Competence for ISO 37001 Anti-Bribery
ISO 37001 Clause 7.2
Competence and the employment process - the controls around hiring, induction, declarations and due diligence on people in higher-risk roles.
ISO 37001 Clause 7.2 - Competence
Clause 7.2 has two parts. 7.2.1 covers general competence requirements. 7.2.2 covers the employment process and is split into two sub-clauses - 7.2.2.1 for all personnel and 7.2.2.2 for personnel in higher-risk positions.
ISO 37001 Clause 7.2.1 - General Competence
The organisation must determine the competence required of anyone whose work could affect anti-bribery performance, confirm that those people are competent on the basis of education, training or experience, take action to address any gaps and evaluate the effectiveness of those actions. Documented evidence of competence is required.
For most staff this is covered through induction records, anti-bribery awareness training and the staff training matrix. For specialist roles - the anti-bribery function, due diligence specialists, investigators - more detailed competence evidence is usually held, often including external qualifications or experience records.
ISO 37001 Clause 7.2.2.1 - Employment Process for All Personnel
The clause sets specific requirements for the employment process applying to all personnel. Conditions of employment must require compliance with the anti-bribery policy and the ABMS, and give the organisation the right to take disciplinary action for non-conformance. New employees must receive a copy of the policy and training within a reasonable period of starting. The organisation must have a procedure for taking disciplinary action against staff who breach the policy. Personnel must not suffer retaliation, discrimination or disciplinary action for refusing to participate in activities they reasonably believe to involve more than low bribery risk, or for raising concerns about bribery in good faith. And personnel must be made aware of the requirement to report potential and actual conflicts of interest.
In practice this is usually covered through a combination of employment contract clauses, the staff handbook, the induction process and the anti-bribery procedure. The contract or written terms commit the employee to the policy. The induction confirms training has been delivered. The handbook provides ongoing reference.
ISO 37001 Clause 7.2.2.2 - Higher-Risk Positions
For positions where the bribery risk assessment has identified greater than low bribery risk - and for the anti-bribery function itself - additional controls are required. Due diligence must be conducted on individuals before they are employed, and on personnel before transfer or promotion into such roles. Performance bonuses, targets and other incentivising elements must be reviewed at planned intervals to confirm that reasonable safeguards are in place to prevent them from encouraging bribery. And these personnel, plus the governing body and top management, must file declarations at planned intervals confirming compliance with the policy and ABMS.
The frequency of declarations is determined by the organisation in proportion to the bribery risk - annual is common, but more frequent declarations are sometimes used for the highest-risk roles.
The combination that satisfies 7.2.2 is the employment contract, the induction record, the staff handbook and the bribery commitment declaration. Each piece does specific work - the contract creates the obligation, the induction confirms the training, the handbook provides the reference and the declaration evidences the periodic re-commitment.
I sample employment records for staff in higher-risk roles. I look for the contract clause, the induction record showing anti-bribery training, the most recent declaration and the due diligence record from before they took the role. If those four things are not in the file, the employment process is not really meeting Clause 7.2.2.2.
Pay attention to the no-retaliation point. It is not enough to write it in the policy - it has to actually be true. If staff perceive there are consequences for raising concerns, the rest of this clause does not work no matter what the paperwork says.
Practical Compliance Guidance
Competence is evidenced through the staff training matrix, induction records and anti-bribery declarations. Higher-risk roles get additional documented information through due diligence records.
The documents below support the competence and employment process requirements of Clause 7.2.
| alphaZ document | How to use it |
|---|---|
| ISO 37001 Toolkit | Complete documentation set for ISO 37001:2025 compliance, including the anti-bribery policy, the PP-1-19 Anti-bribery procedure, audit checklists, risk assessment and all supporting registers and anti-bribery forms. |
| ER2 Staff Training Competency Matrix | Tracks training completion and competence evidence across all roles, including anti-bribery awareness and role-specific competence. |
| F-Q4 Staff Induction | Induction record confirming new starters have received the anti-bribery policy and training. |
| F-AB3 Bribery Commitment Declaration | Periodic declaration filed by staff in higher-risk roles, top management and the governing body. |
| F-AB4 Bribery Due Diligence Review | Used to record due diligence on individuals before employment, transfer or promotion into higher-risk roles. |
| GEN1-1 General Staff Handbook | Provides the ongoing reference for staff covering anti-bribery rules, no-retaliation commitments and conflict-of-interest reporting. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
UK Legislation
The following UK legislation interacts directly with Clause 7.2 - particularly the Bribery Act 2010 which makes adequate procedures around personnel a statutory expectation, and the Public Interest Disclosure Act 1998 which provides the legal framework for no-retaliation protection.
