Performance Evaluation for ISO 37001 Anti-Bribery

ISO 37001 Clause 9

Performance evaluation - monitoring and measurement, internal audit, management review, and review by the anti-bribery function.

ISO 37001 Clause 9 - Performance Evaluation

Clause 9 sets out the four ways the organisation checks whether the ABMS is doing what it is supposed to. Clause 9.1 covers monitoring and measurement of ABMS performance day to day. Clause 9.2 covers planned internal audits. Clause 9.3 covers periodic management review by top management and (where relevant) the governing body. Clause 9.4 is specific to ISO 37001 - the anti-bribery function reviews the ABMS continuously and reports its findings.

Why Clause 9 Matters for Anti-Bribery

An ABMS that is set up but not evaluated cannot be relied on. Bribery risk evolves - new business associates, new countries, new transaction types, changes in regulatory expectations - and the controls that were proportionate twelve months ago may not be proportionate now. The four mechanisms in Clause 9 work together to surface this. Day-to-day monitoring catches issues quickly. Internal audit takes a structured cross-cutting view. Management review takes the longer-term strategic view. The anti-bribery function review covers the continuous oversight that is specific to anti-bribery.

The four are not interchangeable. Each has a different scope, frequency and audience. A common gap is treating internal audit as a substitute for management review, or treating monitoring data as if it answered the strategic questions that management review is supposed to address.

How the Four Mechanisms Connect

Monitoring data feeds into internal audit and management review. Internal audit findings feed into management review. The anti-bribery function review draws on all of the above plus its own observations. Management review decisions then drive changes to objectives, controls, resources and the ABMS itself.

Each mechanism produces documented information - monitoring records, audit reports, management review minutes, anti-bribery function reports. These records are also evidence for certification audits.

The standard requires four different evaluation routes for a reason - they each catch different things. Monitoring spots the operational issues. Internal audit picks up the compliance gaps. Management review takes the strategic view. The anti-bribery function provides the ongoing watching brief. If you collapse them into one or two, you will miss issues.

I look for evidence each of the four is happening and that they connect. Monitoring data without analysis is just numbers. Audit findings without management response is just paper. Management review without inputs from the other three is just a meeting. What I want to see is the chain - data, analysis, audit, review, decisions, action.

Clause 9 Sub-Clauses

The links below provide detailed guidance on each sub-clause:

Practical Compliance Guidance

Performance evaluation depends on the audit programme set out in ER11, audit checklists like F-Q2 and the ABMS-specific A-C checklist, plus management review records using the 37001-specific F-Q3 form.

The documents below support the performance evaluation activities required by Clause 9.

alphaZ document	How to use it
ISO 37001 Toolkit	Complete documentation set for ISO 37001:2025 compliance, including the anti-bribery policy, the PP-1-19 Anti-bribery procedure, audit checklists, risk assessment and all supporting registers and anti-bribery forms.
ER11 Audit Schedule	Annual audit schedule covering the ABMS - frequency, scope, auditor and target completion.
F-Q2 Audit Checklist	General internal audit checklist used during ABMS internal audits.
A-C Management System ABMS Audit Checklist	Full-clause checklist covering ISO 37001:2025 requirements - used for full-system audits.
F-Q3 Anti-bribery Management Review	Management review template specifically for the ABMS, capturing inputs and outputs required by Clause 9.3.
F-Q16 Improvement Request	Records improvement actions arising from monitoring, audit, management review or the anti-bribery function review.
ER1 Issues and Actions Register	Logs issues identified through performance evaluation and tracks actions to closure.

Note - all the above files can be downloaded with an alphaZ subscription.

Frequently Asked Questions

How often does Clause 9 require evaluation activities to take place?

The standard does not prescribe specific frequencies for any of the four. The organisation decides what is appropriate. In practice, monitoring is continuous, internal audits run on an annual cycle covering the whole ABMS over a defined period, management review happens at planned intervals with at least one full review per year, and the anti-bribery function review is continuous with formal reports at planned intervals.

Can the anti-bribery function review under Clause 9.4 replace management review under Clause 9.3?

No. The two have different audiences and different responsibilities. The anti-bribery function reports to top management and (where relevant) the governing body. Management review is the act of top management considering the ABMS at a strategic level and making decisions about it. The anti-bribery function feeds management review but does not replace it.

What evidence does an external auditor look for under Clause 9?

Monitoring records and analysis, the audit programme and individual audit reports, management review minutes with the inputs required by Clause 9.3.2 and the outputs required by Clause 9.3.3, anti-bribery function reports, and the actions arising from each that are tracked through to closure.

UK Legislation

Performance evaluation supports compliance with the bribery and fraud legislation that the ABMS is designed to address.

Further Resources