ISO 37001 for the CEO: if an overseas agent pays a bribe, what liability falls on the company and on you?

If an overseas agent or salesperson pays a bribe, what legal liability can the company and the CEO personally face?

Judge entity by entity and market by market:

Guilt and defences are for legal counsel to judge case by case; ISO 37001 provides the record that anti-bribery procedures actually run.

The company already has an ethical corporate management code. What must the CEO do personally?

The Ethical Corporate Management Best Practice Principles for TWSE/TPEx Listed Companies set specific expectations for senior management:

• Article 8: the company should require directors and senior management to sign a statement of compliance with the ethical management policy.
• Article 22: the chairman, the CEO or senior management should regularly communicate the importance of integrity to directors, employees and mandataries.
• Article 17: a dedicated unit under the board reports to the board at least once a year.
• Article 23: whistleblowing reports involving directors or senior management should be escalated to independent directors or supervisors.

The code is a policy statement; ISO 37001 certification means a certification body has audited, against the standard, that the system actually runs, including risk assessment records, third-party due diligence procedures and records of how reports were handled. The principles are for listed companies to follow; companies that are not public companies are not covered by them and can use them voluntarily.

A customer wants us to sign integrity clauses and fill in an anti-bribery due diligence questionnaire. How should the CEO prepare?

The service page puts it this way: when a customer's due diligence asks how you prevent bribery, the answer is a working system and its records. It lists those who need it most, including suppliers to European and US customers asked to accept integrity clauses and due diligence questionnaires, companies with agents or distributors in high-risk markets, and companies in public works or government procurement.

A typical implementation produces evidence that answers the questionnaire directly:

• A bribery risk assessment (covering business entertainment, commissions, agents and dealings with government)
• Third-party due diligence procedures
• Financial controls and approval design
• Reporting channels and investigation procedures

Whether orders are affected depends on each customer's contract and procurement terms and must be confirmed case by case. If a customer wants proof of overall compliance capability, the service page suggests ISO 37301 as the framework with ISO 37001 as a deeper module.

Who owns anti-bribery? How do sales, finance, procurement and audit divide the work?

The typical implementation work listed on the service page maps to existing departments (a suggested split, to be adjusted to your organisation):

Public companies already have a purchasing and payment cycle in their internal control; ISO 37001 financial controls, approvals and supplier due diligence should map to existing control points rather than form a second system. The internal control regulations apply to public companies; companies that are not public companies can use them voluntarily.

How do we account to the board, in the annual report and in the ESG evaluation?

• Annual report: the corporate governance report in a public company's annual report must disclose how integrity management is carried out, and any differences from the Ethical Corporate Management Best Practice Principles for TWSE/TPEx Listed Companies and the reasons (annual report regulations, Article 10).
• ESG evaluation (covers listed companies):
  • S-7 (2027 wording): disclose a board-approved ethical management policy, set up a full- or part-time unit to promote it, explain implementation and report to the board at least once a year; in 2026 this was split into S-7 and S-8.
  • S-9: disclose in detail on the company website a whistleblowing system for insiders and outsiders covering illegal (including corruption) and unethical conduct.
• Evidence: a management system built on ISO 37001 produces policy documents, risk assessment records, and training and audit evidence that support disclosure and evaluation; whether it matches a given indicator must still be checked against that year's wording.

Companies that are not public companies are not covered by these annual report and evaluation rules and can use them voluntarily.

Does ISO 37001 certification relieve the company or the CEO of liability? Are old certificates still valid?

• No such claim can be made: ISO 37001 itself states that conformity cannot guarantee that no bribery occurs. Whether the adequate procedures defence under section 7 of the UK Bribery Act holds is decided by the court case by case; the joint prosecution guidance of the UK Director of Public Prosecutions and the Serious Fraud Office also notes that a single instance of bribery does not necessarily mean procedures were inadequate. Certification shows the system runs, not that risk is zero; consult a lawyer on specific legal liability.
• Edition: the current edition is ISO 37001:2025, published in February 2025; UKAS in the UK and SCC in Canada have announced that certified organisations must transition by 28 February 2027, after which 2016 certificates are no longer valid. The main changes include more emphasis on compliance culture, handling conflicts of interest, clarifying the anti-bribery function and new climate change clauses; confirm transition arrangements with your certification body.

How does Winners Consulting help a CEO with ISO 37001?

This is Winners Consulting's own description; hold us to the questions above.

• Who leads: Winners Consulting is a consultant and does not issue certificates; vice-president and director-level consultants personally lead the work end to end, never outsourced; a separate certification body certifies
• One document set: implemented on the backbone of ERM risk language, sharing documents with the existing internal control system so nothing is duplicated
• No disruption: interviews and workshops fit into your existing meeting rhythm
• Legal applicability: Article 11 of the Anti-Corruption Act, the US FCPA and the UK Bribery Act are assessed entity by entity; specific legal liability is for lawyers to judge
• Timeline (as listed on the service page): typically one to two quarters to build the system and run the internal audit, then certification
• First step: the first mechanism diagnosis is free

Go deeper: ISO 37001 anti-bribery management system, Choosing an ISO 37001 consultant, ERM consulting, CRO role page, CFO role page