Expanded Due Diligence and Improved Whistleblower Protections
This domain tests the expanded due-diligence provisions and the improved whistleblower protections in ISO 37001:2025. Questions often present a transaction, a new business associate or a report of suspected bribery, then ask what a risk-based ABMS should require.
Due diligence: wider scope, ongoing duty
- Due diligence is risk-based and applies before and during relationships with third parties and business associates, and in transactions, projects and activities. It is not limited to supplier onboarding.
- “Business associates” includes agents, consultants, contractors, suppliers, distributors, joint-venture partners and other parties that can act for or on behalf of the organization.
- The depth of due diligence should match the bribery risk: ownership, reputation, beneficial ownership, government links, payment routes, red flags and the ability to control the relationship.
- If due diligence cannot be completed, the organization should escalate, apply additional controls or decline the relationship or transaction. Records should show the rationale.
- For mergers, acquisitions and investments, due diligence should happen before commitment where possible, with post-closing integration and monitoring of legacy risk.
Whistleblower protections and safe channels
- Reporting channels should allow confidential reporting; anonymous reporting should be permitted where legal and practicable.
- Whistleblowers must be protected from retaliation. Protection is not just a policy statement: it requires accessible channels, awareness, triage, investigation and monitoring of outcomes.
- Reports should be able to reach the compliance function or governing body when normal management is implicated.
Worked example
An employee reports that a sales manager is paying a government official through an agent. The line manager is a friend of the sales manager. Reasoning: the channel must offer an alternative route, such as compliance or an ethics hotline, with confidentiality and no retaliation. The report should trigger risk-based investigation, due diligence review of the agent and, if needed, suspension of payments. A policy that only says “report to your manager” is inadequate.
Traps that cost marks
- Limiting due diligence to initial onboarding.
- Treating whistleblowing as an HR grievance only.
- Failing to protect reporters or permitting retaliation.
- Not documenting due-diligence decisions and red flags.
- Assuming low-risk relationships need no monitoring.