Operation for ISO 37001 Anti-Bribery

ISO 37001 Clause 8

The operational controls of the anti-bribery system - due diligence, gifts and hospitality, financial and non-financial controls, contract terms, raising concerns and investigating bribery.

ISO 37001 Clause 8 - Operation

Clause 8 is where the ABMS turns from policy and planning into actual controls. It has ten sub-clauses - more than any other clause in the standard - each covering a specific operational requirement. The clauses link directly to the bribery risk assessment in Clause 4.5 - the controls described in Clause 8 are the response to the risks the assessment identifies.

Sub-clauses Covered by Clause 8

Clause 8.1 - Operational Planning and Control covers the general operational requirements - process criteria, control of changes and externally provided processes.

Clause 8.2 - Due Diligence requires due diligence on transactions, business associates and personnel positions where the bribery risk is greater than low.

Clause 8.3 - Financial Controls requires financial controls to address bribery risk.

Clause 8.4 - Non-financial Controls requires non-financial controls covering procurement, operations, sales, HR, legal and other areas.

Clause 8.5 - Implementation of Anti-bribery Controls by Controlled Organisations and Business Associates extends the requirements to controlled entities and to non-controlled business associates with greater than low bribery risk.

Clause 8.6 - Anti-bribery Commitments requires commitments from higher-risk business associates, with termination rights for breaches.

Clause 8.7 - Gifts, Hospitality, Donations and Similar Benefits requires procedures to prevent gifts, hospitality and similar from being or being perceived as bribery.

Clause 8.8 - Managing Inadequacy of Anti-bribery Controls requires action where existing controls cannot manage bribery risk.

Clause 8.9 - Raising Concerns requires arrangements for confidential reporting of concerns with no retaliation.

Clause 8.10 - Investigating and Dealing with Bribery requires assessment, investigation and appropriate action where bribery is suspected, reported or detected.

Clause 8 is where the ABMS earns its keep. The bribery risk assessment names the risks. Clause 8 is the response - what the organisation actually does to prevent, detect and respond to bribery. If Clause 4.5 is honest about the risks but Clause 8 controls do not match, the audit will find the gap.

The bulk of audit time tends to fall on Clause 8. I work through each sub-clause looking for the specific evidence - due diligence records, financial control evidence, the business associate register, gifts register, concerns register and any investigation records. The connection back to the bribery risk assessment is what I am tracing throughout.

Further Resources