Compliance Function Independence in a High-Risk Bid Pipeline

The main weaknesses are structural, not clerical. First, the compliance officer reports to the General Counsel, who chairs the commercial approvals committee. That creates a conflict: the same function that should independently challenge a high-risk agent appointment is embedded in the commercial approval chain. Second, the CEO can approve 'strategic exceptions' without a documented bribery risk assessment, due diligence evidence, or compliance review. This suggests the exception route bypasses the ABMS rather than being a controlled, risk-based decision. Third, the compliance officer lacks direct access to the board and cannot block payments, so authority does not match responsibility.

The 2025 revision places stronger emphasis on top-management accountability, compliance-function independence, authority, and governing-body oversight. An auditor will look for evidence that compliance can act independently and that senior management cannot override controls without documented justification and compensating controls. 'Tightening paperwork' after the fact would not fix the decision rights. The ABMS manager should recommend a direct compliance reporting line to the audit committee or board, a formal veto or escalation right over high-risk agent appointments, and a documented exception process requiring risk assessment, compliance recommendation, and board-level approval. The two prior approvals need retrospective review because they may already represent unmanaged bribery risk.

The revised model should separate commercial sponsorship from compliance assurance. The business unit may propose an agent, but compliance should own the risk assessment and due diligence review. No agent should be appointed or paid until compliance has signed off on the due diligence, contract terms, and payment controls. Exceptions should require a written risk assessment, identification of compensating controls, compliance recommendation, and approval by the board audit committee or a delegated subcommittee, not by the CEO alone. The compliance officer should report functionally to the board audit committee, with a dotted line to executive management, and should have unrestricted access to records and the authority to suspend payments.

For the two existing approvals, the ABMS manager should not simply rewrite the files. First, freeze further payments pending review. Second, commission enhanced due diligence on both agents: ownership, government connections, services actually delivered, fee benchmarking, and bank account verification. Third, assess whether the commissions were legitimate or whether they created a bribery risk. If red flags cannot be resolved, terminate or suspend the agents and consider remediation or disclosure as advised by legal counsel. Document the retrospective review, the rationale, and any board decisions. This demonstrates that the revised governance model is operating, not just documented.

The auditor will want evidence of operation over time. Useful evidence includes revised board and committee terms of reference showing compliance's reporting line and authority; board minutes approving the new decision rights; an updated delegation-of-authority matrix; the exception log with risk assessments and approvals; samples of agent files showing compliance review before appointment; payment records showing compliance holds or blocks; and internal audit or compliance monitoring reports testing the new controls. The ABMS manager should also include training records for bid and commercial staff, communications from the CEO supporting compliance independence, and evidence that the two legacy approvals were reviewed and resolved. A culture survey or staff interviews can support tone-at-the-top evidence, but the strongest proof is transaction testing: pick several agent appointments and show that the new steps were followed. The auditor is testing whether the governance body actually exercises oversight and whether compliance can say no.