Assessing Bribery Risk and Applying Proportionate Due Diligence

A bribery risk assessment is the foundation of an effective ISO 37001 anti-bribery system. It helps an organisation identify where bribery risks may exist and decide what controls and due diligence are needed.

Step 1: Define the Risk Criteria

Before starting the assessment, clearly define what each risk level means.

For example, decide what qualifies as low, medium, or high risk. Under ISO 37001, low risk is important because it is the level where enhanced due diligence is generally not required.

Therefore, the point at which a risk moves from low to a higher level should be clearly defined and supported by evidence.

Step 2: Assess Risk by Different Categories

Do not give an organisation or business relationship just one overall risk rating. Look at the different factors that can increase bribery risk.

Location

Consider the countries where the organisation operates, where its business partners are located, and where payments are made.

Publicly available corruption indices can be useful when assessing risk, but they should be treated as one input rather than the only basis for the decision.

Sector

Some industries may naturally have higher bribery risks, such as:

• Construction

• Defence

• Pharmaceuticals

• Infrastructure

• Extractive industries

• Logistics

• Industries that require significant licences, permits, or government approvals

Interaction with Public Officials

Interaction with public officials is an important risk factor.

Consider activities involving:

• Permits and licences

• Customs

• Government inspections

• Public tenders

• Taxes

• Regulatory authorities

Even routine interactions should be considered because bribery or facilitation payment risks can arise during these activities.

Type of Transaction

Pay particular attention to:

• Public tenders

• High-value contracts

• Transactions involving intermediaries

• Unusual payment arrangements

• Complex payment structures

Type of Business Associate

Higher attention may be required for business associates such as:

• Agents and commission-based intermediaries

• Distributors

• Customs brokers

• Logistics providers

• Consultants

• Joint venture partners

• Subcontractors

Internal Factors

The organisation should also consider its own internal practices.

Risk may increase where there are:

• Very aggressive sales targets

• Incentives heavily linked to winning specific contracts

• Weak separation of responsibilities

• Too much decision-making authority with one person

Step 3: Check Low-Risk Decisions

Whenever a relationship is classified as low risk, ask:

What evidence supports this conclusion?

Low-risk decisions are important because fewer controls may be applied at this level.

For example, if the organisation works with government customers, commission-based agents, or operates in markets with known corruption concerns, a low-risk rating should have strong supporting evidence.

Step 4: Create Due Diligence Levels

Use the risk assessment to decide how much due diligence is required.

Standard Due Diligence

This may include:

• Verifying identity

• Checking ownership

• Basic sanctions screening

• Basic adverse media checks

• Standard anti-bribery clauses in contracts

Enhanced Due Diligence

For higher-risk relationships, consider:

• Identifying and verifying beneficial ownership

• Checking political exposure

• Conducting detailed adverse media checks

• Obtaining references

• Reviewing financial standing

• Documenting the business reason for the relationship

• Including stronger contractual protections and audit rights

Highest Level of Due Diligence

For the highest-risk relationships, consider all the above measures plus:

• Independent verification

• Site visits

• Interviews, where appropriate

• Approval by a clearly defined senior authority

The level of due diligence should be based on the actual risk, not simply on the value of the contract. A low-value contract can still involve a high-risk intermediary.

Step 5: Document Why Intermediaries Are Needed

For every agent, consultant, or intermediary, clearly document:

• What services they will provide

• Why their services are required

• Why the organisation has selected them

• Why their fees or commission are reasonable for the work

If the only explanation is that the person "has good relationships", this should be treated as a warning sign and investigated further.

Step 6: Include Appropriate Contractual Controls

Contracts with relevant business associates should include appropriate anti-bribery protections, such as:

• Commitment to comply with applicable anti-bribery laws

• Anti-bribery representations and warranties

• Audit rights

• Termination rights in case of a breach or credible suspicion of misconduct

• Requirements to apply equivalent anti-bribery obligations to downstream parties

• No appointment of sub-agents without prior approval

Even if audit rights are not regularly used, having them in the contract can strengthen the organisation's controls. For higher-risk relationships, exercising these rights periodically can provide additional assurance.

Step 7: Monitor and Update Due Diligence

Due diligence should not be a one-time activity.

Set review periods based on the risk level and monitor for events that may require an earlier review, such as:

• Change in ownership

• Negative media coverage

• Change in the nature of the business relationship

• Entry into a new country or market

• Unusual payment requests

• Changes in the services being provided

Document each review, even when there are no significant changes.

Step 8: Review the Risk Assessment

The overall bribery risk assessment should be reviewed regularly and whenever there is a significant change, such as:

• Entering a new market

• Starting a new business activity

• Acquiring another company

• Appointing new types of intermediaries

• A bribery-related incident

• Significant changes in the organisation's operations

Common Weaknesses

1. Giving one overall risk rating without assessing individual risk factors

2. Classifying a relationship as low risk without sufficient evidence

3. Giving more importance to contract value than the actual bribery risk

4. Failing to identify beneficial owners of higher-risk business associates

5. Not documenting why an intermediary is commercially required

6. Missing anti-bribery protections in contracts or failing to extend them to relevant downstream parties

7. Completing due diligence only when a business associate is appointed and never reviewing it again

8. Failing to update the risk assessment when entering a new market or making a significant business change