ISO 37001: Anti-Bribery Management in Practice
A practical overview of anti-bribery governance, risk assessment, due diligence, controls, reporting, monitoring and improvement.
Key Takeaways
- ✓Set clear anti-bribery policy, oversight and accountable owners.
- ✓Assess risk across operations and business relationships.
- ✓Apply proportionate due diligence, controls, training and reporting processes.
- ✓Investigate concerns impartially and track corrective actions.
- ✓A management system does not guarantee legal compliance or eliminate bribery risk.
Purpose
ISO 37001 addresses anti-bribery management systems. It provides a structured basis for organizations to establish policies, responsibilities and processes intended to prevent, detect and respond to bribery risks. Implementation should reflect the organization's context, relationships, jurisdictions and applicable legal obligations.
Build risk-based controls
Set leadership expectations, assign oversight and operational owners, and assess exposure across activities and business relationships. Apply proportionate due diligence, financial and non-financial controls, approval limits, gifts and hospitality rules, training, reporting channels and investigation procedures as appropriate. Include third parties and business partners in the risk approach, with clear escalation where risk or red flags exceed approved thresholds.
Monitor and respond
Retain evidence of risk assessments, due diligence, approvals, training, reports, investigations and corrective actions. Monitor exceptions, control operation, third-party dependencies and changes in exposure. Ensure reports can be raised without retaliation and that allegations receive an impartial, documented response. Use audit and management review to improve the system and address recurring causes.
Boundaries
A management system cannot guarantee that bribery will not occur or establish compliance with every anti-corruption law. Legal duties vary by jurisdiction and circumstance. Do not describe a certificate as proof that an organization or transaction is free of bribery risk.
Frequently asked questions
Does ISO 37001 guarantee that bribery will not occur?
No. It supports a management system for prevention, detection and response but cannot eliminate risk.
Should third parties be considered?
Yes. Assess business relationships proportionately and apply due diligence and controls based on exposure.
Does certification prove compliance with anti-corruption laws?
No. Legal compliance depends on applicable law, facts and evidence beyond a management-system certificate.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.
Related Content
COBIT 2019: Governance and Management of Information and Technology
COBIT 2019 helps design and tailor an enterprise governance and management system for information and technology to objectives and design factors.
COSO ICIF: Integrated Internal Control
COSO ICIF organizes internal control around objectives, components and principles to help assess whether controls are designed and operate as an integrated system.