PART 5 - ANTI BRIBERY MANAGEMENT SYSTEM (ISO 37001:2016) - by Nik Zafri

 (Anti Bribery Management System = ISO 37001:2016)

3.0 PLANNING

This element links back to identified (bribery) risks and types of mitigation (risks and opportunities of improvement) as mentioned in the previous article. In planning, there should be a sense of assurance that the objectives will work. 

Risks require a plan which entails prevention and "what if" situations e.g. if they fail. (Back up plan is required)

No planning requires no improvement. It's not perfect. You'll learn through experience.

Thus, especially your manual and your procedures addressing risks of briberies, level of risks and possible mitigations should be part of the core process of the organization.

Mitigation is something to be based on experience. You may need brainstorming session(s) to see and test the viability of mitigation especially to possibility of "new bribery risks" that is unexpected.

Evaluate the planning process and execute the plan.

Objectives

The (measureable) objectives as mentioned earlier should be at the departmental and functional level. In making the objectives, it should adopt a cascading concept to the policy. (sort of the Drucker's MBO concept)

(A word of caution : Never treat the policy, objectives or other documented information as merely to comply with the standard and/or law requirements, the organization must feel that "This is the company policy, this is the company's objectives etc" or better "ABMS is part of the company's culture" - to have the sense of ownership towards the system)

Objectives must be practical not something that is "plucked from the sky". Sometimes achievement is not necessarily a measure of success as past achievements are also subject to further review. (as the law or standard changes or poor achievement is witnessed in the past)

Like policy, the objectives must be communicated (usually every department, unit and functions should have it documented or pasted or spread through the respective network throughout the department/unit/function)

Planning should involve the next course of action (including legal where necessary), resources, responsibilities and authorities, a time frame for achievement/reviewed or improvement.

PART 4 - ANTI BRIBERY MANAGEMENT SYSTEM (ISO 37000) - by Nik Zafri

 (Anti-Bribery Management System/ABMS = ISO 37001:2016)

2.0 LEADERSHIP

Leadership is not limited only to the executive and top management, but it should also include the Head of Departments, Supervisors, Immediate Superiors, Administrative positions and equivalent.

All levels of leadership must have a sense of strong commitment to uphold the requirements of Anti-Bribery Management System (ABMS)

Governing body

The standard mentions the phrase "governing body". In this context, it refers to a special committee formed by the organization. To ensure impartiality, it is recommended that this special committee should function as independent commission with minimal intervention by the executive and top management. The  committee should comprise of nominated member(s) of the Board of Directors (BOD), external civil servant from the authorities such as Anti Corruption Agency  or Institute of Governance or equivalent, legal practitioner, Auditor (both internal and external) Management Representative etc.

The duties and responsibilities of the "governing body" is to approve the ABMS policy and ensuring its' consistency with other organizational policies, plans, manual, procedures etc., review and approve report on ABMS status after a certain cut-off period. Resources; as far as is practicable; such as laptops, online/communication and network facilities, work station etc are to be provided to facilitate their work such as risk assessments, recommendations on the type of documented information required, protection of whistleblowers etc.

Cooperation and Effective Communication taking into account transparency are to be taken seriously into account. 

In the absence of a governing body (which is not recommended to minimize partiality), the top management shall assume the duties of the body.

Policy

A policy should be made to address the seriousness of bribery, compliance to the anti-bribery laws, setting/reviewing/achieving ABMS (measurable) objectives  (department/unit), whistleblowing protection and commitment to provide resources/review/continual improvement of the policy. 

As other certification standards requirement, the policy to be available at all times (usually also included in the ABMS Manual) - including stakeholders,  communicated (and translated if necessary where the English or native language shall prevail in case of ambiguity) and/or displayed.

Roles, Responsibilities and Authorities

Top management shall be responsible to implement and comply with ABMS. Thus, responsibilities and authorities (usually by means of Job Description) and ABMS 

Objectives to be assigned and communicated throughout the organization. If there is a governing body, they are to adopt a check and balance approach with the top management.

Anti-Bribery Compliance Function

a) Design/Implementation of ABMS, 

b) Advice/counsel/guide to personnel involved in ABMS,

c) To comply to the ABMS requirements

d) Reporting ABMS performance to the governing body

All 3 significant parts of the organization namely governing body, top management and the leadership function shall have the necessary competence (by means of training if necessary), status, authority and independence. (These are also rules to good governance practice)

Access to to be made to the governing body/top management should there be any concerns raised (red and yellow flags/alert) on evidence, suspicion, investigation or issues on the ABMS itself.

Delegated Decision-Making

Delegation of authority is also linked to the Job Description. The governing body, top management and the personnel involved should be aware of their respective authorities. There should be a set of controls to address decision process and authority level of decision making. Decision making should take into account the possibility of conflict of interest, impartiality and independence. Again the role of independent governing body is important to ensure the "check and balance" process running smoothly

PART 3 - ANTI-BRIBERY MANAGEMENT SYSTEM - by Nik Zafri

1. Context of the Organization

Most of the contents are almost similar to any other quality, safety and environmental certification standards. With exceptional the use of "Anti Bribery Management System (ABMS)" in lieu of QMS, OHSMS and EMS.

It's important to identify and customize ABMS to the overall business nature of the organization be it internal or external. Not everything may apply to the organization practicing ABMS but to link most of the elements to the core processes would be an added advantage. 

Most important, all activities and relevant documented information to also take into account applicable statutory, regulatory, contractual and professional obligations and duties. 

2. Stakeholders

In this sense, not limited to the following, stakeholders could be :

a) Board of Directors (BOD) or equivalent - in this sense, directors that possess a certain portion of shares and with executive authorities to execute their duties and responsibilities to ensure that resources are provided to ensure the success of ABMS. They must also have a fair knowledge of the relevant regulations and ABMS.

b) Management Representative (MR) - although most of the latest revision of the standards may have ommitted "MR", it's still required to have one either a member of the BOD or a member of the organization who possess sufficient experience, qualifications and competency to become the "watchdog" of the system. 

c) Non-Executive Directors or equivalent - this would apply to advisors; despite limited to making recommendations; they should also be fully aware of applicable regulations and ABMS

d) Representatives from Service Providers - namely Consultants, Contractors and Suppliers/Vendors - they are also involved in ABMS and is bound to ethics and requirements of the ABMS procurement contract and procedures, 

e) Investors - for public and public listed companies, the prospectus, annual reports or magazines (online and offline) or press conferences should highlight the initiatives taken by the organization and how investors can play their roles in ABMS,

e) Representatives from the general public or people from the surrounding areas of operation. It's also a good practice to involve relevant NGOs as well.

f) Authorities - involving Anti-Corruption Commission, Corporate Governance, Company Laws, Security Commission, Anti-Money Laundering, Central Bank and the finances and banks as well. Communications should be well-established with these entities.

It is important to note that "whistleblowers" MUST be protected at all times.

3. Scope

"Scope" is relevant to the nature of business of the organization taking into account internal and external issues and risk assessment. Documented information to determine and clarify the scope should be included in the ABMS Manual of the Organization.

4. Anti-Bribery Management System (ABMS)

Again, the keywords :

i)  Establish

ii) Document

iii) Implement

iv) Maintain

v)  Review

vi) Improve

are included in ABMS to manage documented information (document, data and records) just like any other certification standards.

Most important - whether it's a Policy, or Manual or Plan, or Procedures (Administrative and Operation) or Work Instruction or Method Statement or Inspection and Test Plan (even checklists) - a clear and thorough process flow (typical 4 columns - no., process, person in charge (PIC) and relevant documented information - should be included and related to the documented information. These documented information should take into account ABMS standard, relevant regulations and where applicable contractual requirements.

The documented information should also contain measures designed to identify and evaluate the risk of, and to prevent, detect and respond to, bribery.

Despite to eliminate risk of bribery is almost impossible, it is advisable to have a target set for every cut-off period of implementation.

5. Risk Assessment 

a) Identify the bribery risks - proactively if necessary (based on past experience) or as per recommendation from external party,

b) New and unexpected risks could be identified as the implementation goes - analyze (data analysis), assess and prioritize (e.g. the typical Red, Yellow, Green coloured bands - with justifications)

c) Identify proactive mitigation or new mitigation for unexpected risks found during assessment,

d) Be reviewed (usually in the Management Review Meeting)

e) Be susceptible to change in the country laws/legislations or the standard or any other guidelines from the relevant parties.

Should there be a repetitive trends, then it is important to look back at the risks been identified during the commencement of the system (ABMS)

PART 2 - ANTI-BRIBERY MANAGEMENT SYSTEM - by Nik Zafri

Note : For all parters of my articles, I will not touch clause 2.0 and 3.0. The articles may follow the sequential order of the standard clauses or quoting certain paras/phrase from the standard but the contents are mostly self-explanation based on my understanding and experience. The contents may also be customized to the Malaysian environment with some references cited from international laws and case studies.

Scope

All documented information is recommended to use anti-bribery laws and voluntary commitments as their guidelines.

Among others, ISO 37001:2016 entails the need for detect, prevent and respond to many types of bribery. The scope involves personnel, associates, business activities, 3rd parties from public, private and not-for-profit sectors (example NGO). 

This means that it's not limited only to clients but also branching out to customers, JV, JV partners, consortium partners, outsourcing providers, contractors, consultants, sub-contractors, suppliers, vendors, advisors, agents, distributors, representatives, intermediaries and investors.

For public official, the system should also cover person holding a legislative, administrative or judicial office, whether by appointment, election or succession, or any person exercising a public function, including for a public agency or public enterprise, or any official or agent of a public domestic or international organization, or any candidate for public office.

These requirements are typically addressed in the Anti Bribery Management System (ABMS) Manual. 

Although the standard may not be thorough, to organizations practicing (corporate) governance especially Public and Public Listed Company, the manual and the associated procedures should include fraud, cartels, anti-trust/competition offences, money laundering etc.

However, this may require a joint effort between those in the financial positions and the duly authorized personnel from the management.

It is recommended the organization work closely to Bank Negara Malaysia, Security Commission, Registrar of Company/Society etc. for more information on legislation or conditions for public-listing/investment.

ANTI-BRIBERY MANAGEMENT SYSTEM - PART 1 - by Nik Zafri

While the world is not fully out of the Covid-19 pandemic, we are still facing another pandemic what seems to have no cure to it. This pandemic is known as Bribery.

Bribery in any forms has evolved itself to become part of the twisted culture in many industries and sectors - even in the civil services.

It is known as a hindrance to good and clean practices, governance, economy, social and even moral. Hence it has also lead to imbalance and creation of gaps between the rich and the poor via means of taxation and cost of living. The quality and safety of products and services provided are also badly affected by bribery.

Enforcement of the law on many cases of bribery; whilst making good progress; has also been known to meet dead-ends when powerful figures decide to intervene in the judiciary system.

Despite many government endless efforts to address bribery domestically or internationally, the progress seem to be too slow which is evident when arrests have been made only to certain small groups rather than the big planners behind bribery. 

As we all know, having laws without proper guidelines and monitoring of compliance will not be effective. Organizations and industries must adopt a self-governance by having their own standards, policies and procedures.

This is the reason why we need a specific standard now known as ISO 37000 - an ambitious effort to reduce risks of bribery in organizations and industries.

However, I still see the infamous disclaimer :

"Conformity with this document cannot provide assurance that no bribery has occurred or will occur in relation to the organization, as it is not possible to completely eliminate the risk of bribery. However, this document can help the organization implement reasonable and proportionate measures designed to prevent, detect and respond to bribery"

I believe that having the proper policies and documented information based on this standard can become evidence in the eyes of the law - thus, I honestly think that this statement is a little redundant.

I also believe that both law and standard should also provide justice to innocent victims or black sheeps which may require element of forensic auditing skills and just like financial audit, the auditors should be able to lodge reports once proven to the authorities without any tampering from the organization being audited whether the auditor is internal (staff) or an external auditor from the certification body.