Review by Anti-bribery Function for ISO 37001
ISO 37001 Clause 9.4
The anti-bribery function provides continual oversight of the ABMS and reports to top management and the governing body.
ISO 37001 Clause 9.4 - Review by Anti-bribery Function
Clause 9.4 is one of the clauses that is specific to ISO 37001 and not found in other ISO management standards. It places a continuous review obligation on the anti-bribery function (ABF) - the function established under Clause 5.3.2.
What ISO 37001 Clause 9.4 Requires
The anti-bribery function assesses the ABMS on a continual basis to determine whether it is adequate to manage bribery risks faced by the organisation, and whether it is being effectively implemented. The function reports at planned intervals, and on an ad hoc basis as appropriate, to the governing body and top management (or to a committee where that is the route established under Clause 5.3.2). Reports cover the adequacy and the effectiveness of implementation - including the results of investigations and audits.
"Continual" is the operative word. Unlike management review which is periodic, or internal audit which is scheduled, the function's review obligation does not stop. The function is the standing oversight presence for the ABMS.
What the Function Actually Does
In practice the function monitors the bribery risk environment, tracks the operation of the controls, takes part in due diligence reviews on greater-than-low-risk relationships, oversees the handling of concerns received under Clause 8.9, oversees investigations under Clause 8.10, reviews data from monitoring under Clause 9.1, follows up on internal audit findings, and prepares the input to management review.
The function also takes the strategic view across all of those activities. It is the function that notices the pattern - that concerns are clustering around a particular business unit, that due diligence is repeatedly slow on a particular type of associate, that a specific control is generating exception reports more often than expected. Those patterns get fed up to top management and the governing body so they have visibility on issues before they crystallise into something larger.
The Reporting Cadence
Reports go in at planned intervals - commonly quarterly to top management with an annual report to the governing body, though the frequency is for the organisation to set. The clause also requires ad hoc reports as appropriate, which means the function does not wait for the next scheduled report when something material happens. A serious concern, an investigation outcome with wider implications, a change in the risk profile - these trigger immediate reporting outside the normal cycle.
The function review is the part many small organisations do not really set up because they collapse the role into someone else. The standard expects an oversight presence that is actually doing oversight - not just a job title given to whoever happens to be available. If the function is one person who also runs procurement, the review cannot be independent of procurement decisions. The independence requirement under Clause 5.3.2 has to be real for the 9.4 review to be real.
What works in practice is a structured monthly check by the function on a defined set of indicators - concerns, due diligence completion, exceptions on financial controls, training completion - plus a quarterly written report to top management and an annual report to the governing body. The structure means the review is happening continuously, not just before each audit. The reports become the audit trail.
I look for evidence of a continuous review presence - regular reports, follow-up of issues, escalation when needed. A function that produces one report a year for the governing body and nothing in between is not conducting continual review. The strongest evidence is dated documentation showing the function engaging with operational issues throughout the year and reporting up the chain.
Practical Compliance Guidance
The anti-bribery function uses F-IMS34 to track ABMS compliance, F-AB5 for the Focus-ABC committee where one is in place, and reports findings up to top management and the governing body using the F-Q3 management review structure plus ad hoc reports.
The documents below support the continual review activities required by Clause 9.4.
| alphaZ document | How to use it |
|---|---|
| ISO 37001 Toolkit | Complete documentation set for ISO 37001:2025 compliance, including the anti-birbery policy, the PP-1-19 Anti-bribery procedure, audit checklists, risk assessment and all supporting registers and anti-bribery forms. |
| F-IMS34 Anti-bribery Compliance Register | The anti-bribery function uses this to track ABMS compliance and the basis for periodic reports. |
| F-AB5 Focus ABC Committee | Where the anti-bribery function operates as a committee, this template captures membership, terms of reference and meeting records. |
| F-Q3 Anti-bribery Management Review | Used for the function's formal report to top management - the management review structure works as the reporting framework. |
| ER1 Issues and Actions Register | Issues identified by the function are logged here and tracked through to closure. |
| PP-1-19 Anti-bribery Procedure | Sets out the role and responsibilities of the anti-bribery function. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
How is the Clause 9.4 review different from internal audit and management review?
Internal audit under 9.2 is a structured periodic check by an independent auditor. Management review under 9.3 is the strategic review by top management at planned intervals. The anti-bribery function review under 9.4 is continuous oversight by the function established under Clause 5.3.2. The function feeds both audit and management review but operates on its own ongoing basis between them.
Does the function have to be a single person?
No. Clause 5.3.2 allows the anti-bribery function to be one person, multiple people, an internal committee, or partly external. Smaller organisations often run it as a single role. Larger ones often use a committee like the Focus-ABC committee captured on F-AB5. What matters is the function has the authority, independence and resources to do the job.
How often does the function have to report?
At planned intervals - the organisation decides the frequency - and on an ad hoc basis when something material arises. Common practice is regular reports (monthly or quarterly) to top management with at least an annual report to the governing body where one exists. Ad hoc reports happen as needed and are not on a schedule.
What is the relationship between the function and the governing body?
Clause 5.3.2 requires the function to have direct and prompt access to the governing body. Clause 9.4 requires the function to report to the governing body at planned intervals and ad hoc. The relationship is intentionally close - the function is the way the governing body gets honest information about how the ABMS is actually working without it being filtered by top management.
UK Legislation
Continual oversight of bribery controls supports the corporate due-diligence defences in UK legislation.