PECB ISO 37001 Foundation cheat sheet

Bribery is defined as offering, promising, giving, accepting, or soliciting an undue advantage of any value (financial or non-financial), directly or indirectly, as an inducement or reward for an improper action or omission.

ISO 37001 is a certifiable management-system standard built on the ISO High-Level Structure (HLS), so it shares clause 4-10 numbering with ISO 9001 and ISO 27001 and integrates via PDCA: Plan (clauses 4-7), Do (8), Check (9), Act (10).

An ABMS is a set of interrelated policies, processes, and controls that an organization uses to prevent, detect, and respond to bribery; it is a governance system, not a single document or a one-time training event.

Key risk concepts: bribery risk is the combination of likelihood and consequence of bribery occurring; risk assessment is risk-based, not a generic checklist, and must consider country, sector, transaction, and business-partner factors.

Distinguish bribery from facilitation payments (small payments to speed up a routine action a public official is already obliged to perform) and from extortion, where the payer is under duress; ISO 37001 requires organizations to prohibit or control facilitation payments.

Third-party risk is central: the standard requires due diligence before committing to a business associate and ongoing monitoring, because bribery is frequently channelled through intermediaries, agents, and consultants.

Management-system elements are interdependent: leadership commitment, a bribery-prevention policy, defined roles, due diligence, financial and non-financial controls, training, reporting channels, and monitoring/review must all operate together.

Certification is available but not mandatory; an organization may self-declare conformity. Certification confirms the ABMS conforms to ISO 37001, not that the organization is bribery-free.

Clause 4 (Context): determine external and internal issues, identify interested parties and their requirements, define the ABMS scope, and establish the ABMS processes.

Clause 5 (Leadership): top management must demonstrate commitment, establish a bribery-prevention policy, and assign roles and responsibilities; a bribery-prevention compliance function with direct access to top management is required.

Clause 6 (Planning): identify and assess bribery risks, identify legal and other requirements, set objectives, and plan actions to address risks and opportunities; the risk assessment must be documented and periodically reviewed.

Clause 7 (Support): requires resources, competence, awareness and training, communication, and documented information control; due diligence on business associates is a documented-information requirement.

Clause 8 (Operation): covers operational planning and control, due diligence on business associates, financial controls, non-financial controls, implementation of anti-bribery controls for business associates, reporting, and investigation.

Clause 9 (Performance evaluation): requires monitoring, measurement, analysis, and evaluation; internal audit of the ABMS; and management review by top management at planned intervals.

Clause 10 (Improvement): requires handling nonconformities and corrective actions, and continual improvement of the ABMS; root-cause analysis is expected, not just fixing the symptom.

Documented information requirements include the ABMS scope, policy, risk assessment, due diligence, training records, investigation reports, audit results, and management review outputs.