every country of operation.
'Bribery-proof' is therefore a misrepresentation, and using a certification mark in a misleading way can also breach the certification body's rules on marks and claims. It sits badly with 5.2 (policy) and 7.4 (communication), which call for honest communication consistent with the policy.
A defensible claim is narrow and factual: 'Vanterpol operates an anti-bribery management system certified to ISO 37001 for [defined scope].' Note that this claim becomes harder to defend if the overseas office is excluded - the firm would be advertising a certificate that omits the area of greatest risk.
The underlying point for the CEO: the marketing objective is legitimate, but the shortcut undermines it. The credible route is a proportionate, functioning ABMS covering the whole business, followed by a factual claim.