Actions to Address Risks and Opportunities for ISO 37001 Anti-Bribery
ISO 37001 Clause 6.1
Planned actions to address risks and opportunities, with consideration of how to integrate them into the ABMS and evaluate their effectiveness.
ISO 37001 Clause 6.1 - Actions to Address Risks and Opportunities
Clause 6.1 requires the organisation to plan actions arising from the issues identified in Clauses 4.1 and 4.2 and the bribery risks and opportunities identified in 4.5. The actions have four purposes - to provide assurance that the ABMS can achieve its intended results, prevent or reduce undesired effects, achieve continual improvement and monitor the effectiveness of the ABMS.
The clause also requires the organisation to plan how to integrate and implement those actions into ABMS processes and how to evaluate the effectiveness of the actions taken. So actions are not just identified - they are tracked through to closure, and the effectiveness of what was done is reviewed.
Where the Actions Come From
Actions can come from several sources. The bribery risk assessment surfaces residual risks above tolerance that need additional controls. Due diligence reviews identify business associates that need further controls or termination. Internal audits raise non-conformities. Concerns reported through the bribery concerns route may identify control weaknesses. Management review identifies areas for continual improvement. The clause asks the organisation to plan actions in response to all of these and to integrate them into the running of the ABMS rather than treat them as a separate stream of work.
How Actions are Tracked
Most organisations use an issues and actions register - sometimes called an opportunities and risks register - as the central tool for this clause. The register lists each issue or risk, the action required, the owner, the target date, the actual date completed and a brief note on effectiveness review. The same register is used to track corrective actions arising from non-conformity (Clause 10.2) and audit findings (Clause 9.2), so the planning, doing and reviewing happens in one place.
The F-IMS34 Anti-bribery Compliance Register sits above the action register at a higher level. It captures the periodic review of the ABMS as a whole and the high-level themes that need attention. The detailed action tracking happens in the issues and actions register.
Plan actions for the residual risks that sit above tolerance after existing controls. Plan opportunities for things you could do better. Track both in the same register and review progress at management review. The clause does not ask for a separate planning document.
The bit that often gets missed is the effectiveness review. It is not enough to record that an action was completed - the clause asks the organisation to evaluate whether the action actually addressed the risk it was supposed to. A short note in the register against each closed action covers this.
Practical Compliance Guidance
Actions identified through the bribery risk assessment, due diligence reviews, audits and concerns are recorded on an issues and actions register and reviewed at planned intervals to track effectiveness.
The documents below support planning of actions for risks and opportunities under Clause 6.1.
| alphaZ document | How to use it |
|---|---|
| ISO 37001 Toolkit | Complete documentation set for ISO 37001:2025 compliance, including the anti-bribery policy, the PP-1-19 Anti-bribery procedure, audit checklists, risk assessment and all supporting registers and forms. |
| ER1 Issues Actions Register | Tracks every issue, action, owner and completion date arising from risks, audits and concerns. |
| F-IMS34 Anti-bribery Compliance Register | Higher-level register capturing the periodic review of the ABMS and the themes for ongoing action. |
| F-AB4 Bribery Due Diligence Review | Used to plan and document due diligence actions for higher-risk individuals, transactions or relationships. |
| RA-AB1 Bribery Risk Assessment | Identifies residual risks above tolerance that drive Clause 6.1 actions. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
UK Legislation
The following UK legislation creates the legal exposures that often drive Clause 6.1 actions when the bribery risk assessment surfaces a residual risk above the organisation tolerance.
