ISO 37001 Third-Party Due Diligence Guide

ISO 37001 Third-Party Due Diligence Guide: Managing Corruption Risks End-to-End

ISO 37001 (Anti-Bribery Management System) provides a framework for organizations to systematically identify, reduce, and monitor bribery and corruption risks. This guide specifically defines due diligence processes to be applied at the operational level in third-party relationships (suppliers, distributors, intermediaries, joint ventures, donation/sponsorship partners). The goal is to strengthen compliance, transparency, and accountability by clarifying the cycle of risk-based selection, pre-contract evaluation, in-contract controls, and post-contract monitoring.

The scope of this guide includes risk classification and screening criteria, gift/donation/sponsorship approval workflows, whistleblowing and confidentiality mechanisms, internal investigation steps, training and attestation processes, sanctions and disciplinary structure, management reporting and KPIs, supply chain contract clauses, audit evidence, and the continuous improvement cycle. Each section follows the logic of policy → procedure → evidence, resulting in a practical and audit-ready implementation set.

This approach provides risk-based flexibility instead of “one-size-fits-all control,” adapting to parameters such as country, sector, transaction type, payment structure, and relationship role. High-risk parties require deeper review and more frequent monitoring, while low-risk parties are managed with lean but traceable controls to maintain proportionality.

As a result, an audit-ready third-party compliance ecosystem aligned with ISO 37001 and business rhythm is established. The following sections will detail each topic with step-by-step methods and practical examples.

Risk Classification and Screening Criteria

The third-party due diligence process must be built on a risk-based methodology. At the first stage, variables such as country risk, sector risk, transaction subject, payment structure, ownership, and intermediaries are analyzed. The purpose is to determine the depth of screening and intensity of controls in a proportional manner.

Key criteria:

• Country and Jurisdiction Risk: Corruption perception indexes, sanction lists, presence of PEPs (Politically Exposed Persons).
• Sector/Business Model: Public procurement, dependency on customs/licensing processes, cash intensity.
• Transaction Parameters: Commission/discount rates, unusual payment terms, use of intermediaries.
• Ownership and Partnerships: Ultimate beneficial ownership (UBO), complex/opaque structures, PEP connections.
• Past Records: Media screening, litigation/penalty records, previous violations.

Screening tools: Sanction/compliance databases, open-source media searches, company registries, and local records. Based on the risk score, validation is planned at basic, standard, or enhanced levels.

The results determine the third party’s risk class and the depth of KYC/KYB (Know Your Customer/Know Your Business) documentation required for monitoring.

Gift, Donation, and Sponsorship Approval Flow

Gifts, donations, and sponsorships may increase corruption risks. Therefore, thresholds, prohibited categories, and approval authorities must be clearly defined. In third-party proposals, the purpose, timing, amount, and relationship must be examined.

Policy principles:

• Transparency: Cash gifts are prohibited; gestures exceeding reasonable value are rejected.
• Legitimacy: Donations/sponsorships must align with the organization’s social responsibility principles.
• Pre-Approval: Any request above the threshold must be approved by the compliance function and the relevant manager.
• Record-Keeping: All approvals and rejections are maintained in a central gift/donation register.

Process steps: Request form → Compliance review → Additional documents based on risk class → Approval/rejection → Disclosure record and periodic reporting.

Whistleblowing, Confidentiality, and Anti-Retaliation

Under ISO 37001, accessible, multi-channel, and anonymous whistleblowing mechanisms must be established for reporting suspected misconduct in third-party relationships. Channels such as web, phone, and email should be available 24/7 and support multiple languages.

Confidentiality principles:

• Data Protection: Identity information is not shared with unauthorized persons; the “need-to-know” principle applies.
• No Retaliation: Employees/suppliers who report in good faith are protected against retaliation.
• Feedback: Reporters are informed of the case status within a reasonable time.

Reports are recorded, undergo initial assessment, and serious cases trigger an investigation process. Trend analysis may flag high-risk third parties as an early warning indicator.

Internal Investigation: Triggers, Execution, and Closure

Depending on the seriousness of the allegation or violation, a proportionate investigation is conducted. The aim is to uncover facts quickly, fairly, and based on evidence.

Triggers: Whistleblowing reports, unusual payments/commissions, PEP connections, sanction breaches, media findings.

Execution steps:

• Scope and Role Assignment: Investigation leader, legal, and compliance representatives are appointed.
• Evidence Collection: Contracts, invoices/payment records, emails/logs, third-party statements.
• Interviews: Structured interviews with employees and third-party representatives.
• Assessment and Report: Findings, violation evaluation, recommended actions.
• Closure and CAPA: Corrective/preventive actions, policy/procedure updates.

The investigation is conducted under principles of independence, confidentiality, and evidence integrity; results are shared with management and regulators where necessary.

Training and Attestation Processes

ISO 37001 compliance is achieved not only through policy documents but also through the awareness and commitment of employees and third parties. Therefore, training and attestation processes play a critical role.

Key elements:

• Mandatory Training: All employees working with third parties must attend regular anti-bribery training.
• Role-Based Training: Tailored content must be prepared for procurement, sales, legal, and compliance teams.
• Third-Party Training: Critical suppliers and intermediaries must be informed via short compliance modules.
• Attestation: Employees and third-party representatives must declare in writing that they have read and accepted the policies and procedures.

Training records must be kept as audit evidence, and renewal cycles (e.g., annually) should be defined.

Sanctions and Disciplinary Structure

An effective compliance program requires clear and consistent sanctions for violations. This ensures deterrence and fairness.

Elements of a disciplinary matrix:

• Warning: Written or verbal warnings for minor violations.
• Retraining: Additional training for violations caused by lack of knowledge or awareness.
• Disciplinary Penalties: Termination, cancellation of bonuses, or contract termination for repeated/serious violations.
• Application to Third Parties: Termination or blacklisting of non-compliant suppliers.

Every sanction decision must be documented and comply with applicable laws.

Management Reporting and KPIs

Third-party due diligence performance must be regularly reported to senior management and monitored using measurable indicators (KPIs). This demonstrates the system’s effectiveness with tangible data.

Example KPIs:

• Number and percentage of third parties screened
• Risk class distribution (low, medium, high)
• Percentage of training completed
• Rate of signed attestations
• Number of whistleblowing cases opened/closed
• Number of disciplinary measures applied

These reports should be prepared monthly/quarterly and presented to management via dashboards.

Sample Supply Chain Contract Clauses

Anti-bribery obligations must be explicitly included in contracts with third parties. These clauses clarify both the third party’s responsibilities and the organization’s termination rights.

Sample clauses:

• The party agrees to comply with all relevant anti-bribery laws and ISO 37001 requirements.
• The party will comply with gift, donation, and sponsorship policies.
• The party accepts access to whistleblowing channels and commits to non-retaliation.
• The organization reserves the right to request audits and documentation.
• In case of violation, the organization reserves the right to immediately terminate the contract.

These clauses should become part of the third-party compliance culture and be customized where necessary.

Audit Evidence

Within ISO 37001, the third-party due diligence process must be supported not only by policies and procedures but also by tangible evidence. Documentation proving implementation effectiveness plays a critical role during audits.

Example evidence:

• Risk classification reports and screening results
• Gift/donation/sponsorship approval forms and registers
• Whistleblowing records and resolution reports
• Internal investigation reports, interview notes, and decisions
• Training attendance lists and attestations
• Disciplinary decisions and implementation records
• Compliance clauses in contracts and audit reports
• KPI tables and management reports

All such documents must be traceable, accessible, and systematically archived. This proves transparency and compliance during both internal and external audits.

Continuous Improvement

The third-party due diligence process must be approached with a cyclical rather than static mindset. Continuous improvement keeps the system dynamic and adaptable to new risks.

Steps:

• Periodic Review: Risk classification criteria, screening tools, and thresholds should be updated at least annually.
• Root Cause Analysis: Every identified violation should be examined beyond the surface to uncover root causes.
• CAPA (Corrective and Preventive Action): Both corrective and preventive measures should be planned and implemented.
• Feedback Loop: Suggestions from employees, third parties, and audits should be integrated into the process.
• Use of Technology: New compliance software, automated screening tools, and dashboards should be adopted.

This approach ensures that the organization not only meets compliance requirements but also continually enhances corporate reputation, operational efficiency, and stakeholder trust.