According
to a presentation prepared by the ISO, “an organization must implement a series
of measures and controls in a reasonable and proportionate manner to help
prevent, detect, and [respond to] bribery.†More specifically, an organization
is required to have the following best practices and/or controls implemented as
part of its anti-bribery management systems:
- An anti-bribery policy that prohibits
bribery
- The
expression of leadership commitment and responsibility
- Communication
of the policy directly to both personnel and business associates
- Appointment
of a person or function to oversee the program
- Personnel
controls and training
- Regular
assessments of the bribery risk to which the organization is exposed
- Due
diligence on projects and business associates
- Implementation
of anti-bribery controls by controlled organizations and by business
associations
- Implementation
of appropriate financial and non-financial controls to prevent the bribery risk
- Reporting,
monitoring, investigating, and auditing
- Corrective
action and continual improvement
While
the standard provides some specificity regarding the requirements, ISO 37001 is
also broad in nature. For example, the standard requires an organization to
implement measures and controls in a reasonable and proportionate manner. The
standard, however, does not specifically define what is meant by a reasonable
and proportionate manner. The broadness of the standard allows executives to
use their professional judgment in developing the appropriate controls to
prevent, detect, and respond to bribery based on many factors, such as the
company’s industry, size and nature of contracts, types of customers
(governmental or non-governmental, public or private, etc.), and number of
employees.
The Standard provides minimum requirements and supporting guidance for
implementing or benchmarking an anti-bribery management system. It is a risk
management tool and brings assurance to management, investors, employees,
customers and other stakeholders that an organization is taking reasonable
steps to prevent, detect, and appropriately manage bribery risk.
In the event of an investigation, the Standard may also be taken into
account as evidence that an organization has taken reasonable, proactive steps
to prevent bribery.
Implementation of the Standard can also provide an organization with a
competitive advantage and increased stakeholder, shareholder, and customer
trust.
User questions & answers