{"id":8639,"date":"2024-03-05T10:08:43","date_gmt":"2024-03-05T03:08:43","guid":{"rendered":"https:\/\/robere.co.id\/?p=1232"},"modified":"2024-03-05T10:08:43","modified_gmt":"2024-03-05T03:08:43","slug":"iso-37001-2016-bribery-risk-assessment","status":"publish","type":"post","link":"https:\/\/robere.dg-apps.com\/id\/iso-37001-2016-bribery-risk-assessment\/","title":{"rendered":"ISO 37001:2016, Based Bribery Risk Assessment"},"content":{"rendered":"

Authored By, Rian <\/span>Munanjar<\/span>, Lead Consultant GRC – Robere & Associates (Indonesia)<\/span><\/span>\u00a0<\/span><\/strong><\/em><\/p>\n

Implementing <\/span><\/span>ISO 37001:2016<\/span><\/span>, the Anti-Bribery Management System (ABMS), offers significant benefits to organizations, including enhanced reputation, reduced legal and financial risks, and improved stakeholder relationships. This standard also fosters an organizational culture that rejects bribery, promoting integrity and transparency in all business aspects.<\/span><\/span>\u00a0<\/span><\/p>\n

Understanding ISO 37001:2016<\/span><\/span>\u00a0<\/span><\/h3>\n

ISO 37001:2016<\/span><\/span>, the Anti-Bribery Management System, introduces a comprehensive framework for managing bribery risks in daily operations and business transactions. Key elements of this standard include an anti-bribery policy, due diligence procedures, anti-bribery employee training, bribery risk evaluation, business associate due diligence, and ongoing monitoring of the anti-bribery management system’s effectiveness. Bribery risk management is one of the critical <\/span>initial<\/span> steps for organizations aiming to implement an ABMS.<\/span><\/span>\u00a0<\/span><\/p>\n

Why Organizations Need to Conduct Bribery Risk Assessments Based on ISO 37001:2016<\/span><\/span>\u00a0<\/span><\/h3>\n

The objective of a bribery risk assessment is to enable an organization to establish a robust foundation for implementing an Anti-Bribery Management System.<\/span> Through the identification of bribery risks, organizations can focus on priority risks. By understanding the priority risks that must be addressed, organizations can accurately implement risk mitigation strategies, control implementation, and <\/span>allocate<\/span> necessary resources.<\/span><\/span>\u00a0<\/span><\/p>\n

How to Assess Bribery Risks According to ISO 37001:2016?<\/span><\/span>\u00a0<\/span><\/h3>\n

When conducting a bribery risk assessment, organizations need to consider several provisions:<\/span><\/span>\u00a0<\/span><\/p>\n

1. Organizations must establish <\/span>criteria of<\/span> levels of bribery risk, <\/span>taking into account<\/span> organizational policies and objectives.<\/span><\/span>\u00a0<\/span><\/strong><\/h3>\n

The determination of bribery risk criteria levels typically <\/span>utilizes<\/span> a <\/span><\/span>Risk Heat Map<\/span><\/span>. A <\/span><\/span>Risk Heat Map<\/span><\/span> measures the level of risk by considering Likelihood (the probability of a risk occurring) and Impact (the consequence of a risk occurring).<\/span><\/span>\u00a0<\/span><\/p>\n

\"ISO<\/p>\n

Likelihood<\/span><\/span> represents<\/span> the probability of a risk occurring, relative to its infrequency over a certain period or number of occurrences. Below are examples of criteria for <\/span>determining<\/span> <\/span>likelihood<\/span><\/span> values:<\/span><\/span>\u00a0<\/span><\/p>\n

[table id=12 \/]<\/p>\n

Meanwhile, <\/span><\/span>Impact<\/span><\/span> refers to the consequences of a risk occurring. Below are examples of criteria for <\/span>determining<\/span> <\/span>impact<\/span><\/span> values:<\/span><\/span>\u00a0<\/span><\/p>\n

[table id=13 \/]<\/p>\n

From the <\/span><\/span>likelihood<\/span><\/span> and <\/span><\/span>impact<\/span><\/span> assessment on the <\/span><\/span>Risk Heat Map<\/span><\/span>, the prioritization of bribery risks within an organization will be generated. An example of bribery risk priority levels is as follows:<\/span><\/span>\u00a0<\/span><\/p>\n

\"ISO<\/p>\n

In conducting a bribery risk assessment, organizations must assess both <\/span><\/span>inherent risk<\/span><\/span> and <\/span><\/span>residual risk<\/span><\/span>. <\/span><\/span>Inherent risk<\/span><\/span> is the risk that exists before any mitigation efforts or controls, or other actions are <\/span>established<\/span> to reduce the risk from its <\/span>initial<\/span> level to a more acceptable level for an organization. Meanwhile, <\/span><\/span>residual risk<\/span><\/span> is the risk <\/span>remaining<\/span> after mitigation efforts and controls are implemented to reduce inherent risk. This <\/span><\/span>residual risk<\/span><\/span> is what organizations must manage based on <\/span>previously<\/span> determined risk mitigation strategies.<\/span><\/span>\u00a0<\/span><\/p>\n

\"ISO<\/p>\n

Below is an example of a bribery risk assessment related to the procurement process, including how an organization addresses such risks:<\/span><\/span>\u00a0<\/span><\/p>\n

\"ISO<\/p>\n

2. Organizations must conduct bribery risk assessments periodically.<\/span><\/span>\u00a0<\/span><\/strong><\/h3>\n

The provisions for conducting <\/span>bribery risk<\/span> assessments are as follows:<\/span><\/span><\/p>\n