8.8 - Managing inadequate anti-bribery controls : Handling unmanageable corruption risks

The ISO 37001 Anti-Bribery Management Systems standard, instituted by the International Organization for Standardization in 2016, directs organizations globally in fortifying their anti-corruption frameworks. This standard is pivotal for both private and public entities of any size, focusing on active prevention, detection, and management of bribery risks.

How to Answer the Question

When an organization faces corruption risks that existing controls cannot manage and new controls are impractical or undesirable, several strategies can be adopted:

1.   Risk Avoidance  :

  - The organization might choose to avoid certain high-risk activities or markets altogether if the corruption risks outweigh potential benefits. This decision should be made after a thorough risk assessment and consultation with compliance and legal advisors. For more about risk avoidance strategies, refer to the [International Chamber of Commerce Guidelines](https://iccwbo.org).

2.   Strengthening Existing Controls  :

  - Where new controls are not feasible, strengthening existing controls through increased oversight, enhanced training, and more rigorous enforcement can be effective. This might include increasing the frequency of audits or the depth of background checks. The [OECD Guidelines for Multinational Enterprises](https://www.oecd.org/corporate/mne/) provide further insights on enhancing existing controls.

3.   Third-Party Monitoring  :

  - Engage external auditors or compliance consultants to monitor high-risk activities. This external oversight can provide an unbiased review of the organization’s compliance practices. For guidance on implementing third-party monitoring, visit [Transparency International](https://www.transparency.org).

4.   Contractual Safeguards  :

  - Implement stringent contractual safeguards, including anti-corruption clauses and right-to-audit clauses, which can provide legal recourse in the event of corruption-related breaches by business partners. Examples of such contractual terms can be found at the [United Nations Global Compact](https://www.unglobalcompact.org).

Why It's Important

Addressing unmanageable corruption risks is crucial for several reasons:

-   Legal Compliance  : Ensures the organization remains compliant with applicable anti-corruption laws, thus avoiding legal penalties and sanctions.

-   Reputation Management  : Protects the organization's reputation by demonstrating a commitment to ethical business practices.

-   Operational Integrity  : Ensures that business operations are conducted on a transparent and ethical basis, which is vital for sustainable growth.

For additional context on the importance of managing corruption risks, the [World Bank's resources on governance and anti-corruption](https://www.worldbank.org/en/topic/governance) can be consulted.

Examples

-   Example A  :

 -   Context  : A multinational corporation identifies high corruption risks in certain emerging markets.

 -   Action  : It decides to exit these markets after determining that mitigating the risks would require unacceptable compromises or illegal activities.

 -   Outcome  : This decision helped the corporation maintain its global reputation and avoid potential legal troubles.

 - Additional resources on market exit strategies can be explored at [Harvard Business Review](https://hbr.org).

-   Example B  :

 -   Context  : A technology firm discovers that its existing controls are insufficient to manage the bribery risks posed by third-party vendors.

 -   Action  : It enhances its vendor vetting process, increases the frequency of compliance audits, and implements stricter contractual requirements.

 -   Outcome  : These measures reduce the risk of corruption, ensuring that all vendors align with the firm’s ethical standards.

 - For further reading on vendor management, see [Gartner’s insights on third-party risk management](https://www.gartner.com).

By taking these measures, organizations can effectively manage corruption risks even when the introduction of new controls is not feasible. These strategies help ensure that the organization remains committed to high standards of integrity and compliance.