Corruption and ISO 37001:

A new instrument to prevent it in international entrepreneurship

Abstract
Corruption is a distorting factor in the market and has negative effects on both public and
private administrations. It strongly affects international companies with high investments and
high revenues, influencing also the work of managers and decision-makers. After a brief
analysis of the context, the study proposes the analysis of a new risk assessment tool to prevent
corruption. This is the ISO 37001: 2016, a new UNI standard that, according to our analysis,
sees itself perfectly in a rational administration system and addresses all drivers that lead to
corruption behaviors.
Keywords: anti-corruption; ISO 37001; corruption; risk assessment
1. Introduction
Corruption is a constant concern for countries facing and analyzing the causes of the economic
crisis and a considerable amount of research has come to understand its economic effects. The
World Bank defined corruption as "abuse of the public Duty to generate private profit" [1].
Transparency International provides a similar but more general definition of "abuse of entrusted
power to generate private profit", which is not limited to the public sector as in the World Bank
but extends it to the private one. Going to analyze the causes in literature related to corruption
and the factors that influence, we can begin to have an overall consideration of the phenomenon.
The effect of corruption on growth was negative, but based its conclusion on the historical
analysis. The study that draws on its deductions on contemporary empirical experience is by
Mentre Wei who concluded that corruption had an adverse effect on growth by discouraging
foreign direct investment and encouraging increased spending in government by distorting
the composition of public spending. There are several pieces of evidence of how corruption has
negative effects on the economic growth. From other macroeconomic studies, it turns out that the
most corrupt society can allow for greater tax evasion, as corrupt officials seek more income
through bribes; On the contrary, higher tax evasion can lead to corruption by offering
more opportunities for bribes. Empirical evidence that controls the potential indigenousness of
evasion and corruption shows that corruption is to a large extent leading to higher levels of
evasion. "Tax evasion" is a related but very different concept, and refers to illegal and intentional
actions taken by individuals by reducing their legal tax obligations. Despite all this work on
corruption and tax evasion, there is very little work on their interrelation, especially as far as
business is concerned. The existence of a theoretical analysis combining corruption and evasion
does not focus on companies but on families. Although corruption and tax evasion may exist
separately, they can easily become embittered. Corruption allows tax evasion, making it easier
for taxpayers to conceal their income, while tax evasion can contribute to corruption by creating
additional opportunities for corruption. Some studies show that corruption is a driver for evasion.
The presence of tax inspectors requesting bribes involves a reduction in reported tax sales
between 4 and 10 percentage points. Moreover, higher bribes involve higher levels of evasion.
These findings support the argument that tax compliance depends on the quality and honesty of
tax authorities [9]. Some studies have highlighted how the corruption culture of a company, as
well as the corruption average attitude of officials and executives of a company using their
cultural information, falls on the corporate structure. The main finding of the study is that the

1
culture of corporate corruption has a significant positive effect on corporate misconduct, such as
earnings management, accounting fraud and opportunistic trading of insiders. The effects are
also economically significant: an increase in standard deviation in a company's corruption culture
is associated with an increase in the probability of bad business conduct by about 2-7%.
According to the Global Corruption Report, the sector where corruption is most present in the
health sector. Corruption is responsible for the lack of improvement in the health of different
populations. Another area where the influence of corruption is evident in the military one, there
is a correlation between growth in military spending and corruption. In this case, it is also shown
that the relationship between economic growth and public expenditure is less than the
expenditure itself, thus not empirically justifying the effect of corruption. International
entrepreneurship is growing and has many potentialities, although it grows at different speeds by
sectors. Given the characteristics of international entrepreneurship and the push of managers, it is
clear that our industry-based analysis is based on complex business structures often present in
multiple states, which need advanced risk assessment tools. All studies and evidence lead to
looking for a tool to be used to prevent corruption, thus avoiding market distortions. It is shown
how the tool must be generalizable and applicable to both public and private sectors and must be
able to engage and act on all drivers that can lead to corruption. The study intends to
investigate the new corporate management and control system introduced by ISO 37001: 2016
and to analyze whether the volunteer tool can deal with expressive drivers that encourage
corruption, subsequently highlighting the potential positive effects for the company after
the introduction of the instrument. In almost all states with a developed economy, penalties
have been introduced to prevent corruption as the only tool available to the government, but as
we have seen in the literature, these are not sufficient if not helped also by efficient tools other
than the legislative one. The tool is placed and integrates into theories related to rational
administration.
1.1. Anti-corruption and reference background
The spread of anti-corruption rules is becoming increasingly widespread with increased
sanctions. We refer, for example, to:
 Foreign Corrupt Practice Act (FCPA) which applies in principle to America for
offenses committed abroad, although the only link with the United States is that the operation
goes through the United States.
 UK Bribery Act 2010 (UKBA) which stipulates that the British company or any person
associated with the United Kingdom, even though birth, having a British passport or
residence can be prosecuted for bribes that they pay anywhere in the world.
Discussion ISO 37001 and anti-corruption instruments
The ISO 37001 standard, published on October 15, 2016, called "Anti-bribery management
systems - Requirements with guidance for use" is a useful tool to tackle corruption. The
responsible Technical Body is the Project Committee ISO / PC 278. As a rule adopted by the
UNI, it is a tool that can be applied in all States and therefore it answers the need to be adopted
with different laws. The regulation can be used alone or in conjunction with other management
system regulations (e.g. ISO 9001, ISO 14001, ISO / IEC 27001, ISO 19600) and other
management regulations (e.g. ISO 26000, ISO 31000). The regulation ISO 37001 that governs
this tool applies only to corruption. It defines requirements and provides a guideline to help an
organization: Prevent, detect, and respond to corruption, in addition, to Comply with anti-

2
corruption legislation and other voluntary commitments applicable to its activities. The
regulation is NOT specifically applicable to fraud, cartels and other competition violations,
money laundering, and other corrupt practices. However, an organization may choose to
extend the scope of its management system to include such activities. The requirements of ISO
37001 are general and are applicable to any organization (or part of the organization), regardless
of the type, size, and nature of the activity. The terminology used in order to identify the
responsibilities and actions to be taken has particular importance. In Table 3, the terminological
description that then distinguishes the application of the instrument in its phases.

3
Table 3. Main definitions of ISO 37001 Standard

Terminology Definition

Governing body Group or body that holds final responsibility and

authority for the activities, the administration and
policies of the organization headed by senior
management and which controls the responsibilities of
senior management.

Senior management Person or group of people who, at the highest level,

direct and control an organization

Policy Orientations and addresses of an organization formally

expressed by its own senior management or by its
governing body

Organization Person or group of people having their own functions

with responsibility, authority and relationships to
achieve their goals

Involved part or stakeholder Person or organization that can influence, be

influenced, or perceive itself as influenced by a
decision or activity.

Business partners The external part with which the organization has or
plans to establish any commercial relationship form.

Definitions of active corruption and passive corruption

Active corruption Passive corruption

Corruption on behalf of the organization Corruption of the organization

Corruption on behalf of personnel of the Corruption of the organization's personnel

organization acting on behalf of the that acts on behalf of the organization or for
organization or for its benefit its benefit

Corruption on behalf of related individuals Corruption of related individuals acting on

acting on behalf of the organization or for its behalf of the organization or for its benefit
benefit

Both direct and indirect (offered or accepted through/by a third party).

4
ISO 37001 establishes a bridge between two different cultures; that of management
systems and that of organizational models and anti-corruption plans. A management system: "set
of interrelated or interacting elements of an organization to establish policies and
objectives and processes to achieve those goals" (from ISO 9001). An organization's
compliance with ISO 37001's management system requirements does not mean that no case of
corruption has occurred or may occur, but it means that the organization has done what
reasonably (proportionately to the size and risks of the organization) possible to prevent
corruption cases from occurring. The new High-Level Structure envisages alignment with other
rules on management systems, identical titles, and key texts, basic vocabulary. Deming's
cycle and rational administration integrate into the management of actions and administrative
facts within the structure in order to develop a total quality system. ISO 37001 provides the
following steps:
Plan: Organization, roles and responsibilities (e.g. delegated decision making), internal and
external context analysis, Anti Bribery Policy, Bribery risk assessment, definition of the Action
Plan to introduce (cd. Action Plan), definition of supporting actions (resources such as bonuses
or disciplinary systems, skills that the components of the structure must possess, information and
training, archiving systems).
Do: Action Plan Implementation, Due Diligence (e.g. Third Party, M & A), Financial and
nonfinancial controls, Gifts, hospitality, donations and similar benefits, Whistleblowing,
Investigation.
 Check: monitoring and measurement, internal audit, review
 Act: continuous improvement
This risk assessment tool sees as a starting point the analysis of the organization's context as a
start to assess the risks. The internal and external factors that are relevant to the
organization (statutory and / or contractual / professional obligations, the structure and level of
decision-making powers, the size and places where it operates, the controlled entities and / or
that exert control over the organization, relations with public officials, business partners, etc.). It
is necessary to identify the involved parts (public and private) whose expectations are to be taken
into account. The scope of the system needs to be determined in terms of external and internal
factors, involved parts’ expectations, assessment of the risk of corruption. The organizational
context needs to be analyzed day by day as it is necessary to identify and evaluate periodically
(e.g. organizational changes and/or market/business) the risks that can be expected and the
existing controls, though:
 Definition of evaluation criteria (e.g. low/medium/high) taking into account factors such as
the nature of the risk, the probability, and the impact.
 Analysis of the organization's size/structure (e.g. concentration of management controls
and/or decentralization)
 Analysis of the sectors and territories in which it operates (e.g. corruption indexes)
 Examining affiliated business entities (e.g. suppliers and/or agents)
 Examining the nature and frequency of interactions with national or foreign public officials
 Assessing the degree of influence and control on the above elements
It is essential that the risk assessment should be available in the form of documented information.
For ISO 37001: 2016, risk assessment is a complex process that considers different factors, such
as organizational size and organization (e.g. branches abroad), place and sectors in which the

5
organization operates, activities and processes of the organization (small and medium-sized
enterprises, multinationals, local government, public companies), business associates, public
relations, breach of rules and regulations. The main phases of the risk management process are:
1. Context analysis: external context (characteristics of the external environment, e.g. cultural,
criminological, social and economic variables of the territory, which may favour the
occurrence of corrupt phenomena within the Entity); internal context governing bodies,
organizational structure, roles and responsibilities; policies, goals, and strategies; resources,
knowledge, systems and technologies; quality and quantity of personnel; organizational
culture, with particular reference to the culture of ethics; information systems and flows,
decision making (both formal and informal); internal and external relations.
2. Risk assessment: risk identification; risk analysis; risk weighting. After identifying the areas
at risk, by means of interviews, the risk profile should be assessed in a concrete way in order
to avoid identifying prevention measures that are too general and/or impracticable.
3. Identification of measures; programming of the measures. This phase aims at identifying the
remedial measures and the most appropriate ways of preventing risks, based on the priorities
emerging when assessing risky events and in particular adequately designed sustainable and
verifiable measures.
It is proposed the analysis of an organization's business model with the identification of the
Chain of Value
organizational structure, roles and people in key positions (Key Officer) in Figure 2. The analysis
starts from the value chain, considers processes of business and support processes in order to
identify the areas of risk.

Support Processes

Risk Areas
Figure 2 Analysis of the Organizational Model

6
The main areas at risk of active corruption are identified in the private sector in relationships with third
parts (JV consultants, relations with public officials and/or loans to associations and foundations,
financial flows, expeditions, personnel selection and management, trade and discount policy, donations
and sponsorships to events. The main areas of passive corruption in the public and private sectors are:
issuance of authorizations and/or permissions, issuance of certifications as independent third parts,
implementation of third-party inspections, purchases and/or contracts, selection and management of
personnel, provision of funds or contributions to third parties, donations, gifts and sponsorships to events.
To identify the risk, you have to consider the processes and understand how (through which behaviors)
processes could be manipulated/altered to encourage corruption. This manipulation/alteration translates
into an action on one or more elements of the internal control system. It is, therefore, possible to identify
some types of risk behaviors that need to be evaluated. After evaluating the pertinent corruption risks, the
organization can determine the type and level of controls for corruption’s prevention applied to each
category of risk and it can assess whether the controls in place are adequate. Otherwise, controls may be
duly improved or the organization may change the nature of the transaction, project, activity or
relationship so that the nature and extent of the risk of corruption are reduced. The assessment of
corruption risk is not intended as an extensive and overly complex exercise and the results of the
assessment do not need necessarily to prove to be correct (for example, a transaction assessed as a risk of
low corruption may reveal the existence of acts of corruption). A strong leadership (formed by the
Governing Body or the High Authority) is required to approve the policy of preventing corruption, make
policy and objectives compatible with the strategic direction, ensure the effectiveness of the system by
guaranteeing the allocation of adequate resources, supervise the implementation of the System, its
integration into business processes and the involvement of people which must be assured by the Senior
Management, promote reporting procedures and avoid retaliation. An "Anti-Corruption Compliance
Function" is required with guidance tasks, system explanation, and reporting of results to the Governing
Body or Senior Management. The Governing Body must approve/review an Anti-Corruption Policy that
Forbids corruption (active and/or passive) and requires compliance with applicable laws in Italy and/or
abroad, in accordance with the mission of the organization, provides a framework reference to achieve
goals (e.g. integrated with other forms of corruption’s prevention), encourages reports of suspected
breaches, in good faith, explains the authority, the independence of the Anti-Corruption Compliance
Function and its lines of reporting upwards. The policy must be available as documented information,
communicated in the appropriate languages both internally and externally and bind in the relationships
with the stakeholders in the appropriate ways. ISO 37001: 2016 identifies 3 responsible individuals:
executive body, senior management, and anti-corruption compliance function, and is distinguished
between a private company, public company, and public administration. Managers at every level must be
responsible to request that the requirements of the corruption management system are applied and
observed within their department or function table 5.

ISO 37001 Private society Public society Public administration

Board of
Governing body Directors/Supervisory Board of Directors Council/Mayor
Board

Managing Managing
High supervision Director/General Director/General General Secretary
Direction Direction

Anti-corruption Compliance/Internal Compliance/Internal

Internal Audit Office
compliance function Audit Audit

Table 5. Identification of the 3 responsible individuals according to ISO 37001: 2016

7
The High Supervision must assign to the Anti-Corruption Compliance Function the responsibility and
authority to supervise the design and implementation of anti-corruption management system, provide
advice and guidance to personnel about the anti-corruption management system and corruption-related
issues, ensure the compliance of the anti-corruption management system with the requirements of ISO
37001, draft the performance report of the Anti-Corruption Management System to the Governing Body
(if available), to
the High Supervision and / or other functions. Depending on the complexity of the organization, the
function can be covered by a single person or by a group possessing status, competence, authority, and
independence. The function can be entrusted entirely or partially to external subjects. However, they must
answer a competent manager of the organization.
Considering the elements of the context, the stakeholders' expectations, and the risk analysis, the
regulation requires planning actions to manage the risks and opportunities for improvement. The goals
must be established for each relevant function and level, in line with anti-corruption policy, they must be
measurable, monitor able, communicable and up-to-date. Planning must define who does what, how and
when, as well as the results which will be evaluated and who will apply penalties. It is important at this
stage that the criterion of reasonableness and proportionality, that is prevention and control measures
should not be so burdensome to prevent activity or read as to prevent activity. In addition to the "Due
Diligence" and "Reporting and Investigation Management" controls, other preventive measures have to be
identified. Based on international best practices, these measures could be inspired by the following
internal control standards:
1. Segregation of tasks: the protocol is based on the separation of tasks between those who authorize,
execute and control.
2. Procedures: the protocol is based on the existence of business rules and/or formal procedures that are
appropriate to provide principles of conduct, operating procedures to conduct sensitive activities, and
how to store relevant documentation.
3. Authorization and signature powers: the protocol is based on the principle that the powers of
authorizing and signing must be: (i) consistent with the assigned organizational and management
responsibilities, providing, where requested, an indication of the approval thresholds; ii) clearly
defined and known within the Company.
4. Traceability: the protocol is based on the principle that: (i) any activity relating to sensitive activity
is, where possible, adequately recorded; (ii) the decision-making, authorization and conduct of the
sensitive activity can be verified ex-post, also by means of appropriate documentary media; (iii) in
any case, the possibility of deleting or destroying the registrations shall be governed in detail.
There must be adequate resources to achieve the desired goals such as staffing requirements, non-
discriminatory personnel management procedures that highlight those exposed to risk situations,
disciplinary and / or rewarding system, training actions for the most exposed personnel for "Business
Associate" CDs, a well-defined internal and external communication process, pieces of information that
document the policy, procedures and controls of the management system, the results of the risk analysis,
the training provided, the actions taken, the results of the monitoring, the "incidents" related to suspected
or actual corruption cases. Due diligence third parties are all staff who have third-party relationships and
who must check the selection process, the adequacy of the economic commitment and
professionalism/integrity, the receipt of all the approvals required for signing the agreement and
performance certification, acceptance and adherence to the anti-corruption management system. The
organization must evaluate the nature and extent of the risk of corruption in relation to transactions,
projects, activities, business partners and specific staff members that fall into predefined categories as at
greater risk. Based on the outcome of the risk assessment, the organization must implement procedures
that require that all other organizations which it controls and the application of the anti-corruption

8
management system, or the implementation of their controls for the prevention of corruption. In relation
to business partners, based on the outcome of the risk assessment and/or due diligence, the organization
must determine whether the business partner is implementing anti-corruption controls that handle the
relative risks of corruption; where a business associate does not implement checks to prevent corruption
or it is not possible to verify whether he/she carries them out, he/she must require to do so contractually
and in negative case consider this element as a risk factor in the risk assessment.
Reporters who relate periodically to the Anti-Corruption Compliance Function should be identified to
update both the performance and adequacy of the entire organization's system and the monitoring
activities performed by the Anti-Corruption Compliance Function, executives and other staff involved in
the risk areas, Referents (Apical or Director). To this end, it is necessary to define and communicate
formally to all involved individuals the contents, frequency, and mode of transmission. For example,
information flows may include: state-of-the-art workflows and / or change risk areas / controls from
Referents, internal / external factor exchange and system review, Key Risk Indicators and / or Red Flags
(e.g. desert races, single and / or emergency assignments), summary reports prepared by Surveillance
Bodies or other Internal Control Bodies (e.g. auditors), other information such as disciplinary
proceedings. Operationally, procedures are required to regulate the receipt/promise of various forms of
gratuities and / or other "benefits" deemed unlawful with special attention to "suspect" cases, application
of procedures to encourage and use the reports of suspected anonymous ("whistle blowing"), protecting
confidentiality and staff reporting, applying procedures to independently investigate suspected or actual
corruption cases. The organization at the evaluation stage must determine what is required to monitor and
measure, who is responsible for monitoring, monitoring methods, measurement, analysis and evaluation,
as applicable, to ensure valid results when monitoring and measurement are to be performed, when the
results of monitoring and measurement must be analysed and evaluated, to whom and how such
information should be reported. It is also required to carry out internal audits, a review of the High
Supervision (and the Governing Body, if any), a continuous review by the Anti-Corruption Department,
which reports back to the High Supervision and to the Governing Body, where existing. Auditing (or
inspection test) means an independent auditing activity carried out internally by the Entity to ascertain, by
selecting a sample of transactions, the compliance of the activities carried out by staff and collaborators
with respect to what is prescribed. Auto Evaluation is a self-assessment questionnaire filled out by staff
involved in risk areas to identify any changes in risk and/or administrative areas, level of perception of
corruption/value of integrity and level of knowledge of prevention measures, anomalies, and criticalities
in process management. The High Supervision must, at scheduled intervals, review the management
system to ensure its continuing suitability, adequacy, and effectiveness. The High Supervision review
must include consideration of the status of actions resulting from previous management reviews, changes
to external and internal aspects that are relevant to the system, system performance information, including
noncompliance trends and corrective actions, monitoring and measurement results, audit results,
corruption reports, investigations, the nature and extent of the corruption risks faced by the organization,
the effectiveness of the actions taken to address the risks of corruption, opportunities for continuous
improvement. When a nonconformity occurs, the organization must react promptly to non-compliance
and, as far as it is possible to take action to keep it under control and correct it, to address its
consequences, to assess the need for action to eliminate the cause or causes of non-compliance so that it
does not repeat or do not occur elsewhere by reviewing non-conformities, determining the causes of
noncompliance, determining whether or not there may be similar nonconformities, as well as carrying out
any necessary action and reviewing the effectiveness of any corrective action taken. The organization
must continuously improve the sustainability, adequacy, and effectiveness of the system.
All of the most relevant analyzed points in the ISO 37001: 2016 standard allow to focus on the different
drivers and the various factors that affect both the organization's and managers 'or decision-makers'
corruption behavior. In addition, analysis of functions and processes and governance control, including
the training and characteristics that individuals must possess, allows immediate intervention in companies
even in complex structures and in different markets and international regulations.

9
4. Conclusion
ISO 37001 can be an innovative tool for international companies that carry out their business in a global
market and that, because of their complexity, systematize systems to prevent corruption and related
sanctions, thus leading to an economic and competitive advantage for the same company. The regulation
applies both to groups and public companies as well as to private groups and companies that can be
implemented indifferently from the type of reference needs and markets, and it affects several drivers
related to the phenomenon of corruption. The management benefit is identifiable in adopting a unique
language and international standards for the prevention of corruption (in their case it is very useful, given
their international dimension to FCPA / UKBA). The system-related advantage involves a single
language that is based on the SL platform, the same used for other management systems (e.g. ISO 9001)
and therefore with the implementation of ISO 37001 several elements (e.g. policy, review, etc.) can be
integrated without weighing up the organizational structure. However, there are also significant benefits
to governance. In particular, the study has strengthened the existing control protocols to prevent active
corruption towards public administration / private citizens and/or passive corruption within public
administration (strengthening first / second level controls) and whistleblowing system. Strengthening
control protocols on "Third Parties" (e.g. agents, distributors, freight forwarders, etc.) and therefore
greater integration between the Internal Control Model and the Anti-Corruption Global Policies (e.g.
FCPA/UKBA) in addition to the possibility according to the risk profile of the "Third parties" to request
them also the ISO 37001 certification (e.g. countries with greater risk) in a coordinated manner with any
indication of the Global Policy Parent Company. With the implementation of the 37001 system, there is a
strengthening of third level controls and/or the Supervisory Authority, which in this way will focus more
on other areas at risk of the whole system less guarded (e.g. laundering and/or anti-laundering, organized
crime, etc.), leveraging information flows. At the level, the instrument allows to increase and strengthen
evidence in case of "legal defense". Always at the economic level, it is possible to take advantage of the
adoption of ISO 37001 Management Systems as a pricing requirement to have the legality rating in the
control of each State and the possibility of being facilitated in brand reputation terms and particularly for
international customer qualification systems with the possibility of reducing their contract audits. Being a
voluntary tool cannot be defined as resolved in the absolute terms of the corruption phenomenon in public
and private companies. The fact that a third party performs the audit increases the autonomy and
truthfulness of what has been stated.
Limitations:
The tool was recently introduced by the standard, so there are not enough cases to analyze the actual
relapse between companies and groups that adopt it and those who have not adopted it. Major evidence
will take several years.

10