An international standard called ISO 37001 offers a methodical way of managing bribery. With the help of this standard, businesses may set up, carry out, keep up with, and constantly improve their anti-bribery management systems, which essentially gives them the ability to address bribery risks and stop, find, and deal with bribery.
The ISO 37001 standard addresses all types of bribery, including active bribery, which involves offering or paying a bribe, passive bribery, which involves soliciting or accepting a bribe, bribery of public officials in the public sector, bribery of employees of private companies or other private organizations, or bribery of private individuals in the private sector; Bribery committed directly by a company or its employees, or indirect bribery committed through agents, consultants, or outsourced partners.
The organization can build a strong foundation for its anti-bribery management system thanks to the bribery risk assessment. The methodology for risk assessment is dependent on two elements for example how bribery risks are considered and weighed. Correspondingly, the extent to which the organization accepts or tolerates the risk of bribery.
The organization decides on its requirements for assessing bribery risk while taking into account a variety of elements. The four key phases of the risk assessment design are described here, along with their respective purposes and objectives.
First phase: - Criteria for evaluating the level of bribery risk
The first phase of the risk assessment process establishes criteria for evaluating the level of bribery risk, the organization's ISO 37001 policy documents and objectives are taken into account when criteria for determining the amount of bribery risk are established. Understanding the risk's impact and likelihood of occurrence will help a business do this. The risk's acceptance or toleration level is taken into consideration when calculating the impact. The likelihood of risks is scored on a five-point scale to assess risk. For example, it is very unlikely to occur, unlikely to occur, could occur, likely to occur and almost certain to occur. Similarly, the following factors should be considered when calculating the impact rating:
- Financial impacts
- Organization’s status
- Strategic aims
- Improving scenario
Second phase: - Identifies the risk
The second phase of the risk assessment process is risk identification, which entails locating, detecting, and describing hazards that may hinder an organization from accomplishing its goals. The organization's environment, including the nature of its activities, business, and locations, is used to identify risks. The second phase includes
- Personnel in important sectors are being interviewed
- Reviewing internal and external audit reports or hotline records
- Analyzing past incidents that took place in the organization or similar organizations
- Obtaining advice from lawyers, auditors or other professionals
The risk categories concerning bribery include the following:
- Country risk: How common is bribery in each of your locations?
- Sectoral risk: Is bribery prevalent in the organization's industry?
- Business partners’ risk: Is the organization involved in business partnerships over which it has no complete control?
- Public sector risk: In how many activities do people interact with governmental officials?
Third phase: - Risk analysis and evaluation
The risk analysis and evaluation phase is the third phase of the risk assessment. The risk analysis is carried out by applying risk criteria to the hazards identified in the various categories, which include the likelihood and impact of occurrence. Furthermore, it is determined how likely the risk is to occur, and if it does, what the negative impact on the company will be. Each category receives a risk score as a result of the analysis.
Fourth phase: - Risk response and monitoring by management
The fourth phase is risk response and management monitoring to bring the residual risk within the intended level of risk exposure. Possible responses include:
- Avoidance: The first and most preferable response is to avoid the risk by discontinuing the risk-bearing activity or abandoning a market to remove the risk from its source.
- Mitigation: Another option is to utilize or install standard controls that reduce the risk within the organization to an acceptable level.
- Transfer: Shifting the risk to another party in some circumstances, such as engaging with customers or suppliers through contractual relationships.
- Acceptance: Finally, the risk response can consist of accepting the exposure.
