Curriculum
- 2 Sections
- 36 Lessons
- Lifetime
- ISO 3700111
- 1.1Introduction to ISO 37001 and Anti-Bribery Management Systems
- 1.2Terms, Definitions, and Key Concepts in ISO 37001
- 1.3Context of the Organization (Clause 4)
- 1.4Leadership and Commitment (Clause 5)
- 1.5Planning (Clause 6)
- 1.6Support (Clause 7)
- 1.7Operation (Clause 8) – Operational Planning and Control
- 1.8Operation (Clause 8) – Reporting, Investigation, and Dealing with Bribery
- 1.9Performance Evaluation (Clause 9)
- 1.10Improvement (Clause 10)
- 1.11Integration of ISO 37001 with Other Management Systems
- ISO 19011: Guidelines for auditing management systems26
- 2.1Introduction to ISO19011
- 2.2Principles of Auditing
- 2.3Managing an Audit Program
- 2.4Establishing Audit Program Objectives
- 2.5Determining Audit Program Risks and Opportunities
- 2.6Establishing the Audit Program
- 2.7Implementing the Audit Program
- 2.8Monitoring the Audit Program
- 2.9Reviewing and Improving the Audit Program
- 2.10Initiating the Audit
- 2.11Determining Audit Feasibility
- 2.12Preparing Audit Activities
- 2.13Reviewing Documented Information
- 2.14Preparing the Audit Plan
- 2.15Assigning Work to the Audit Team
- 2.16Preparing Working Documents
- 2.17Opening Meeting
- 2.18Communication During the Audit
- 2.19Collecting and Verifying Information
- 2.20Generating Audit Findings
- 2.21Preparing Audit Conclusions
- 2.22Closing Meeting
- 2.23Preparing the Audit Report
- 2.24Completing the Audit
- 2.25Follow-Up Activities
- 2.26ISO 37001 Exam120 Minutes40 Questions
Operation (Clause 8) – Operational Planning and Control
Understanding Operational Control in ISO 37001
Clause 8 focuses on how an organization implements and controls its processes to meet anti-bribery requirements. While earlier clauses establish the framework, this clause is where those plans are put into action through day-to-day operations.
Operational planning ensures that anti-bribery controls are embedded into business activities rather than treated as separate or optional processes.
Organizations must plan, implement, and control processes needed to meet ABMS requirements. This includes:
- Establishing criteria for processes
- Implementing control measures aligned with risk levels
- Maintaining documented information to demonstrate compliance
Operational controls should be proportionate to the identified bribery risks. For example, high-risk transactions or regions may require enhanced scrutiny, while lower-risk activities may involve standard controls.
Due diligence is one of the most critical components of Clause 8. It involves assessing the nature and extent of bribery risk associated with:
- Projects
- Transactions
- Business associates
The level of due diligence should reflect the level of risk. Enhanced due diligence may include:
- Background checks
- Financial reviews
- Reputation analysis
- Verification of ownership structures
Due diligence is not a one-time activity. It should be ongoing, especially for long-term business relationships.
Financial Controls
Financial controls are essential to prevent bribery through improper payments. Organizations must implement controls such as:
- Segregation of duties
- Approval processes for payments
- Accurate record-keeping
- Monitoring of transactions
These controls help ensure that financial activities are transparent and traceable.
Non-Financial Controls
Non-financial controls address risks that may not involve direct payments but could still facilitate bribery. These include:
- Procurement processes
- Contract approvals
- Hiring practices
- Performance incentives
Organizations must ensure that these processes are designed to prevent opportunities for bribery.
Implementation of Anti-Bribery Controls
Controls must be integrated into routine business operations. This requires:
- Clear procedures
- Employee training
- Monitoring mechanisms
Employees should understand how these controls apply to their roles and responsibilities.
Organizations must ensure that business associates comply with anti-bribery requirements. This includes:
- Communicating expectations
- Including anti-bribery clauses in contracts
- Monitoring compliance
Where risks are high, organizations may need to take additional measures, such as audits or termination of relationships.
ISO 37001 requires organizations to control activities that could be used as a disguise for bribery, including:
- Gifts
- Hospitality
- Charitable donations
- Sponsorships
Policies should define acceptable limits, approval processes, and documentation requirements.
If an organization identifies that a business associate lacks adequate anti-bribery controls, it must take appropriate action. This may include:
- Strengthening controls
- Providing guidance
- Terminating the relationship
Operational effectiveness depends on the consistent application of these measures across all activities.