Due Diligence for ISO 37001 Anti-Bribery
ISO 37001 Clause 8.2
Due diligence on transactions, business associates and personnel where the bribery risk is greater than low. Updated at planned intervals.
ISO 37001 Clause 8.2 - Due Diligence
Clause 8.2 is one of the operational pillars of ISO 37001. It requires due diligence wherever the bribery risk assessment has identified a greater than low bribery risk in three categories - specific categories of transactions, projects and activities; planned or ongoing relationships with specific categories of business associates; and specific categories of personnel in certain positions.
What ISO 37001 Clause 8.2 Requires
For each higher-risk category, the organisation must assess the nature and extent of the bribery risk involved. The assessment must include any due diligence necessary to gather sufficient information to assess the bribery risk. Due diligence must be updated at a set frequency so that changes and new information can be accounted for.
Factors That Drive Due Diligence Depth
The standard lists factors that typically affect due diligence depth. Business size and the scale of relevant operations - the bigger the relationship, the deeper the due diligence. Locations - the geographic profile of the activity, often assessed using indices like the Transparency International Corruption Perceptions Index. Complexity and business model - opaque arrangements, layered intermediaries and unusual payment structures all increase the level of due diligence needed. Entities under control - direct subsidiaries get more scrutiny than arms-length suppliers.
How Due Diligence Works in Practice
For business associates, due diligence typically includes a structured review of the associate identity, ownership, regulatory standing, history of any bribery investigations, anti-bribery procedures in place, and reputation in the relevant market. The F-AB4 Bribery Due Diligence Review form provides a structured template covering pre-employment background checks, contract review, bribery commitments, cultural and business structure considerations, industry profile and any history of investigations.
For higher-risk transactions, due diligence focuses on the nature of the transaction, the parties involved, the route to market, the use of intermediaries and the financial structure. For higher-risk personnel positions, due diligence is integrated with the employment process under Clause 7.2.2.2.
Due diligence outputs feed back into the bribery risk assessment - where due diligence reveals risks beyond what was originally assessed, the assessment is updated and any additional controls flow from that.
Due diligence is not a one-off exercise. It is updated at planned intervals - usually annually for ongoing relationships, and immediately whenever significant changes occur such as a change of control, change of ownership or change of activity. The business associate register tracks the date of the last due diligence and the next planned review.
I sample due diligence records for higher-risk business associates. I look for the date the due diligence was completed, the factors considered, any concerns identified and how those concerns were resolved or controlled. A due diligence file that simply states the review was completed and acceptable, without the underlying analysis, is usually a non-conformity.
Proportionate is the key word. A 30-page due diligence pack on a low-risk supplier is wasted effort. A one-page form on a key agent in a higher-risk jurisdiction is not enough. Match the depth to the risk identified by the Clause 4.5 assessment.
Practical Compliance Guidance
Due diligence is documented through F-AB4 review records and tracked through F-IMS35 for business associates. The frequency of review is set by the organisation in proportion to the bribery risk and recorded against each entry.
The documents below support the due diligence requirements of Clause 8.2.
| alphaZ document | How to use it |
|---|---|
| ISO 37001 Toolkit | Complete documentation set for ISO 37001:2025 compliance, including the anti-bribery policy, the PP-1-19 Anti-bribery procedure, audit checklists, risk assessment and all supporting registers and anti-bribery forms. |
| F-AB4 Bribery Due Diligence Review | Structured template covering the factors to consider when conducting bribery due diligence. |
| F-IMS35 Business Associate Register | Tracks each business associate, their bribery risk rating, due diligence date and any additional controls. |
| PP-1-18 Purchasing Outsourced Services Policy | Sets out due diligence requirements within the purchasing process for higher-risk supplier relationships. |
| RA-AB1 Bribery Risk Assessment | Identifies which categories of transactions, business associates and roles require Clause 8.2 due diligence. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
UK Legislation
The following UK legislation creates legal obligations that due diligence helps the organisation manage. The Bribery Act 2010 corporate offence in particular makes adequate procedures - which include due diligence on associated persons - the only available defence.
