ISO 37001

An Introduction to Anti-Bribery Management Systems

Alan Field

• Editore: ITGP
• Anno: 2017
• ISBN:
  9781849289559
• Argomento: Commerce
• Categoria: Gouvernance d'entreprise

When is a gift not a gift? When it's a bribe.

For many, corporate hospitality oils the wheels of commerce. But where do you draw the line?

Bribes, incentives and inducements are not just a matter of used banknotes stuffed in brown envelopes. Expenses, corporate settlement of personal bills, gifts and hospitality can all be used to influence business partners, clients and contractors.

Can you afford unlimited fines?

Under the Bribery Act 2010, a maximum of ten years' imprisonment and an unlimited fine may be imposed for offering, promising, giving, requesting, agreeing, receiving or accepting bribes.

With such strict penalties, it's astonishing that so few companies have few or no measures in place to ensure that they are not liable for prosecution. The Ministry of Justice's quick start guide to the Bribery Act makes it clear that "There is a full defence if you can show you had adequate procedures in place to prevent bribery".

Such procedures can be found in ISO 37001, the international standard for ABMSs.

How to implement an ABMS

ISO 37001: An Introduction to Anti-Bribery Management Systems explains how to implement an ABMS that meets the requirements of ISO 37001, from the initial gap analysis to due diligence management, and covers the following:

• An introduction to ISO 37001.
• An ABMS explained.
• Management processes within an ABMS.
• Implementing an ABMS.
• Risk assessment in due diligence.
• Whistleblowing and bribery investigations.
• Internal auditing and corrective action.
• Certification to ISO 37001.

The book provides helpful guidance on the importance of clearly defining policies; logging gifts and hospitality in auditable records; ensuring a consistent approach across the organisation; controls for contractors; facilitation payments; and charitable and political donations.

Meet the stringent requirements of the Bribery Act

Not only will an ISO 37001-compliant ABMS help your organisation prove its probity by meeting the stringent requirements of the Bribery Act but it can also be adapted to most legal or compliance systems.

An ethical approach to business is not just a legal obligation but a way to protect your reputation.

CHAPTER 1: NO OSTRICHES ALLOWED: AN OVERVIEW OF ANTI-BRIBERY

The purpose of this guide is to provide guidance on implementing a management system to the requirements of ISO 37001:2016, the international standard relating to an ABMS. This will apply whether you are considering formal assessment or not.

Each ABMS will be as unique as any organisation’s culture and circumstances. This guide will focus on the key areas that may need particular consideration and it will highlight other areas that may need further research.

It is also important that you read and consider the exact requirements of ISO 37001 in detail.

In the context of this publication, a management system is a framework where processes and/or procedures are used to ensure that tasks are delivered in a consistent way by an organisation to ensure its objectives are achieved.

Anti-bribery – although it may be a separate management system – may also be incorporated into many other aspects of compliance, ICT and HR policies, to name but a few. This will be examined further throughout the guide.

Ostriches and risk takers

Why consider ISO 37001:2016 at all?

The following scenario may not apply to your organisation, but the risks and assumptions it raises helps one consider the landscape that ISO 37001 seeks to manage.

You might call this scenario the ostrich approach to bribery and corruption risks: the belief that it will never happen in your organisation, and none of your customers, suppliers or contractors – or individual members of their staff – would ever engage in such practices. Many organisations still implicitly or even openly believe this. This might be because they simply see it as a very low risk, or because they prefer not to think that those they trust would abuse that relationship.

There may also be a fundamental misunderstanding in that just because an organisation itself is ethical and compliant in most respects, this does not necessarily prevent certain individuals working for them (and sometimes very senior individuals) from being corrupt. We will explore this distinction when we look at due diligence.

It is also sometimes forgotten that the links between corruption and fraud are very close. If an organisation has a counter-fraud policy with systems and controls in place, then there should be a similar process in place for bribery and corruption.

For example, if a subcontractor deliberately invoices a company for work they have not done, then that is probably fraud. If they tell one of the company’s employees in advance and offer them an inducement to approve the invoice for payment, then that is corruption as well. To recognise one of these circumstance as a risk to be controlled but not the other, does not make good business sense.

Another example is where very large contracts can be won or lost based on relationships with clients, and where a ‘beauty parade’ system operates. There may actually be little or no difference in price or product quality between competitors for high-value contracts. Some organisations may give inducements to potential customers or their agents to get the order, which in some parts of the world is normal business practice. Some individuals may even believe they are doing nothing wrong, especially if these inducements are payments to ‘charities’ or trade bodies (which the client or agent will either be a direct beneficiary of or, perhaps, where a family member or other associates will benefit).

In the industrialised world, inducements may be presents instead of cash: holidays, lavish entertainment (including for family members), interest-free or low-interest loans, paying healthcare costs, paying other bills out of company funds, or rather more complex arrangements such as secret offshore investments.

Although bribery may not be legal in any part of the world, its definition and how little it is enforced means that in some countries there is simply a lack of expectation for all parties to act honestly.

Some organisations take risks just by saying there is no risk at all: there is no bribery and corruption here – it only happens elsewhere. Others take the view that bribery and corruption only ever happen in the developing world and not in, say, the UK or US. They confuse the difference between risk and frequency. Bribery and corruption can happen anywhere – it is just more prevalent in some countries and in some business sectors.

One way to discourage dishonesty is to have rigorous processes and risk-based decision making, such as a check on the identities, qualifications and employment references of all new staff, no matter how senior or how well known they may be to managers or investors.

Some fraudsters and corrupt individuals may develop ‘friendships’ that are beneficial to them, even taking pleasure in manipulating senior business people into believing they are something they are not. The truth is that ‘grooming’ isn’t just something done by sexual predators – deception is a common strategy used by many criminals. Few executives would ever admit they could fall victim to a con artist, but they could. An organisation needs to accept that this risk exists and put in place appropriate countermeasures.

The reasons for dishonesty are many and sometimes employees will become involved in criminality that is out of their previous character. This is even before we consider those business people who see nothing wrong in corrupt behaviour. Rigorous processes for checking candidates’ backgrounds can minimise the risks.

This guide will discuss these points and others in more detail to give you a grounding in ISO 37001.

CHAPTER 2: AN ABMS BY ANY OTHER NAME

What is an ABMS?

An ABMS is not the same as financial and corporate governance rules to prevent bribery and fraud., but it can be integrated as a part of it. For organisations in the UK, corporate governance or financial controls should already be in place to meet the requirements of the Bribery Act 2010. However, implementing an ABMS – as understood by ISO 37001 – is still optional.

ISO 37001 is the new basis for most ABMS implementations. It is similar in approach to other international standards, such as ISO 9001:2015 (quality management systems) or ISO 14001:2015 (environmental management systems), in that it is based on a plan, do, check, act (PDCA) approach to decision making.

A PDCA approach can be generic and can influence the way other systems or processes within an organisation are developed. ISO 37001 can be integrated with other related PDCA-based management systems, such as ISO 9001.

In the UK, the Bribery Act 2010 is one of the key pieces of legislation. ISO 37001 can be adapted for other jurisdictions, as many of the general legal principles are similar. Because an ABMS is a management system, we can also adapt it to most legal or compliance systems. This is important if an organisation works in a number of different countries and decisions on specific issues need to comply with differing local, legal expectations.

If an organisation has a global approach to business ethics or corporate social responsibility, it should either be integrated into the ABMS or run in tandem. Where compliance and ethics run in different directions then, at the very least, mixed messages will be sent to staff.

Reinventing the wheel?

We will be using ISO 37001 as a guiding point for subsequent chapters but, equally, it will be useful for more compliance-based approaches, even for organisations that do not intend to formally implement ISO 37001.

When implementing an ABMS you are unlikely to be starting from a completely blank slate. Even a cursory read through ISO 37001 highlights lots of familiar things, including HR and procurement policies. Some of these policies may already be in place and meet ISO 37001, whereas others will need work and some requirements will be new. You should conduct a gap analysis to identify the difference between what you have and what you will need.

The following chapters will take you through the key requirements of ISO 37001, but we will look first at the areas where a gap analysis might find some quick wins.

There may already be a business ethics policy in place. If not, this is one of the first areas for top management to focus on. Implementing an ABMS, let alone being assessed against ISO 37001, is something the organisation has to be committed to. Such phrases are often written in management textbooks but this has to be more than an aspiration – an ABMS might be business as usual to some organisations but a fundamental shift to others. This is something to discover at the outset of an ABMS implementation and not halfway through.

The quick wins might fall into the following four areas:

1. 1. Policy – if there is a developed corporate governance and compliance system in place, and/or a system of corporate social responsibil...

Indice dei contenuti

• Cover
• Title
• Copyright
• About the Author
• Contents
• Introduction
• Chapter 1: No Ostriches Allowed: An Overview of Anti-Bribery
• Chapter 2: An ABMS by any Other Name
• Chapter 3: Management Processes within an ABMS
• Chapter 4: Implementing an ABMS: One Key Issue
• Chapter 5: Risk Assessment in Due Diligence
• Chapter 6: Who Do You Think They Are?
• Chapter 7: Blowing the Whistle
• Chapter 8: Investigating Bribery
• Chapter 9: Internal Auditing and Corrective Action
• Chapter 10: Going for Gold
• ITG Resources