Non-financial Controls for ISO 37001 Anti-Bribery

ISO 37001 Clause 8.4

Non-financial controls across procurement, sales, HR, legal and other functions where bribery risk arises.

ISO 37001 Clause 8.4 - Non-financial Controls

Clause 8.4 requires non-financial controls to address and manage bribery risk. The standard explicitly mentions procurement, operations, sales, commercial, human resources, legal, mergers and acquisitions and regulatory activities. This list is illustrative - the controls apply wherever the bribery risk assessment identifies exposure that financial controls alone do not adequately manage.

Common Non-financial Controls

In procurement the typical non-financial controls include approved supplier lists, due diligence on new suppliers, conflict of interest declarations from staff involved in supplier selection, requirements for written contracts above set thresholds, and rotation of staff with significant supplier relationships.

In sales and commercial activity, non-financial controls include approval requirements for sales agents and intermediaries, restrictions on the use of agents in higher-risk regions, controls on the structure of commission arrangements, contract review by legal or compliance before signature for higher-value or higher-risk deals, and clear separation between the sales role and the contracting role.

In HR, non-financial controls cover the employment process requirements set out in Clause 7.2.2 - background checks, due diligence, declarations, conflict of interest reporting and disciplinary procedures.

In mergers and acquisitions, non-financial controls include pre-acquisition bribery due diligence on target companies, contractual representations and warranties about anti-bribery, and post-acquisition integration plans that bring the acquired company into the ABMS scope.

In regulatory activity, non-financial controls cover the rules around interaction with public officials - who may interact with them, what may be discussed, what records must be kept and what authorisations are needed before payments such as visa or permit fees.

How Non-financial Controls Connect to the ABMS

The PP-1-19 anti-bribery procedure typically lists the non-financial controls in place and points at the operational procedures - purchasing, sales, HR - that contain the detail. The control matrix that maps higher-risk activity categories to specific controls makes the connection auditable.

Non-financial controls is a long list because bribery risk shows up in lots of operational areas. The trick is to identify the specific controls that matter for your risk profile and make sure they actually operate. A long list of theoretical controls that are not enforced is worse than a short list that actually works.

I sample non-financial controls in the highest-risk areas identified by the bribery risk assessment. I look for evidence the control is operating - approval records, declarations, due diligence files, conflict of interest registers. The pattern of evidence tells me whether the control is real or just on paper.

Practical Compliance Guidance

Non-financial controls are recorded in PP-1-19 with the operational detail in the relevant procedures. The bribery risk assessment identifies the higher-risk areas that drive control prioritisation.

The documents below support the non-financial controls required by Clause 8.4.

alphaZ document	How to use it
ISO 37001 Toolkit	Complete documentation set for ISO 37001:2025 compliance, including the anti-bribery policy, the PP-1-19 Anti-bribery procedure, audit checklists, risk assessment and all supporting registers and anti-bribery forms.
PP-1-19 Anti-bribery Procedure	Lists the non-financial controls in place across the organisation and points to the operational procedures that contain the detail.
PP-1-18 Purchasing Outsourced Services Policy	Sets out the procurement-related non-financial controls including supplier approval, due diligence and contract requirements.
F-AB3 Bribery Commitment Declaration	Declaration from staff in higher-risk roles that supports HR-related non-financial controls.
F-IMS35 Business Associate Register	Tracks the controls applied to higher-risk business associates including any additional non-financial controls.

Note - all the above files can be downloaded with an alphaZ subscription.

Frequently Asked Questions

Does Clause 8.4 require controls in every area listed in the standard?

No - the list is illustrative. The clause requires non-financial controls in the areas where the bribery risk assessment identifies exposure. An organisation with no mergers and acquisitions activity does not need M&A-specific controls. The areas listed in the standard are common ones but the actual scope is driven by the risk profile.

How do non-financial controls connect with HR procedures?

Through the employment process under Clause 7.2.2 - background checks, due diligence on higher-risk roles, conflict of interest reporting, declarations and disciplinary processes. The HR non-financial controls under Clause 8.4 are largely the operational implementation of the employment process requirements.

What controls are typical for sales activities involving public officials?

Approval requirements before contact, written records of meetings, restrictions on hospitality offered, controls on the use of agents and intermediaries, and pre-approval for any payments such as visa or permit fees. The PP-1-19 procedure typically sets out the specific rules that apply.

UK Legislation

The following UK legislation provides the legal context for many non-financial controls including the Bribery Act 2010 corporate offence and Modern Slavery Act 2015 supply chain provisions.

Further Resources