ISO 37001 for General Counsel: agent bribery, whistleblowing investigations and contract clauses

If an overseas agent pays a bribe, what criminal liability can the company and senior executives personally face? Which laws reach us?

Judge entity by entity and market by market:

The DOJ and SEC FCPA Resource Guide also notes that a bribe paid by a third party does not eliminate potential criminal or civil FCPA liability. Guilt and defences are for legal counsel to judge case by case.

Which anti-bribery clauses belong in agent and distributor contracts? What should the General Counsel look for in review?

Start with Taiwanese rules, then what enforcers ask:

• Ethical Corporate Management Best Practice Principles, Article 9: before dealing, consider the legality of agents, suppliers and customers and whether they have engaged in unethical conduct; contracts shall include compliance with the ethical management policy and a right to terminate or rescind at any time if the counterparty engages in unethical conduct. The Principles are for listed companies; non-public companies may follow them voluntarily.
• US DOJ Evaluation of Corporate Compliance Programs (updated September 2024) asks of third parties: do contract terms specifically describe the services, is compensation commensurate with the work, and does the company have audit rights over third parties' books and accounts?
• Red flags in the FCPA Resource Guide: consulting agreements with only vaguely described services, excessive commissions, requests for payment into offshore accounts.

A clause you cannot perform is a risk in itself. ISO 37001 third-party due diligence, financial controls and approval design are the records behind the clauses.

A customer wants us to sign anti-bribery clauses and complete a due diligence questionnaire. How should the General Counsel respond?

A framework:

1. Can we do it: does the company already have the due diligence, training, financial controls and reporting channel the clauses require? A promise you cannot keep is a breach risk.
2. How liability is split: what triggers termination, the scope of indemnity or damages, whether the liability cap excludes anti-bribery breaches, the scope and frequency of the customer's audit rights, and whether we must flow the same obligations down to our own agents and suppliers.
3. Evidence on hand: as the service page puts it, when a customer's due diligence asks "how do you prevent bribery", the answer is a system and records that are actually running.

If the customer wants proof of overall compliance capability, the service page suggests ISO 37301 as the framework with ISO 37001 as the deeper module. What liability caps and indemnities are acceptable is for legal counsel to judge case by case.

We received a bribery report. How should the internal investigation run, and how do we protect the whistleblower?

• Listed companies: Article 23 of the Ethical Corporate Management Best Practice Principles requires confidentiality of the whistleblower's identity and report and allows anonymous reports, protects whistleblowers from improper treatment, sets report categories and standard investigation procedures, decides follow-up by severity, and keeps records of receipt, investigation and conclusion; reports involving directors or senior management go to independent directors or supervisors.
• EU subsidiaries: the Whistleblower Directive (EU) 2019/1937 requires private legal entities with 50 or more workers to set up internal reporting channels, acknowledge receipt within seven days and give feedback within three months (Articles 8 and 9); actual duties follow the Member State's transposing law.
• Investigation quality: when evaluating compliance programmes, the US DOJ looks at whether investigations are independent, objective, appropriately conducted and properly documented, and whether the company has an anti-retaliation policy.

In practice, preserve the relevant emails, books and payment records before starting. Whether criminal liability is involved and whether to disclose to authorities is for legal counsel to judge case by case.

If bribery happens, can the company argue it had adequate procedures? Does an ISO 37001 certificate help?

• UK: the adequate-procedures defence in section 7 of the Bribery Act is decided by the court case by case; the joint prosecution guidance of the CPS and the Serious Fraud Office notes that a single instance of bribery does not necessarily mean procedures were inadequate.
• US: the DOJ's three fundamental questions are whether the programme is well designed, adequately resourced and empowered, and works in practice.
• Limits of the certificate: ISO 37001 itself states that conformity cannot guarantee that no bribery will occur; certification shows the system runs, not zero risk.
• Edition: the current edition is ISO 37001:2025; UKAS (UK) and SCC (Canada) have announced that certified organisations must transition by 28 February 2027, after which 2016 certificates are no longer valid.

What the General Counsel needs is operating records: risk assessments, due diligence, training sign-offs, financial approvals and report handling. Whether a defence succeeds is for legal counsel to judge case by case.

How do legal, the ethical-management unit and internal audit split the work? What goes to the board, the annual report and the ESG evaluation?

The split under the Ethical Corporate Management Best Practice Principles:

On disclosure: the annual report discloses how ethical management is implemented and any differences from the Principles with reasons (annual report rules, Article 10); ESG indicator S-7 looks at the board-approved policy, the dedicated unit and the annual report, and S-9 at the whistleblowing system disclosed on the company website. Non-public companies are not bound by these rules or the evaluation and may follow them voluntarily.

How does Winners Consulting help the General Counsel with ISO 37001?

This is Winners Consulting's own account. Test us with the questions above.

• Who leads: Winners Consulting is an implementation consultant and does not issue certificates; VP- and director-level consultants run every engagement personally and do not outsource; certification is done by a separate certification body
• Typical work: bribery risk assessment, third-party due diligence procedures, financial control and approval design, reporting channel and investigation procedures, management commitment and the anti-bribery function
• One set of documents: implemented on an ERM risk-language backbone, sharing documents with the existing internal control system to avoid duplication
• Legal applicability: we assess, entity by entity, whether Taiwan's Anti-Corruption Act Article 11, the US FCPA and the UK Bribery Act apply; specific legal liability is for lawyers to judge
• Timeline (as listed on the service page): typically one to two quarters to build the system and complete internal audit, then certification
• First step: the first mechanism diagnosis is free

More: ISO 37001 anti-bribery management system, choosing an ISO 37001 consultant, ERM, CRO page, CFO page