Managing Inadequacy of Anti-bribery Controls for ISO 37001
ISO 37001 Clause 8.8
What to do where bribery risk cannot be managed by existing controls and additional controls cannot be applied.
ISO 37001 Clause 8.8 - Managing Inadequacy of Anti-bribery Controls
Clause 8.8 covers the situation where due diligence on a specific transaction, project, activity or relationship establishes that bribery risks cannot be managed by existing anti-bribery controls, and the organisation cannot or does not wish to implement additional controls (or take other steps such as changing the nature of the activity) to enable effective management of those risks.
What ISO 37001 Clause 8.8 Requires
For existing transactions, projects, activities or relationships in this situation, the organisation must take appropriate steps in relation to the bribery risk - to discontinue, terminate, suspend or withdraw from it as soon as possible. For proposed new transactions, projects or activities, the organisation must postpone or decline to continue with them.
The clause is unequivocal. Where the controls cannot manage the risk and the organisation will not strengthen them or change the activity, the activity has to stop. There is no fourth option of carrying on regardless.
How This Works in Practice
The trigger for Clause 8.8 is usually a due diligence finding under Clause 8.2 or a Clause 8.5 review of business associate controls. The bribery risk assessment is updated to reflect the inadequacy. The organisation considers whether additional controls are practicable - enhanced monitoring, contractual changes, restructuring of the activity, or escalation through the anti-bribery function. If those options are not available or not acceptable, Clause 8.8 applies.
For existing relationships, termination has to be handled in line with the contract. The contractual termination rights obtained under Clause 8.6 are the legal mechanism. Where termination is not immediately possible, suspension or withdrawal from the specific activity is the interim step.
For new transactions, the decision is simpler - the organisation declines to proceed and the bribery risk assessment records the decision and the reasons.
This clause is the one that takes commercial pressure most directly. Walking away from a customer, supplier or contract because the bribery risk cannot be managed is uncomfortable. The clause exists because the alternative - operating with controls everyone knows are inadequate - is worse.
The decision under this clause is recorded in the bribery risk assessment and the issues and actions register. For business associates, the entry on F-IMS35 is updated to show termination or restriction. For new transactions, the record sits in the project or commercial review documentation.
I look for evidence that the clause has actually been used. Where the bribery risk assessment shows higher-risk activities or relationships, I check whether any have been declined or terminated and whether the records explain why. An organisation that has never declined or terminated anything under Clause 8.8 may have a bribery risk assessment that is too generous, or the clause is not actually being applied.
Practical Compliance Guidance
Decisions under Clause 8.8 are recorded against the relevant entries in the business associate register, the bribery risk assessment and the issues and actions register. The trigger is typically a due diligence finding under Clause 8.2 or a business associate review under Clause 8.5.
The documents below support the application of Clause 8.8 in practice.
| alphaZ document | How to use it |
|---|---|
| ISO 37001 Toolkit | Complete documentation set for ISO 37001:2025 compliance, including the anti-bribery policy, the PP-1-19 Anti-bribery procedure, audit checklists, and all supporting registers and forms. |
| F-IMS35 Business Associate Register | Records the status of each business associate relationship including any decisions to terminate or restrict. |
| ER1 Issues Actions Register | Tracks the actions arising from inadequate controls including termination or decline decisions. |
| RA-AB1 Bribery Risk Assessment | Identifies activities and relationships where existing controls are inadequate, triggering Clause 8.8 consideration. |
| PP-1-19 Anti-bribery Procedure | Sets out the procedure for handling inadequate controls including escalation and termination routes. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
UK Legislation
The following UK legislation creates the legal context that often drives Clause 8.8 decisions. Continuing with activities that breach the Bribery Act 2010 is not an option.
