VII Jornada CPIC de Ética y Lucha Anticorrupción

1. © 2019 GIACC 1
Purpose and benefits of ISO 37001
Anti-Bribery Management System Standard
_________________
Neill Stansbury
Chairman: ISO 37001 Project Committee
Co-founder and Director: GIACC
www.giaccentre.org

2. © 2019 GIACC 2
Need for anti-bribery management controls (1)
 The costs, damage and risks to public sector and private sector
organisations caused by bribery are now well known.
 In particular, bribery in procurement and project management can result
in increased costs, and defective and dangerous work and products.
 Organisations and individuals involved in bribery are at risk of criminal
liability, financial loss and reputational damage. Individuals can be
imprisoned.

3. © 2019 GIACC 3
Need for anti-bribery management controls (2)
 Therefore, it is increasingly recognised as vital that public and private
sector organisations implement effective anti-bribery controls as part of
their management procedures.
 Bribery prevention should be treated in a similar manner to safety, quality
and environmental management.
 Organisations need to know what anti-bribery procedures should be
adopted so as to effectively prevent bribery.

4. © 2019 GIACC 4
Need for anti-bribery management controls (3)
 There were calls for a definitive set of minimum standards, so that an
organisation, if it adopted these minimum standards, could be reasonably
comfortable that it had done all that was reasonably possible to prevent
bribery.
 Minimum standards would also help level the playing field if all
organisations were required to work to the same standards, and would
help organisations choose business partners who also worked to these
standards.
 Minimum standards existed for organisations in relation to safety, quality
and environmental management. Could the same approach be used for
anti-bribery management?

5. © 2019 GIACC 5
What is ISO 37001 (1)
 To meet this need, ISO 37001 was published.
 ISO 37001 is an anti-bribery management system (ABMS) standard for
organisations.
 It was published in 2016 by the International Organisation for
Standardization (ISO): a non-governmental international organisation
with a membership of national standards bodies from 162 countries.
 ISO 37001 specifies the anti-bribery policies and procedures which an
organisation should implement to assist it prevent bribery, and identify
and deal with any bribery which does occur.

6. © 2019 GIACC 6
What is ISO 37001 (2)
 It is applicable to small, medium and large organisations in the public and
private sector.
 It can be used in any country.
 It requires organisations to implement various anti-bribery measures on a
reasonable and proportionate basis according to the type and size of the
organisation, and the nature and extent of bribery risks faced.
 Organisations can get independently certified to ISO 37001 in a similar
way to ISO 9001 (quality), ISO 14001 (environment), ISO 45001 (safety)
and other ISO management standards.

7. © 2019 GIACC 7
Development of ISO 37001 (1)
 ISO 37001 was developed by Project Committee with the following
members.
 Participating countries (37): Australia, Austria, Brazil, Cameroon, Canada,
China, Columbia, Croatia, Czech Republic, Denmark, Ecuador, Egypt,
France, Germany, Guatemala, India, Iraq, Israel, Kenya, Lebanon,
Malaysia, Mauritius, Mexico, Morocco, Nigeria, Norway, Pakistan, Saudi
Arabia, Serbia, Singapore, Spain, Sweden, Switzerland, Tunisia, UK, USA,
Zambia.
 Observing countries (22): Argentina, Armenia, Bulgaria, Chile, Cyprus,
Cote d’Ivoire, Finland, Hong Kong, Hungary, Italy, Japan, Korea, Lithuania,
Macau, Mongolia, Netherlands, New Zealand, Poland, Portugal, Russia,
Thailand, Uruguay.

8. © 2019 GIACC 8
Development of ISO 37001 (2)
 Liaison organisations (8): ASIS, European Construction Industry
Federation (FIEC), Independent International Organisation for
Certification (IIOC), International Federation of Consulting Engineers
(FIDIC), IQNet, Organisation for Economic Co-operation and Development
(OECD), Transparency International (TI), World Federation of Engineering
Organisations (WFEO).
 Committee Secretariat and Chair: British Standards Institution (BSI).

9. © 2019 GIACC 9
Benefits of ISO 37001 (1)
 Provides assurance to owners, directors, employees and business
associates that organisation is taking adequate steps to prevent bribery.
 Can be used as project pre-qualification requirement (i.e. organisations
may only be allowed to bid for major projects if they have a certified ISO
37001 programme).
 Can be used as a business associate due diligence mechanism (i.e. that a
business will only work on major transactions with other organisations
which have a certified ISO 37001 programme).
 Can enhance an organisation’s reputation (e.g. can be displayed on web-
site, used in promotional material etc., to show that the organisation
operates in an ethical manner).

10. © 2019 GIACC 10
Benefits of ISO 37001 (2)
 Can be used to help an organisation’s defence in the event of a bribery
investigation.
 Many countries’ laws (e.g. USA, France, UK, Italy) either require
companies to have anti-corruption programmes in place, or allow proof
of an adequate programme to act as a defence or mitigating factor in the
event of a prosecution.
 Therefore, possession of an independently certified ISO 37001 can help
prove to a prosecutor or judge that the organisation had adequate anti-
bribery procedures in place.

11. © 2019 GIACC 11
Requirements of ISO 37001
 ISO 37001 requires an organisation to implement an anti-bribery policy
and supporting anti-bribery procedures.
 These procedures are specified in detail in ISO 37001, and an organisation
must comply with all of them in order to be compliant.
 These procedures must be implemented by the organisation on a
reasonable and proportionate basis according to the type and size of the
organisation, and the nature and extent of bribery risks faced.
 The detail on these procedures will be described by Emilio Colon in his
presentation.

12. © 2019 GIACC 12
Cost of implementation (1)
 The cost of implementing an ISO 37001 compliant ABMS will depend on
many factors such as:
 size of the organisation
 complexity of its structure and operations
 where it does business
 number of interactions it has with other organisations
 how advanced its existing programme is.
 If the organisation chooses to get its programme independently certified,
there will also be the cost of certification. This cost is also likely to vary
according to the above factors (which is the same as with e.g. ISO 9001).

13. © 2019 GIACC 13
Cost of implementation (2)
 Cost is unlikely to be a competitive disadvantage. Likely to be an
advantage if:
 a procuring entity requires all its bidders to be compliant with ISO
37001; or
 additional points given in the procurement evaluation for evidence of
anti-bribery policies.
 Cost of implementing system likely to be minimal when compared to loss
and damage which could be suffered by an organisation which gets
involved in bribery. System can help prevent loss.

14. © 2019 GIACC 14
Certification: Overview
 Organisations can get certified to ISO 37001 in a similar way to ISO 9001
etc. Numerous organisations internationally now have obtained ISO
37001 certification.
 Certification is undertaken by way of an independent audit of the
organisation’s compliance with ISO 37001.
 If the audit establishes that organisation is compliant, a certificate of
compliance with ISO 37001 is issued.
 Certification provides independent assurance to the organisation and its
stakeholders as to the organisation’s compliance.

15. © 2019 GIACC 15
Certification: Certifying bodies
 For the standard to achieve widespread adoption and recognition
internationally, there needs to be a strong pool of reputable certifying
bodies with ability to certify to ISO 37001.
 Numerous national and international certifying bodies now offer ISO
37001 certification.
 Examples of major international certifying bodies offering ISO 37001
certification:
BSI, DNV, BV, LRQA, AFNOR, PECB, RINA,
TÜV, SIRIM, CDG, SII, DQS, NQA, SGS, ANSI

16. © 2019 GIACC 16
Certification: Accreditation bodies
 For the certifications to maintain credibility, there needs to be recognised
accreditation schemes for the certifiers, so as to minimise the risk of
incompetent or corrupt certifiers.
 The accreditation bodies audit the certifying bodies, and certify that the
certifying bodies are competent to provide certification.
 Examples of major accreditation bodies offering ISO 37001 accreditation:
 COFRAC (France)
 DAKKS (Germany)
 ACCREDIA (Italy)
 UKAS (UK)
 ANAB (USA)

17. © 2019 GIACC 17
Certification: Certified organisations
Numerous major international organisations now certified to ISO 37001. No
central register, so total numbers are not known. Examples:
Edesur (Argentina) (electricity)
Emgesa (Colombia) (electricity)
Construtora Queiroz (Brazil) (constr.)
CIMC TianDa (China) (airport)
Alstom (France) (rail)
Credit Agricole (France) (banking)
Aeroporti di Roma (Italy) (airport)
Autostrade L’Italia (Italy) (road)
ENI (Italy) (oil and gas)
ENEL (Italy) (electricity and gas)
Pirelli (Italy) (tyres)
Saipem (Italy) (oil and gas)
Salini Impregilo (Italy) (construction)
Daewoo (Korea) (IT)
Korea Aerospace (Korea) (aerospace)
KEPCO (Korea) (construction)
Petronas (Malaysia) (oil and gas)
Road Department (Malaysia) (road)
Autoridad Nacion. Agua (Peru) (water)
Iberdrola (Spain) (electricity)
UBS (Switzerland) (banking)
Bosch Middle East (UAE) (electronics)
Morgan Sindall (UK) (construction)
Microsoft (USA) (computer software)

18. © 2019 GIACC 18
Certification: Approx. number by countries (1)
Country Certifications Country Certifications
Albania 1 Denmark 2
Angola 1 Dominican Rep. 1
Argentina 1 France 4
Austria 5 Germany 1
Azerbaijan 1 Greece 16
Bangladesh 2 Guatemala 1
Belgium 1 Hong Kong 1
Brazil 12 Hungary 1
Bulgaria 1 India 1
Chile 3 Indonesia 5
China 1 Ireland 1
Colombia 1 Israel 3
Cyprus 1 Italy 228

19. © 2019 GIACC 19
Certification: Approx. number by countries (2)
Country Certifications Country Certifications
Korea 60 Russia 4
Lithuania 2 San Marino 1
Malaysia 15 Sierra Leone 1
Mexico 26 Singapore 2
Moldova 1 Slovakia 6
Morocco 1 Spain 25
Netherlands 2 Switzerland 1
Norway 4 Turkey 4
Peru 6 Ukraine 2
Poland 6 UAE 4
Portugal 1 UK 17
Romania 10 USA 2

20. © 2019 GIACC 20
Outcome
 ISO 37001 cannot provide absolute assurance that no bribery will occur.
But it can help establish that the organization has implemented
reasonable and proportionate anti-bribery measures.
 The risk of bribery is reduced and the playing field is levelled for
organizations if proof of compliance with ISO 37001 is a project pre-
qualification requirement.
 Number of international certifications to ISO 37001 is gradually
increasing.
 The publication and use of ISO 37001 is therefore a major step forward in
the fight against bribery.
 For further information, see: www.giaccentre.org/ISO37001.php

21. © 2019 GIACC 21
Requirements & Benefits of ISO 37001
Anti-Bribery Management System Standard
____________________
End of Presentation:
Questions