Bond prepares ISO 37001 certification in Iraq and Kurdistan.
The anti-bribery management system. It sets the policy, the due diligence on agents and suppliers, the rules on gifts and payments, and the way a report of bribery is investigated, and it is what international operators and lenders check before they clear a company.
ISO 37001 Anti-bribery management systems · Governance
What ISO 37001 is
ISO 37001 is the international standard for an anti-bribery management system. It asks a company to rate where bribery risk actually sits in its business, put controls on the payments, permits, tenders and third parties where that risk is highest, train the people exposed to it, and record what happens when someone reports a concern. The certification body issues the certificate to the company, and it says the system meets the standard.
What the standard requires
- Clauses 1 to 3 cover scope, normative references and terms. Clauses 4 to 10 are the requirements an auditor checks, and Annex A is guidance rather than a requirement.
- Clause 4.5, bribery risk assessment. Rate the bribery risk of every country, contract type, agent, customs step and public official contact the company deals with, and review the rating when the business changes.
- Clause 5, leadership. The governing body and the general manager own the system, sign the anti-bribery policy, and appoint an anti-bribery compliance function with direct access to the board.
- Clause 6, planning. Set anti-bribery objectives with numbers and dates, and plan the controls against the rated risks.
- Clause 7, support. Employment checks on staff in exposed roles, an anti-bribery clause in contracts, training for everyone exposed to the risk, and a channel for raising concerns.
- Clause 8.2, due diligence. Record a documented check on every agent, distributor, consultant, joint venture partner and high risk supplier before the contract is signed.
- Clauses 8.3 and 8.4, controls. Financial controls over payments, petty cash and approval limits, and non-financial controls over procurement, tendering, customs handling and permits.
- Clause 8.7, gifts and hospitality. A written rule with a value limit, a register of what was given and received, and an approval step for anything above the limit.
- Clauses 8.9 and 8.10, concerns and investigation. A reporting channel that protects the person who reports, and a recorded investigation for every report received.
- Clauses 9 and 10, evaluation and improvement. Internal audit, a review by the anti-bribery compliance function, a management review by top management and by the governing body, and a closed corrective action for every finding.
Who needs ISO 37001 in Iraq and Kurdistan
The buyers that ask for ISO 37001
| Buyer or list | What they ask for |
|---|---|
| International operators | DNO, Genel Energy, Gulf Keystone and HKN run compliance due diligence on suppliers. DNO is Norwegian and Genel Energy and Gulf Keystone are listed in London, so the UK Bribery Act 2010 reaches into their supply chain in Kurdistan. |
| Foreign parent companies and joint venture partners | US companies are covered by the Foreign Corrupt Practices Act and check the Iraqi partner's controls before the joint venture or agency agreement is signed. |
| UN agencies through UNGM | ungm.org. The UN Supplier Code of Conduct bans bribery and facilitation payments. One free registration covers UNDP, UNICEF, WFP, UNHCR, IOM and FAO. |
| Donors and development lenders | The World Bank and the IFC apply anti-corruption guidelines and publish a debarment list. A debarred company is excluded from every project they finance. |
| EPC contractors | Subcontractor prequalification files on projects in Kurdistan and Basra carry a compliance section next to the quality and HSE sections. |
| Ministry of Natural Resources Approved Vendor List | mnronline.com/avl. It scores finances, quality system and HSE, and anti-bribery is not one of its criteria. The operators that draw suppliers from the list ask for it in their own compliance files. |
| Gulf and international buyers | State buyers in Saudi Arabia, the UAE and Qatar ask bidders for a written anti-bribery policy, and on large packages for an ISO 37001 certificate from a body accredited under an IAF member. |
Two tracks, you choose one
Certificate track
5 daysA company that has to clear an operator's compliance due diligence or answer an anti-bribery clause in a tender or an agency agreement before the deadline. We prepare the compliance system in five working days. The certification body then issues the certificate, and its calendar sits outside the five days.
Steps- We read the compliance questionnaire or the tender clause on day one and confirm the scope and the body the buyer accepts.
- We run the bribery risk assessment on day one and day two with the owner, the finance manager and the people who deal with officials.
- We write the document set on day two and day three: policy, due diligence procedure, gifts rule, payment controls and the investigation procedure.
- We set up the reporting channel in Arabic, Kurdish and English on day three and write the rule that protects the person who reports.
- We train the exposed roles on day four in half day sessions and record who attended and what they were told.
- We run the first internal audit and the management review with the governing body on day five, then close the findings.
- We book the certification body at the end of the five days, and the body sets the stage 1 and stage 2 dates on its own calendar. We prepare the site, attend both stages, and answer the findings with your team.
- The anti-bribery system, complete in five working days
- Scope statement and bribery risk assessment with rated risks
- Anti-bribery policy signed by the governing body and the compliance function appointment
- Due diligence procedure and completed files on agents and high risk suppliers
- Gifts and hospitality rule and register
- Financial and procurement control procedures with approval limits
- Reporting channel, investigation procedure and internal audit report
- The certification body booking and a three year surveillance and renewal calendar
Implementation track
6 to 14 weeksA company whose records will be read by a foreign parent, an operator's compliance team or a lender, and that wants the due diligence and approval controls running before the auditor arrives.
Steps- We analyse what the company does and what its buyers and tenders require, then send a proposal.
- We run the bribery risk assessment business line by business line with the people who face the risk.
- We design the financial and procurement controls with the finance manager and set the approval limits in writing.
- We write the documentation in Arabic, Kurdish and English and build the due diligence file format the company will use for every third party.
- We run the due diligence on the existing agents, distributors and high risk suppliers and record the result for each one.
- We train every exposed department, launch the reporting channel, and let the controls run live for three to four weeks.
- We run the internal audit programme and the management review with the governing body, then prepare the site and attend stage 1 and stage 2.
- Bribery risk assessment covering every business line and country of operation
- Anti-bribery policy and full documented system in Arabic, Kurdish and English
- Completed due diligence files on the existing agents, distributors and high risk suppliers
- Anti-bribery clauses added to contracts and purchase orders
- Gifts and hospitality register with live entries
- Training records for every exposed role
- Reporting channel with a log and a recorded investigation for each report
- Internal audit programme, compliance function report and management review minutes
The certification body issues the certificate.
The implementation track, week by week
| Phase | Weeks | What happens |
|---|---|---|
| Scope and bribery risk assessment | Weeks 1 to 2 | We confirm which entities, sites and business lines the certificate covers, then rate the bribery risk of each contract type, third party and dealing with officials. |
| Governance and compliance function | Weeks 2 to 3 | The governing body signs the policy and appoints the anti-bribery compliance function with written authority and direct access to the board. |
| Controls and documentation | Weeks 3 to 6 | Payment and petty cash limits, procurement and tendering controls, the gifts and hospitality rule, and the investigation procedure, written in Arabic, Kurdish and English. |
| Due diligence on third parties | Weeks 5 to 8 | We run and record the check on every existing agent, distributor, consultant and high risk supplier, and add the anti-bribery clause to their contracts. |
| Training and reporting channel | Weeks 7 to 9 | A session for each exposed department, a separate session for finance and procurement, and the launch of the reporting channel in three languages. |
| Records running live | Weeks 8 to 11 | The controls run in daily operations for three to four weeks so there are real approvals, register entries and due diligence files for the auditor to sample. |
| Internal audit and management review | Weeks 11 to 12 | We audit every clause, the compliance function reports on the system, and the management review is held with top management and the governing body. |
| Certification audit | Weeks 12 to 14 | The accredited body runs stage 1 on the documents and the risk assessment, then stage 2 on site. We prepare the site, attend both, and answer the findings. |
What we do, what you do
We do
- Confirm which scope, which entities and which certification body the buyer accepts, before any work starts.
- Run the bribery risk assessment with the owner, finance and the staff who deal with officials.
- Write the whole documented system in Arabic, Kurdish and English.
- Build the due diligence file format and run the checks on the existing agents and high risk suppliers.
- Set up the reporting channel and the investigation procedure that protects the person who reports.
- Train the exposed roles, finance, procurement and management on the controls and the records.
- Run the first internal audit against every clause and chair the management review with the governing body.
- Select certification bodies, collect their quotes, book the audit dates, prepare the site and attend stage 1 and stage 2.
- Write the corrective actions for every finding and keep the surveillance and recertification dates in a calendar.
You do
- Have the owner or the board sign the anti-bribery policy and appoint the compliance function in writing.
- Name one compliance representative who can give about five hours a week.
- Give us the agent and distributor list, the supplier list, the payment approval rules and the contracts already in force.
- Release the finance manager for a full day on payment controls and approval limits.
- Release each exposed department for a half day of training and a half day for the internal audit.
- Have the owner or general manager and one board member attend the management review, which takes about two hours.
- Pay the certification body directly, or through us at cost with the receipts.
- Have the owner or general manager present at the opening and closing meetings of the certification audit.
What moves the price
- Number of legal entities and sites, and whether the auditor has to travel to Erbil, Sulaymaniyah, Baghdad or Basra.
- The bribery risk rating of the business, because a high rating adds auditor days and evidence.
- Number of agents, distributors, consultants and high risk suppliers that need a due diligence file.
- Effective headcount in the exposed roles, which sets the auditor days the body calculates.
- Number of business lines and how much they differ in the officials and permits they deal with.
- Whether the certificate has to come from a body accredited under an IAF member or a locally accredited body is enough.
- Languages the documentation, the training and the reporting channel are delivered in.
- How much usable policy, contract and payment control documentation already exists in the company.
- Whether ISO 37001 is built alone or together with ISO 9001 as one system, which lowers total auditor days.
The proposal names the scope, the deliverables and the dates before work starts.
ISO 37001 questions we are asked
We prepare the compliance system in five working days on the certificate track. The implementation track runs six to fourteen weeks. The certification body then issues the certificate. Bodies working in Erbil and Baghdad set their own audit dates.
The proposal names the scope, the deliverables and the dates before work starts.
A certificate from a body accredited by IQAS, for example KQC in Erbil, is valid in Iraq and accepted for KRG lists. IQAS is not a member of the IAF Multilateral Recognition Arrangement. Operators such as DNO, Genel Energy and Gulf Keystone, UN agencies and lenders normally require a body accredited under an IAF member, such as Bureau Veritas, SGS or TUV. We confirm which one the buyer accepts before any body is booked.
International operators in Kurdistan and Basra ask for it in their supplier compliance files, and DNO, Genel Energy, Gulf Keystone and HKN all run third party due diligence. UN agencies contracting through ungm.org apply the UN Supplier Code of Conduct. The World Bank and the IFC apply anti-corruption guidelines and exclude any company on their debarment list from the projects they finance. Suppliers bidding to those operators are usually asked for ISO 9001, ISO 14001 and ISO 45001 first, then for ISO 37001 in the compliance section.
Three years from the date of issue. The certification body runs a surveillance audit each year and a recertification audit in year three. We keep those dates in a calendar and prepare the company for each one. If a surveillance audit is missed the body can suspend the certificate, and a suspended certificate will not clear an operator's annual compliance review in Kurdistan or Basra.
No. The certificate says the anti-bribery management system meets the standard on the date the accredited body audited it. It does not say that no bribery has happened or that none will happen. What it gives a buyer is evidence of the controls: the bribery risk assessment, the due diligence files on agents and suppliers, the approval limits, the gifts register, and a recorded investigation for every report received.
Yes. We work anywhere in Iraq, in Basra, Baghdad, Kirkuk, Erbil, Sulaymaniyah and Duhok, and in the Gulf. The office is in Erbil and the team travels to the site.
Business inquiry
Select a target. Two questions follow, and the file reaches the desk on WhatsApp. A reply comes within four working hours.