GB/T 27021.9-2021Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 9: Competence requirements for auditing and certification of anti-bribery management systems (English PDF)

5.1 General

The personnel engaged in the ABMS audit should have certain abilities, including the general abilities described in GB/T 27021.1, understanding

The relationship between the requirements of ISO 37001 and these requirements, as well as the knowledge of ABMS described in 5.2~5.8.

Note. Each member of the audit team does not have to have the same ability, but the overall ability of the audit team needs to be sufficient to achieve the purpose of the audit.

5.2 The concept of bribery

5.2.1 The audit team should have knowledge related to the concept of bribery, including at least the following.

a) Direct and indirect payments;

b) Facilitation payment;

c) Non-financial benefits or benefits (such as benefits or opportunities provided to family members);

d) Conflict of interest.

5.2.2 The audit team should have knowledge of bribery risks related to third parties, including public officials, agents, consultants, subcontractors, and

Its family members or social relations, etc.

5.2.3 The audit team should have at least knowledge of bribery related to the following situations.

a) Personnel, recruitment, hiring and compensation;

b) Commercial activities;

c) travel, gifts and entertainment;

d) Donations and sponsorships;

e) Procurement and contracting;

f) Sales and marketing;

g) Manufacturing and supply chain;

h) outsourcing process;

i) Mergers and acquisitions.

5.2.4 The audit team should have knowledge about bribery risk points (red flags).

Note. The list of bribery risk points (red flags) can be obtained from the International Chamber of Commerce (ICC), the Organization for Economic Cooperation and Development (OECD) and the World Bank.

5.2.5 The audit team shall have control measures for preventing, detecting and responding to bribery, as well as relevant control measures related to the consequences of insufficient control measures or loss of control.

Knowledge.

5.3 Organizational environment

5.3.1 The audit team should have knowledge of the organization's operating environment, including those required by Chapter 4 of ISO 37001.2016.

5.3.2 The audit team should have the necessary knowledge and skills to independently conduct organization-related research, so as to identify and understand

Bribery allegations or matters, industry bribery risks, government interaction or degree of supervision and other related matters.

5.3.3 The audit team should have knowledge related to the organizational structure, such as mergers and acquisitions, joint ventures and investment tools.

5.4 Laws, regulations and other requirements

The audit team should have relevant knowledge to determine whether the organization's compliance procedures are adequate and implemented. This procedure is used to identify and evaluate the team.

Whether the organization complies with applicable laws and regulations and other requirements of ABMS.

5.5 Bribery risk assessment and due diligence

The audit team should have the knowledge of how to implement the bribery risk assessment described in 4.5 of ISO 37001.2016, including various assessment methods and

Its limitations and difficulty, due diligence (see ISO 37001.2016, 8.2) and bribery risks associated with business partners (see

ISO 37001.2016,8.5) knowledge.

5.6 Bribery risk

The audit team should have the methods and skills related to the evaluation and control of bribery risks described in Chapter 7 and Chapter 8 of ISO 37001.2016.

5.7 Anti-bribery control

The audit team should have the knowledge and skills related to planning and evaluating anti-bribery control and investigating bribery.

5.8 Anti-Bribery Management System (ABMS)

The audit team should have the knowledge and skills related to the planning and implementation of ABMS or similar compliance management or internal control systems.

6 Competence requirements of personnel who implement application review, review audit reports and make certification decisions (other personnel)

6.1 General

Other personnel should have the general abilities described in GB/T 27021.1, understand the requirements of ISO 37001 and the relationship between these requirements.

Department, and the requirements of ABMS knowledge described in 6.2~6.3.

6.2 The concept of bribery

Other personnel should have knowledge about bribery concepts and risks.

6.3 Organizational environment

Other personnel should have knowledge of the organization's operating environment, including those required by Chapter 4 of ISO 37001.2016.