PECB ISO 37001 Transition key terms

A structured set of policies, processes, roles and controls an organization uses to prevent, detect and respond to bribery, established and maintained according to ISO 37001 requirements.

Offering, promising, giving, accepting or soliciting an undue advantage of any value, directly or indirectly, to influence someone's actions improperly, regardless of location or outcome.

Anything of value, whether financial or non-financial, that a recipient is not legitimately entitled to and that is offered or received to obtain improper behaviour or influence a decision.

A small payment made to secure or speed up a routine action a person is already entitled to receive; ISO 37001 treats such payments as a form of bribery to be prohibited.

A documented process of identifying, analysing and evaluating bribery risks facing the organization, considering its activities, locations, sectors and third parties, and used to direct proportionate controls.

A maintained record listing identified bribery risks, their likelihood and impact ratings, existing controls, owners and planned treatment actions, reviewed at defined intervals.

A top-level documented statement prohibiting bribery in all forms, setting out the organization's commitments, scope, responsibilities and consequences of non-compliance, and communicated to all personnel and relevant third parties.

The principle that the type and depth of anti-bribery controls are proportionate to the assessed bribery risk of activities, transactions and relationships, so that higher-risk situations attract stronger measures.

Anti-bribery measures sized and designed to match assessed risk, ensuring effort is concentrated where bribery exposure is greatest rather than applying identical treatment everywhere.

The documented boundaries of the anti-bribery management system, defining which entities, locations, activities and relationships are covered, and justifying any exclusions with reference to bribery risk.

The internal and external factors, including legal, regulatory, cultural, sector and business conditions, that affect the organization's ability to achieve its anti-bribery objectives.

Persons or organizations that can affect, be affected by, or perceive themselves affected by bribery risk, such as employees, clients, regulators, owners and business associates.

The highest-level person or group with authority and accountability for the organization's strategic direction and oversight of the anti-bribery management system, including approving policy and monitoring effectiveness.

The person or group directing and controlling the organization at the highest operational level, responsible for integrating anti-bribery requirements into business processes and providing resources and leadership.

Demonstrated commitment by senior leaders to ethical conduct and anti-bribery compliance, expressed through decisions, communications, resource allocation and personal behaviour that set expectations for the whole organization.

The role or unit responsible for overseeing the design and operation of the anti-bribery management system, advising personnel, monitoring controls and reporting on performance to top management and the governing body.

The named individual with responsibility and authority to oversee the anti-bribery management system, including advising on risk, reviewing high-risk transactions and escalating concerns.

The condition in which anti-bribery oversight is free from conflicting operational duties and undue commercial pressure, with direct access to the governing body and authority to escalate concerns.

A risk-based process of gathering and evaluating information about a counterparty before and during a relationship to determine whether bribery risk is acceptable and what controls are needed.

Deeper investigation applied to higher-risk transactions or relationships, such as those involving public officials, high-risk jurisdictions or complex ownership, before approval and at defined review points.

Any external person or organization that provides services to or on behalf of the organization, or with whom it has a business relationship, and whose actions could create bribery risk.

An external party with whom the organization has or plans a business relationship, including contractors, suppliers, consultants, agents, joint venture partners and intermediaries, that may act for or represent it.

An external party engaged to act on the organization's behalf in dealings with others, such as an agent, consultant or representative, whose conduct can be attributed to the organization.

The identity of the natural persons who ultimately own or control a legal entity or arrangement, which must be identified during due diligence to reveal hidden bribery exposure.

A person entrusted with prominent public functions, or a close associate or family member of such a person, who presents elevated bribery risk and normally triggers enhanced due diligence.

A country or territory identified as presenting elevated bribery risk because of weak enforcement, corruption perception, conflict, sanctions or legal restrictions on foreign payments.

Bribery-focused review applied to proposed transactions such as mergers, acquisitions, investments and major contracts, assessing the counterparty, its owners and its conduct before commitment.

The exposure that an acquired or merged entity carries pre-existing or ongoing bribery liabilities, requiring pre-deal assessment, contractual protections and post-deal remediation and integration.

Rules and approval thresholds governing the offering and acceptance of gifts, meals, travel and entertainment, designed to prevent such benefits from becoming an undue advantage.

A situation where a person's private interests could improperly influence their judgement in an organizational role, requiring declaration, assessment and management to avoid bribery risk.

An organizational environment in which personnel and business associates feel safe and encouraged to raise bribery concerns promptly, without fear of retaliation, and trust that concerns will be addressed.

The act of reporting suspected bribery, misconduct or policy breaches internally or to an appropriate authority, which the organization must enable, protect and treat confidentially.

A communication route allowing concerns to be raised confidentially and, where permitted, anonymously, accessible to personnel and business associates, and free from obstruction or retaliation.

The commitment and controls that prevent anyone who raises a concern in good faith from suffering dismissal, demotion, harassment, exclusion or other detrimental treatment as a result.

A documented, impartial process for assessing reports of bribery, gathering evidence, determining findings and taking corrective action, conducted by competent persons free from conflicts of interest.

Action taken to eliminate the cause of a detected nonconformity or bribery incident and prevent recurrence, including remediation of harm and review of control weaknesses.

The ongoing process of enhancing anti-bribery performance by monitoring results, learning from incidents and audits, and adjusting the management system accordingly.

Systematic collection of data on whether anti-bribery controls operate as intended, using indicators, reviews and testing to evaluate performance and inform decisions.

An independent, objective review of the anti-bribery management system against requirements and planned arrangements, reporting findings to management and the governing body.

A periodic top-level examination of the anti-bribery management system's suitability, adequacy and effectiveness, using defined inputs and producing decisions on improvement and resources.