(ABMS = ISO 37001)
6.0 Performance Evaluation
- Monitoring - what has been established, implemented, impose control (e.g. revision, issue, superseded etc)
- Measurement - assess (audit/inspection) on benchmark, target
- Analysis - statistics on e.g. department vs non-conformance, project vs non-conformance etc.
- Evaluation - against effectiveness of ABMS
a) What to be monitored/measured
b) Person responsible
c) Method with expected/actual results
d) timeframe/cut-off period
e) results of monitoring and measurement - analysed/evaluated (usually in Management Review)
f) reporting flow
Documented information required as evidence (records/forms/checklists duly filled)
Procedure is present for guide.
Internal audit is much the same clause as ISO 9000/14000/45000 etc. (differences are - anti-bribery details are defined in this clause)
- conduct at planned intervals (set a cut-off period/timeframe/frequency) e.g. every 6 months = 1 Internal Audit or every 1 fiscal year = 1 or 2 Internal Audit (1 every 6 months)
- to comply and conform to the law and ABMS - as far as is practicable to the organization (custom) - not all elements/criterions fit the organization (justify why such element are skipped with evidence)
- effectively implemented and maintained.
should there be many locations or projects/sites - then arrangement to be made by at least the HQ to be audited and - should there be many locations or projects/sites - then arrangement to be made by at least the HQ to be audited and 2-3 ongoing projects (sampling) of different nature/trades (sampling per 5 projects) (as the projects may have a different team members)
- define audit criteria and scope and select competent auditors,
- conduct audit with objectivity and impartiality - either independent function/management representative, the function (critical department/unit) involved in anti-bribery, 3rd party etc.
- report the audit - top management/governing body
- compliance and documented evidence
- audit program/results
Audit shall be reasonable, proportionate and risk based (well-balanced between the 3 aspects),
Procedures shall be referred to ascertain any suspected or actual bribery, violation of policy or ABMS, failure of business associates (including consultant, supplier, vendor, contractor, sub-contractor) determine weakness or improvement
No auditor shall audit his/her own work. (this include his own unit or department - it must be cross-department/unit)
Management review
Top management shall review ABMS at planned intervals (every 6 months - 1 Management Review (MRM) or every fiscal year - 1 or 2 MRMs), determine suitability/adequacy/effectiveness.
MRM to consider : previous MRM, changes in external/internal issues, performance - non-conformities/corrective actions, monitoring/measurement results, audit results, bribery reports,investigation, risks and mitigation and continual improvement (if any) as output. (If ABMS requires no improvement, then maintain it and don't repair it unnecessarily)
MRM results to be reported to governing body (if any) and retain documented information/evidence.
Governing body (if any) shall review the ABMS for further action (investigation) if any by anti-bribery compliance function. Anti-bribery compliance function shall assess to ensure that AMBS is adequate, implemented and effective including investigations/audit results to be reported to Governing body.
The organization may also use business associate (3rd party is recommended) to assist in the review. (This will usually happen when results are inadequate or found dissatisfactory due to lack of substantial evidence)
No comments:
Post a Comment