ISO 37001 Documentation: What You Actually Need

Documents You Must Maintain

Organisations should maintain documented information about:

• Scope of the ABMS – What parts of the organisation and which activities are covered.

• Anti-bribery policy – The organisation’s commitment to preventing bribery.

• Anti-bribery objectives – What the organisation wants to achieve in preventing and managing bribery risks.

• Bribery risk assessment – The method, criteria, risks identified and assessment results.

• Procedures and controls – The measures implemented to manage and reduce identified bribery risks.

• System-related information – Other information needed to ensure the anti-bribery system works effectively.

Records You Must Keep

Organisations should retain records showing:

• Employee competence and training

• Appointment, responsibilities and authority of the anti-bribery compliance function

• Due diligence carried out on transactions, projects and business associates

• Anti-bribery commitments received from business associates

• Gifts, hospitality, donations and similar benefits

• Approvals related to financial and non-financial controls

• Concerns or reports raised, along with their investigation and outcome

• Internal and external communication related to the system

• Monitoring and measurement results

• Internal audit plans and results

• Reviews conducted by top management and the governing body

• Nonconformities and corrective actions

Four Documents Auditors Usually Look at First

1. Bribery Risk Assessment

Auditors will look at how bribery risks were assessed, including the criteria, method and results.

The assessment may consider factors such as:

• Location

• Industry or sector

• Type of transaction

• Type of business associate

• Interaction with government or public officials

The risk assessment should be reviewed regularly and whenever there is a significant change in the organisation or its activities.

2. Anti-Bribery Compliance Function

Auditors will check:

• Who has been appointed

• What authority they have

• What resources are available to them

• Who they report to

• Whether they have appropriate access to the governing body

3. Due Diligence Process

Auditors want to understand how the organisation assesses its business associates and other counterparties.

The organisation should clearly define:

• How risk categories are assigned

• What level of due diligence is required for each category

• Who approves or decides the level of due diligence

• How the findings and decisions are documented

4. Gifts, Hospitality and Donations Register

Auditors may review the actual register, not just the policy.

The register should clearly show:

• Applicable limits or thresholds

• Required approvals

• Details of gifts, hospitality and donations

• Actual entries and activities

Practical Tips for Better Documentation

1. Explain the reason behind the risk rating.

Do not record only "low", "medium" or "high" risk. Document why the risk was given that rating. A rating without supporting reasoning can be difficult to justify during an audit.

2. Make due diligence proportionate to the risk.

Not every business associate needs the same level of checking. Document the risk category and explain why that level of due diligence was applied.

3. Record gifts and hospitality properly.

Even items below the approval limit can be recorded, at least in summary. This helps demonstrate that the register reflects actual activity.

4. Keep records of all concerns raised.

Record concerns, investigations and outcomes, even when an allegation is found to be unsubstantiated. A case where no wrongdoing was found still demonstrates that the reporting and investigation process is working.

5. Keep management and governing body reviews separate.

ISO 37001 requires both reviews. Organisations should not treat them as one review or maintain only one set of records.

6. Refresh due diligence regularly.

Due diligence should not necessarily happen only when a business associate is appointed. Periodic reviews should be carried out where appropriate, and the refresh should be documented.

Common ISO 37001 Audit Findings

Auditors commonly identify issues such as:

1. The organisation assesses bribery risk as low everywhere without sufficient supporting analysis.

2. The anti-bribery compliance function does not have clearly documented authority or access to the governing body.

3. The same level of due diligence is applied to everyone instead of being based on risk.

4. The gifts and hospitality register is empty or only records exceptional cases.

5. Higher-risk business associates do not provide documented anti-bribery commitments.

6. A reporting channel exists, but there are no records showing that it is being used, monitored or tested.

7. The same training is provided to everyone, regardless of their role or exposure to bribery risks.

8. There is no separate documented review of the anti-bribery system by the governing body.

Key Takeaway

ISO 37001 documentation is not about creating paperwork just for an audit. Your documents and records should demonstrate how your organisation identifies bribery risks, applies controls, investigates concerns and continually improves its anti-bribery management system.