ISO 37001 Training: Preparing the People Who Carry the Risk

Nearly every business I have worked with can produce an anti-bribery policy signed by every employee. Very few can show that the six people who might actually be offered or asked for something have been trained to recognise it and know what to do.

That gap matters. Under the Bribery Act 2010 a commercial organisation commits an offence if an associated person bribes on its behalf and the organisation cannot show it had adequate procedures in place. Training is one of those procedures, and it is explicitly expected to be risk-based. A universal signed policy and a company-wide e-learning module is not, on its own, a convincing answer.

If you want the background, our posts on anti-bribery training for owner-managed businesses and on what ISO 37001 adds cover the law and the standard. This one is about the training itself.

Risk is concentrated, so training should be

In a manufacturing SME, bribery exposure is rarely spread evenly. It sits with:

• Sales and business development, particularly anyone selling into overseas markets, through agents, or into government or defence procurement.
• Agents, intermediaries and distributors — associated persons whose conduct the organisation can be liable for, and who are frequently the least trained people in the chain.
• Purchasing, where the risk flows the other way: being offered inducements by suppliers.
• Anyone dealing with officials — customs, export licensing, inspection, permits.
• Senior management and the governing body, who carry explicit duties under ISO 37001 and whose tone determines whether anyone else takes it seriously.

Train these groups properly and deeply. Give everyone else awareness. That allocation is defensible, affordable, and matches what the standard asks for.

Train the judgement, not the rule

The rules are easy to state and useless in the moment. Nobody is ever offered something labelled "bribe". They are offered hospitality that is slightly too generous, at a slightly awkward time, by someone who is about to make a decision.

So train on decisions, using scenarios from your own sector:

• A customer's engineer asks you to cover travel and accommodation for a factory visit, plus two extra nights. Where is the line, who decides, and what is recorded?
• An overseas agent asks for an unusually high commission, payable to a different entity in a third country. What questions do you ask before agreeing?
• A freight agent says a payment will "release the shipment faster". Facilitation payments are illegal under UK law, unlike in some other jurisdictions. Does the person on the end of that phone call know that?
• A supplier sends hampers at Christmas during a tender. What happens to them?

People remember the argument they had in the room about where the line sat. They do not remember a slide listing the six principles.

Gifts and hospitality is where most systems fail

Not because the policy is wrong but because it is impractical. If approval takes three days and the decision is needed now, the system gets bypassed — and once bypassed quietly, it stops being evidence of anything.

Training should cover the thresholds, the register, who approves, and how to get an answer quickly. If the honest conclusion is that the process is too slow to use, that is useful feedback about the procedure rather than about the people. Monitoring and review is itself one of the adequate-procedures principles.

Third-party due diligence

For most manufacturers this is the highest-risk area and the least well trained. The people who appoint agents and distributors need to know what proportionate due diligence looks like: establishing who ultimately owns and controls the party, what they will actually do for the commission, whether their remuneration is justifiable against that, any political exposure, and what contractual anti-bribery terms and audit rights you require.

They also need to know what to do when the answers are unsatisfactory, and that declining a relationship is a supported decision. If the commercial pressure to appoint an agent always wins, the due diligence process is decoration.

Make reporting genuinely safe

ISO 37001 requires a way to raise concerns, including anonymously, with protection from reprisal. Training needs to tell people the channel exists, what happens when they use it, and that they are protected — including where they report in good faith and turn out to be wrong.

This is a culture question as much as a procedural one. You cannot engineer a culture, but you can guide it, nurture it and expose it. People judge whether it is safe to speak by what happens the first time somebody does.

Auditing the system

Whoever audits your anti-bribery management system needs the same process-auditing skill as any other internal auditor, plus the specific content: testing whether due diligence was actually performed before appointments, whether the gifts register reflects reality, whether training records match the risk assessment, and whether raised concerns were investigated.

If you already run internal auditor training for quality, add this content to it rather than running a separate programme.

Frequently asked questions

Do we need ISO 37001 certification?

Often not. Proportionate procedures aligned to the Bribery Act can be sufficient and are what most SMEs need. Certification becomes worth considering when customers or tenders require it, or when you operate in markets where you need demonstrable assurance. Our post on ISO 37001 covers that decision.

Does everyone need in-depth training?

No, and spreading it evenly wastes the budget. Awareness for all staff, depth for the roles that face the decisions. The standard expects it to be risk-based and so does the Ministry of Justice guidance on adequate procedures.

What about our overseas agents?

They are associated persons, so their conduct can create liability for you. Communicating your requirements to them, contracting for them, and training or briefing them is part of adequate procedures — and is the step most often skipped.

How often should it be refreshed?

Annually for high-risk roles, and whenever you enter a new market, appoint a new intermediary, or change the procedure. Keep dated records showing who was trained, on what, and how effectiveness was checked.

We deliver facilitated anti-bribery and ISO 37001 training, worked through as interactive sessions using scenarios from your own markets, and carry out internal and second-party audits on our clients' behalf. See our training services or get in touch.