This presentation has been delivered by Jean-Pierre Méant at the PECB Insights Conference 2018 in Paris.

1. Auditing
Anti-Bribery
Jean-Pierre Méan
Attorney, Eigenmann Associés

2. 2
What is ISO?
 International Organisation
for Standardisation
 Private association under
Swiss law
 161 members – National
Standardisation Bodies

3. 3

4. 4
The different Types of Standards
 Over 20’000 standards
 Management system standards
 Guidance and requirements standards

5. 5
The Auditing of Standards
The various kinds of audits
 First party audits
 Second party audits
 Third party audits

6. 6
ISO Auditing Framework
 ISO/IEC 17011 : Requirements for accreditation bodies
 ISO 19011 : Guidelines for auditing management
systems
 17021-1 : Requirements for audit and certification of
management systems
 17021-9 : Requirements for auditing and certification of
anti-bribery management systems

7. 7
Accreditation bodies
 Accredit certification bodies
 Grouped in International Accreditation Forum: IAF
 COFRAC, DAkkS, UKAS, Accredia, ANAB, ANSI,
IAS…
 Conduct regular assessments of conformity assessment
bodies
 Accreditation ensures level certification playing field
 Not all accreditation bodies accredit for ISO 37001

8. 8
Guidelines for auditing management
systems

9. 9
Requirements for audit and certification of
management systems (1)
 Legal entity or governmental body
 Confidentiality

10. 10
Requirements for audit and certification of
management systems (2)
Impartiality
 No consultancy by certification body or controlled entities
 No outsourcing to consultancy organization
Minimum two year cooling off period for audits following:
 internal audits
 consultancy by related entities
 consultancy by individual auditors

11. 11
Requirements for auditing anti-bribery
management systems (3)
Specific additional auditors’ competencies for anti-bribery -
Knowledge of :
 Bribery concepts
 bribery risk, scenarios, indicators, controls
 Context of the organization
 Laws, regulations
 Bribery risk assessment and due diligence
 Bribery risk
 Anti-bribery controls
 Anti-bribery management systems

12. 12
Pre-certification activities
 Scope of certification
 Audit time
• Considering size and location, complexity, maturity of
system…
• Possibility : Adapt QMS table in IAF MD 5:2015 by
considering only exposed personnel + square root of
other personnel
 Multi-site sampling
 Areas for improvement
 Select audit team
 Dates and sites
 Persons to be interviewed

13. 13
Audit - Stage 1
Off-site, partly on-site
 Review documented information
 Obtain information on sites, processes, equipment,
controls, statutory requirements
 Allocation of resources
 Establish readiness for stage 2

14. 14
Audit - Stage 2
On-site
 Opening meeting
 With management + functions/processes to be
audited
 Conducted by audit team leader
 Explanation of audit
 Introduction of participants
 Presentation of auditee
 Confirmation of logistics and audit details

15. 15
Audit - Stage 2
On-site
 Logistics
 Office space and assistance
 Interviews should be conducted without
management presence, exceptionally in office of
interviewee
 Auditors should pay for their own meals (possible
exception for meal in auditee’s cafeteria)
 Notes should be made of interviews
 Copies/screenshots should be provided of
documents consulted

16. 16
Audit - Stage 2
On-site
 Interviews
 Chair of Board and/or Audit or Ethics Committee
 Chief Executive Officer
 Other members of top management : e.g. Finance,
Marketing
 Functions : HR, Communication, Internal Audit,
Legal, Compliance, Anti-bribery, Public Relations,
Procurement, Security
 Selected personnel

17. 17
Audit - Stage 2
On-site
 Documentation (as relevant to anti-bribery):
 Policies, procedures, contractual documentation
 Internal and external communication media
 Minutes of Board and Top Management meetings
 Annual Report, Corporate Responsibility Report
 Internal audit reports
 Investigation reports

18. 18
Audit - Stage 2
On-site
 Processes and activities
 Internet and intranet
 Selected due diligence file
 Management of business associates
 Risk assessment
 Training sessions, content and attendance
 Management of reporting system
 Implementation of gifts and hospitality policy
 Sponsoring

19. 19
Audit - Stage 2
On-site
 Closing meeting
 With management + functions and processes
audited
 Conducted by audit team leader
 Presentations of non-conformities
 Decision on certification recommendation
 Agreement on timeframe for responding
 Recording of diverging opinions if any

20. 20
Non-conformities
Non-fulfilment of a requirement
 Minor non-conformity
 Not an obstacle to certification
 proposal for corrective action within 3 months
 Major non-conformity
 Obstacle to certification or reason to withdraw
certificate
 If not corrected within 6 months from end of stage 2,
new audit

21. 21
Audit - Report
 Covers details of audit including:
 Identification of audit team
 Dates and places of activities
 Audit findings, evidence and conclusions
 Unresolved issues
 Recommendation
 Statement of conformity of system to meet
requirements

22. 22
Post-audit activities
 Submission of proposal for correction of non-
conformities by auditee
 Review effectiveness of corrections by auditors
 Documentary review or verification on-site
 Certification decision

23. 23
Audit cycle
 Initial audit
 Year 1 : surveillance audit
 Year 2 : surveillance audit
 Year 3 : re-certification

24. 24
J.P. Méan
Jean-pierre.mean@bluewin.ch