ISO 37001 requirements for an anti-bribery management system
This domain tests clause-level knowledge of ISO 37001:2016: the architecture of clauses 4–10 and the requirements auditors examine, above all the operational controls of clause 8.
Clause architecture
Clause 4 context (4.5 is the bribery risk assessment), 5 leadership and policy, 6 planning and objectives, 7 support (resources, competence, awareness, communication, documented information), 8 operation, 9 performance evaluation, 10 improvement. The sequence follows the harmonized management-system structure.
Leadership
Top management sets an anti-bribery policy that prohibits bribery, fits the organization’s purpose, commits to applicable anti-bribery requirements and continual improvement, and is documented, communicated and available to business associates. The anti-bribery compliance function needs direct access to top management and the governing body, adequate authority and resources, and involvement in significant bribery-risk decisions.
The operational core, clause 8
- 8.2 due diligence on business associates, and on personnel for specific projects, proportionate to risk and refreshed periodically
- 8.3 financial controls: approvals, segregation of duties, no off-book or secret accounts, accurate records
- 8.4 non-financial controls: procurement, donations, sponsorship, political contributions, facilitation payments
- 8.5 controlled organizations and business associates; 8.6 anti-bribery commitment in contracts
- 8.7 gifts, hospitality and similar benefits; 8.8 managing inadequacy of anti-bribery controls
- 8.9 raising concerns confidentially, without retaliation; 8.10 investigating and dealing with bribery
Worked example
A company needs a local agent to bid for a public tender in a high-risk country. The risk assessment flags public procurement and intermediaries. Due diligence examines the agent’s ownership, reputation and political connections; the contract carries an anti-bribery commitment and termination rights; commission is market-based, not a success fee; payments go to an account in the agent’s own name, never cash; the relationship is re-assessed periodically. If the agent refuses the commitment, the inadequacy is recorded under 8.8, the risk reassessed, and the engagement may be declined.
Traps that cost marks
- Treating the bribery risk assessment as a one-off exercise.
- Limiting due diligence to suppliers, or to onboarding only.
- Merging 8.2 due diligence with the 8.6 contractual commitment.
- Assuming a signed policy satisfies the operational clauses.