British Standard BS 10500 Specification for an Anti-bribery Management System Summary BACKGROUND BSI Standards is the UK's National Standards Body. It is the UK representative at the International Organisation for Standardisation (ISO). BSI Standards has 31,000 current standards. The most popular global standard is ISO 9001 Quality Management System, which is used by over 1,000,000 organisations in 178 countries. The second most popular global standard is ISO 14001 Environmental Management System which is used in over 220,000 organisations in 159 countries. Both ISO 9001 and ISO 14001 began as British standards, as did some of the other top global standards. BSI Standards also publishes the widely used BS OHSAS 18001 Health and Safety Management System. In November 2011, BSI Standards published BS 10500 Anti-bribery Management System. PURPOSE AND SCOPE OF BS 10500 BS 10500 is intended to help an organisation to implement an effective anti-bribery management system. It can be used both in the UK and internationally. The requirements of UK law and internationally recognised good practice are taken into account. It is applicable to small, medium and large organisations in the public, private and voluntary sectors. The bribery risk facing an organisation varies according to factors such as the size of the organisation, the countries and sectors in which the organisation operates, and the nature, scale and complexity of the organisation s operations. Therefore, BS 10500 specifies the implementation by the organisation of risk-based policies, procedures and controls. Compliance with BS10500 cannot provide assurance that no bribery has occurred or will take place in relation to an organisation. However, the standard can help establish that the organisation has implemented reasonable and proportionate measures designed to prevent bribery. Well-managed ethical organisations are likely to implement effective anti-bribery management systems in their organisations in the same way that they would implement effective quality, environmental and safety management systems. They would therefore be likely to obtain certification to BS 10500 in a similar way to obtaining certification to 9001, 14001 and 18001. BS 10500 is likely to be useful to organisations in the following way. - It will help provide assurance to the board and shareholders of an organisation that their organisation has implemented best practice anti-bribery controls. - A project developer or project funder may require the contractors, suppliers and consultants which are constructing a project to provide certification to BS 10500 as evidence that they have implemented antibribery controls in their organisations. - Organisations may require their major sub-contractors, suppliers and consultants to provide evidence of certification to BS 10500 as part of their supply chain approval process (on a similar basis to their requiring evidence of certification to ISO 9001 etc.). 1
BS 10500 is applicable only to bribery. It is not applicable to other criminal offences such as fraud, antitrust/competition offences, and money laundering, although the organisation may choose to extend the scope of its ABMS to include these other offences. REQUIREMENTS OF BS 10500 In order to comply with BS 10500, an organisation must implement the following requirements. [Note that the following is a summary of BS 10500 s requirements. Users should look to the full version for details.] Anti-bribery policy The organisation shall adopt an anti-bribery policy. The policy may be a brief, simple statement by the organisation that it: - prohibits bribery; and - will implement measures to: - prevent bribery; and - detect, report and deal with any bribery which occurs. Anti-bribery Management System The organisation shall implement an Anti-bribery Management System (ABMS) comprising the appropriate policies, procedures and controls specified below. Implementation shall be in a manner which is reasonable and proportionate having regard to the nature and extent of bribery risks which the organisation faces, taking into account the: - size of the organisation; - countries and sectors in which the organisation operates; - nature, scale and complexity of the organisation s activities and operations; - organisation s existing and potential business associates; and - applicable statutory, regulatory, contractual and/or professional obligations and duties. Communicating the anti-bribery policy and ABMS The organisation shall communicate the anti-bribery policy and ABMS to all the organisation s personnel. The anti-bribery policy shall be published on the organisation's intranet and public website (if it has these). The organisation shall implement procedures under which all its personnel read the anti-bribery policy and agree to comply with it. Education, training and/or guidance The organisation shall provide appropriate education, training and/or guidance to all its personnel who will be responsible for implementing parts of the ABMS or who could encounter bribery in relation to their duties. 2
Compliance Manager A suitably qualified or experienced manager of appropriate seniority shall be allocated responsibility for overseeing implementation by the organisation of the ABMS (compliance manager). Where the organisation comprises more than one independently managed organisation, a suitably qualified or experienced manager shall be appointed within each organisation as responsible for overseeing compliance with the anti-bribery policy and ABMS within each organisation. (e.g. a group with several subsidiaries or divisions). This responsibility can be on either a full-time or part-time basis, depending on the size of the organisation and the nature and extent of bribery risk which the organisation faces. If on a part-time basis, the compliance manager can combine the compliance function with other responsibilities. Risk assessment The organisation shall implement procedures to enable it to assess: - the risk of bribery in relation to its existing and proposed new activities; and - whether its policies, procedures and controls are adequate to reduce those risks to an acceptable level. Due diligence Where the risk assessment shows that a business associate may pose a more than negligible bribery risk, the organisation shall implement procedures to undertake due diligence on the business associate prior to entering into any business relationship with it. (A business associate would include any party with whom the organisation contracts, including but not limited to clients, customers, joint venture partners, consortium partners, contractors, consultants, sub-contractors, suppliers, vendors, advisors, agents, distributors, representatives and intermediaries.) Implementation of ABMS by controlled organisations and business associates The organisation shall implement procedures which ensure that all other organisations over which it has control implement an ABMS which is reasonable and proportionate having regard to the nature and extent of bribery risks which the controlled organisation faces. (An organisation might have control, for example, over a subsidiary, joint venture or consortium, either through exercising management control or through having a majority ownership interest.) In relation to business associates over which the organisation has no control, and in relation to which the risk assessment has identified a more than negligible bribery risk, the organisation shall implement procedures which ensure the following. - Where it is reasonable for the organisation to do so, it shall take steps to ensure that its business associate implements an ABMS which includes the relevant business transaction within its scope. - Where it is not reasonable for the organisation to require the business associate to implement an ABMS, or for the organisation to verify the existence or adequacy of the business associate s ABMS, then the absence of an ABMS, or inability to verify the ABMS, is likely to be a negative factor taken into account in undertaking the risk assessment. Employment procedures In relation to all its personnel who could pose a bribery risk to the organisation, and to the extent permitted by applicable law, the organisation shall implement procedures which provide that: - potential personnel are vetted before they are employed by the organisation to ascertain as far as is reasonable that their employment is appropriate and that they are likely to comply with the anti-bribery policy and ABMS; 3
- conditions of employment require personnel to comply with the anti-bribery policy and ABMS, and give the organisation the right to discipline personnel (including the right of termination of employment) in the event of non-compliance; - personnel receive a copy of the anti-bribery policy, and agree to comply with it, within a defined period of their employment commencing; - personnel declare any actual or potential conflict of interest; - performance bonuses, performance targets and other incentivising elements of remuneration are reviewed periodically by an appropriate manager to ensure that there are reasonable safeguards to prevent these from encouraging bribery; - the organisation has disciplinary procedures which entitle it to take appropriate disciplinary action (including the right of termination of employment) against personnel who breach the anti-bribery policy and ABMS; - personnel are not penalised (e.g. by demotion, disciplinary action, transfer or dismissal) for refusing to participate in, or for turning down, a business opportunity in respect of which they have reasonably and in good faith judged there to be an unacceptable risk of bribery. Gifts, hospitality, donations and similar benefits The organisation shall adopt a policy which prohibits the offer or receipt of items such as the following, where the offer or receipt is, or could reasonably be perceived to be, for the purpose of bribery: - gifts, entertainment and hospitality; - political or charitable donations; - client or public official travel; - promotional expenses; - sponsorship; - community benefits. Facilitation payments The organisation shall adopt a policy which prohibits the offer or receipt of facilitation payments. (A facilitation payment is an illegal or unofficial payment made in return for services which the payer is legally entitled to receive without making such payment. It is normally a relatively minor payment made to a public official or person with a certifying function in order to secure or expedite the performance of a routine or necessary action, such as a visa, work permit, or customs clearance.) Delegated decision-making Where top management delegates to its personnel the making of decisions in relation to which there is a risk of bribery, the organisation shall establish a decision-making process that ensures that the decision process and the seniority of the decision-maker are appropriate for the value of the transaction and the perceived risk of bribery. Anti-bribery contract terms The organisation shall implement procedures which ensure that, in relation to all business associates which pose a more than negligible bribery risk: - as far as is reasonable, all contracts between the organisation and the business associate contain a prohibition of bribery; and - where it is not reasonable to require the contract to contain such prohibition, that the absence of the prohibition will be a negative factor taken into account in undertaking the risk assessment. 4
Financial controls The organisation shall implement financial controls which minimise the risk of the organisation, or any of its personnel or others acting on its behalf or for its benefit, paying or receiving a bribe. Procurement and other commercial controls The organisation shall implement procurement and other commercial controls which minimise the risk of the organisation, or any of its personnel or others acting on its behalf or for its benefit, paying or receiving a bribe. Raising concerns The organisation shall implement procedures which: - enable its personnel to report attempted, suspected or actual bribery, or any breach of or weakness in the ABMS, to an appropriate person within the organisation (either directly or through an appropriate third party); - where requested by its personnel, ensure that the organisation as far as possible keeps the identity of personnel who make a report confidential (unless the organisation is required by law to disclose this information); - allow anonymous reporting (if and to the extent that applicable laws allow this); - protect personnel from retaliation after raising in good faith a concern about actual or suspected bribery or the implementation of the ABMS. Investigating and dealing with bribery The organisation shall implement procedures which: - require appropriate investigation by the organisation of any bribery, or any breach of or weakness in the ABMS, which is reported, detected or reasonably suspected; and - require appropriate action in the event that the investigation reveals bribery, or breach of or weakness in the ABMS. Documenting the ABMS The organisation shall keep appropriately detailed records of: - the policies, procedures and controls of the ABMS; - actions taken under the ABMS; and - any bribery-related issues which arise. Monitoring and reviewing the ABMS The compliance manager shall assess on an ongoing basis whether the ABMS is adequate to manage effectively the bribery risks faced by the organisation; and is being effectively implemented. The compliance manager shall report at planned intervals to top management, or to a suitable sub-committee of top management, on the adequacy and implementation of the ABMS. The organisation shall implement appropriate and proportionate internal audit processes or other procedures which check projects, contracts, procedures, controls and systems for any indication of: - bribery or suspicion of bribery; - non-compliance with the anti-bribery policy or ABMS; 5
- failure of other organisations over which the organisation has control, or of a relevant business associate, to implement an ABMS; - weaknesses in or scope for improvement to the ABMS. The audits may be on an appropriate sample basis. In order to ensure the continuing adequacy and effectiveness of the ABMS, top management or a suitable subcommittee of top management, shall review the scope and implementation of the ABMS. This review shall be carried out at regular, planned intervals and when major changes to the organisation s activities or structure take place. Improvement of the ABMS The organisation shall implement a procedure for changing or improving the ABMS whenever this is necessary or desirable. GUIDANCE BS 10500 has an Annex which contains guidance to help an organisation implement an ABMS. This guidance applies to due diligence; the vetting of personnel; gifts, hospitality, donations and similar benefits; facilitation payments; financial controls; procurement and other commercial controls; and internal audit. BS10500 also contains a list of significant independent external resources which may help an organisation implement an ABMS. CERTIFICATION TO BS 10500 BS 10500 will be most effective if its implementation by an organisation is independently certified. Certification bodies could be the existing organisations which provide certification to e.g. ISO 9001. They could also be accounting practices which can provide certification as part of their annual financial audit. Alternatively, new organisations may develop to provide this service. The cost of certification is likely to vary materially according to the size of the organisation obtaining the certification (as is the case with the cost of obtaining certification to ISO 9001). Certification of an organisation of e.g. 20 people working in one country will be materially more simple, and is likely therefore to cost materially less, than certification of an organisation with e.g. 10,000 employees working in 20 countries. The cost of implementing the ABMS and obtaining certification is unlikely to be a competitive disadvantage. If, for example, a procuring entity requires all its bidders to be certified to BS 10500, then all bidders will be required to bear the cost and so will be on an equivalent footing. Where certification to BS 10500 is not a tender requirement, organisations may find it a competitive advantage to be certified, as they will be able to show the procuring entity that they have an anti-bribery management system in place which may gain them additional points in the procurement evaluation. The cost of implementing the ABMS and obtaining certification is also likely to be minimal when compared to the loss and damage which could be suffered by an organisation which gets involved in corruption. Having such a system can help prevent this loss and damage. COPY OF BS 10500 BS 10500 is copyright protected by BSI. A full copy of BS 10500 can be purchased from BSI s web-site. http://shop.bsigroup.com/productdetail/?pid=000000000030238856 Note prepared by GIACC 9 th April 2012 www.giaccentre.org 6