Where does bribery risk sit on the risk map, and which scenarios must the assessment cover?
Under Article 18 of the TWSE Risk Management Best Practice Principles for Listed Companies, bribery is both an integrity risk and a compliance risk. Common scenarios in the bribery risk assessment (ISO 37001 clause 4.5):
- Hospitality and gifts, commissions
- Agents and distributors
- Dealings with government
- Donations and sponsorship
- Overseas markets
The results must map to controls: third-party due diligence, financial controls and approvals, reporting channels and investigation procedures, and the anti-bribery compliance function. The principles cover listed companies; companies that are not public companies are not covered and can use them voluntarily.
Our group has overseas subsidiaries and agents. How does legal exposure to cross-border bribery go into scenario analysis?
It has to be judged entity by entity, not waved through as "extraterritorial":
| Law | What matters |
|---|---|
| Article 11 of Taiwan's Anti-Corruption Act | Bribing officials of foreign countries, mainland China, Hong Kong or Macau in matters of cross-border trade, investment or other business activities is punishable; it also applies to acts committed outside the Republic of China |
| US FCPA | US securities issuers (including foreign issuers), US domestic concerns (including US subsidiaries of Taiwanese groups), and their directors, employees and agents |
| Section 7 of the UK Bribery Act | Organisations incorporated in the UK or carrying on a business or part of a business in the UK; an offence can arise from bribery by associated persons such as agents and subsidiaries |
Whether a given entity falls within scope, and what liability follows, is a legal judgement for lawyers to make case by case.
Which records can integrity-risk KRIs be drawn from?
Running ISO 37001 leaves auditable records: risk assessment records, third-party due diligence, records of how reports were handled, and training and audit evidence. The CRO can pick indicators from these records, such as completion of due diligence, intake and investigation progress of reports, and closure of audit findings, track them quarterly and fold them into the annual report.
Control points sit in approvals, payments, hospitality and gifts, and procurement (clauses 8.3, 8.4, 8.7); raising concerns and investigation are clauses 8.9 and 8.10.
What evidence can ISO 37001 provide for the ESG integrity indicators and annual report disclosure?
The relevant TWSE ESG indicators:
- S-7: a board-approved integrity policy, a dedicated or part-time unit promoting integrity, its implementation explained, and reporting to the board at least once a year (2027 wording; split into S-7 and S-8 in 2026)
- S-9: a whistleblowing system for insiders and outsiders on illegal (including corruption) and unethical conduct, disclosed in detail on the company website
The corporate governance report in a public company's annual report must also disclose how integrity management has been carried out. ISO 37001 policies, risk assessment records, training and audit evidence can support this; whether they meet a given indicator still has to be checked against that year's wording. The ESG evaluation covers listed companies; companies that are not public companies are not covered and can use it voluntarily.
With ISO 37001 certification, can we tell the committee that bribery risk is under control?
It cannot be put that way. ISO 37001 itself states that conformity cannot guarantee that no bribery occurs; whether the "adequate procedures" defence under section 7 of the UK Bribery Act succeeds is decided by the court case by case, and the UK Ministry of Justice guidance sets out six principles without naming any particular management system.
Certification shows the system is working, not that risk is zero. The report to the committee should present residual risk and evidence of how controls operate, not the certificate itself.
We hold a 2016 certificate. What now, and how long does implementation take?
The current version is ISO 37001:2025, published in February 2025 (second edition, replacing 2016). UKAS in the UK and SCC in Canada have announced that certified organisations must transition by 28 February 2027, after which 2016 certificates are no longer valid; confirm the actual arrangements with your certification body. The main changes in 2025 include emphasis on compliance culture, handling conflicts of interest, clarifying the anti-bribery compliance function, and new climate change clauses.
Timeline as listed on the service page: depending on size and risk exposure, typically one to two quarters to build the system and run the internal audit, then certification.
How does Winners Consulting help CROs with ISO 37001?
- One risk language: implemented on the backbone of ERM risk language, sharing the document system with existing internal controls to avoid duplication
- Entity by entity: whether Article 11 of the Anti-Corruption Act, the US FCPA and the UK Bribery Act apply is assessed for each legal entity
- Little disruption: interviews and workshops fit into existing meeting rhythms
- Separate roles: Winners Consulting is the consultant and does not certify; specific legal liability is for lawyers to judge
- Who leads: vice-president and director-level consultants lead end to end, never outsourced
ISO 37001 anti-bribery management system, Choosing an ISO 37001 consultant, ERM consulting. Request a free mechanism diagnosis
How other roles see this service
Other services for this role
- ERM for CROs: how do you build the risk map, KRIs and board reporting?
- ISO 22301 for CROs: how do scenarios, RTOs and exercises enter the risk report?
- Trade secrets for CROs: how do you set leak scenarios, reasonable measures and KRIs?
- ISO 27001 for CROs: how do information and enterprise risk share one scale?
- AI risk for CROs: what to decide first on ISO 42001 and the EU AI Act?
- GDPR for CROs: how to assess fines, intra-group transfers and breach scenarios?
- NIS2 for CROs: how to assess scope, fines and management body duties?
- EU CRA for CROs: how to handle market access risk, reporting and oversight?
- CRO and DORA: where do ICT third-party and operational resilience risks go on the risk map?
- CRO and AI transformation: putting AI risk into the risk map, KRIs and board reports