PECB ISO 37001 Transition flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Anti-bribery management system

The set of interrelated policies, processes, controls, and governance arrangements an organization uses to prevent, detect, and respond to bribery, structured to the requirements of ISO 37001.

Bribery definition

Offering, promising, giving, accepting, or soliciting an undue advantage of any value, directly or indirectly, in violation of applicable law, intended to influence someone's conduct.

Undue advantage

Anything of value, financial or non-financial, that the recipient is not lawfully entitled to and that is offered to improperly influence a decision or action.

Public official

A person holding a legislative, administrative, or judicial office, or exercising a public function, including employees of state-owned or public international organizations.

Business associate

An external party the organization has or plans a business relationship with, such as an agent, consultant, supplier, contractor, joint venture partner, or intermediary.

Bribery risk assessment

A documented process to identify, analyze, and evaluate bribery risks the organization faces, then determine treatment, reviewed when significant changes occur.

Risk-based approach

Proportionality principle under which the depth of controls, due diligence, and monitoring applied to a party or activity matches its assessed bribery risk.

Anti-bribery policy

Top-level documented statement of the organization's prohibition of bribery, commitments, and expectations of personnel and business associates, communicated and applied across the organization.

Scope of ABMS

The documented boundaries and applicability of the anti-bribery management system, reflecting the organization's context, activities, and bribery risks it must address.

Governing body oversight

The board or equivalent body's explicit duty to oversee the ABMS, ensure adequate resources, and stay informed of bribery risk and significant incidents.

Top management commitment

Demonstrated, active leadership of the ABMS through decisions, resourcing, communication, and personal engagement, not merely signing the anti-bribery policy.

Compliance function independence

The arrangement ensuring anti-bribery personnel have authority, access, and reporting lines, including to the governing body, free from improper commercial pressure.

Anti-bribery culture

The shared norms and behaviors that make bribery unacceptable in practice, evidenced by reporting willingness, incentives, and conduct rather than by policy text alone.

Management review inputs

Specified information considered at planned intervals, such as audit results, risk changes, incident trends, and monitoring data, to judge ABMS suitability and effectiveness.

Roles and authorities

Assigned, documented, and communicated responsibilities for anti-bribery across the organization, clarifying who decides, who monitors, and who reports.

Performance evaluation

Monitoring, measurement, internal audit, and management review activities used to determine whether the ABMS and its controls achieve intended anti-bribery outcomes.

Incentive alignment

Design of remuneration, promotion, and disciplinary systems so that bribery-related conduct is never rewarded and ethical decisions are not commercially penalized.

Harmonized structure

The common clause framework shared by ISO management system standards, which the 2025 revision applies, affecting clause numbering and integration with other systems.

Due diligence process

Risk-based gathering and evaluation of information about a party or transaction before commitment, documented to support a proceed, conditional, or decline decision.

Transaction due diligence

Bribery risk assessment applied to mergers, acquisitions, joint ventures, and investments before completion, with identified risks addressed in integration and post-completion controls.

Beneficial ownership check

Verification of who ultimately owns or controls a counterparty, used to detect concealed interests, politically exposed persons, and opaque ownership structures.

Third-party red flags

Warning signs such as disproportionate commissions, offshore payment routes, opaque ownership, or refusal of anti-bribery terms that require escalation before proceeding.

Continuous due diligence

Periodic refresh of due diligence triggered by risk-relevant changes such as new ownership, new markets, adverse media, or altered scope of the relationship.

Due diligence documentation

Retained records of checks performed, findings, risk rating, decision taken, and rationale, providing evidence that due diligence was proportionate and completed.

Contractual anti-bribery controls

Clauses in agreements such as anti-bribery representations, audit or access rights, and termination rights for breach, complementing due diligence on the counterparty.

Intermediary risk

Elevated bribery exposure when agents or consultants interact with officials on the organization's behalf, requiring deeper checks and closer monitoring.

Speak-up channel

A confidential route, permitting anonymity where lawful, through which personnel and business associates can report suspected bribery without fear of reprisal.

Good-faith reporting

Raising a concern honestly, even if later unsubstantiated, which qualifies the reporter for protection from retaliation and victimization.

Non-retaliation principle

The rule that no one may be dismissed, demoted, disciplined, or otherwise disadvantaged for reporting a concern or refusing to participate in bribery.

Investigation process

Documented steps for receiving, assessing, investigating, and closing reports, conducted by people not implicated in the matter, with outcomes recorded.

Reporter confidentiality

Protection of a reporter's identity to the extent permitted by law and consistent with a fair investigation, limiting disclosure to those who need it.

Channel effectiveness monitoring

Tracking indicators such as reports received, substantiation rates, and resolution times to judge whether reporting channels are trusted and working.