Anti-Bribery & Corruption Compliance Checklist Template

What the Anti-Bribery & Corruption Compliance Checklist Covers

1. 1
   Phase 1

   Phase 1: Set Up, Scope & Top-Level Commitment

   8 tasks

   The answers on the first task decide which tasks appear: the UK tasks for the Bribery Act, the US tasks for the FCPA, notes for any other country, and the accounting tasks for a US issuer. Due dates count back from the board meeting that will approve the review.

   • Set up the anti-bribery compliance review — the organisation, the review period, the board meeting date, the jurisdictions that apply, whether it is a US issuer and the four people; later tasks are assigned from these fields
   • Gather last year’s review and open actions — the previous report and action plan, what is still open, the gifts and hospitality register, third-party files, training records and any bribery concerns raised since
   • Confirm the scope of the review — entities, subsidiaries, joint ventures, countries and business lines, businesses acquired since the last review, and the people who perform services for or on behalf of the organisation
   • Check the board’s anti-bribery commitment — a current statement of zero tolerance endorsed by the board, the senior person responsible for the programme, and the board’s involvement in bribery risk decisions since the last review
   • Check the compliance function’s authority and resources — the person who runs the programme has authority, independence from management, direct access to the board or audit committee, and enough staff and budget for the risks
   • Confirm whether section 7 of the Bribery Act applies — a body or partnership formed in the UK, or one that carries on business or part of a business in the UK, is a relevant commercial organisation, and the offence applies wherever the bribery takes place
   • Confirm which FCPA provisions apply — the anti-bribery provisions cover issuers, US domestic concerns and other persons who act in US territory; the accounting provisions cover issuers only
   • Record the anti-bribery laws of other jurisdictions — for each other country in scope, the law, what it prohibits, whether it has a corporate offence or a defence for adequate procedures, and the legal advice you have
2. 2
   Phase 2

   Phase 2: Bribery Risk Assessment

   7 tasks

   The Ministry of Justice guidance groups common external risks into five kinds: country, sector, transaction, business opportunity and business partnership. It asks for an assessment that is periodic, informed and documented, and that also looks at the organisation’s own weaknesses.

   • Assess country risk — perceived levels of corruption, how well anti-bribery law is enforced, and how transparent public procurement is in each country where you or your agents work
   • Assess sector risk — the guidance names extractive industries and large-scale infrastructure as higher-risk sectors; rate your own sector and the sectors of your main customers
   • Assess transaction risk — charitable and political contributions, licences and permits, public procurement, and any other transactions with public bodies or officials
   • Assess business opportunity risk — high-value projects, projects with many contractors or intermediaries, and deals not at market prices or without a clear legitimate objective
   • Assess business partnership risk — intermediaries who deal with foreign public officials, consortium and joint venture partners, and relationships linked to politically exposed persons
   • Assess internal risk factors — gaps in training, bonus schemes that reward excessive risk-taking, unclear rules on hospitality and donations, weak financial controls and a weak message from the top
   • Rate each bribery risk in the register — likelihood and impact on your agreed scale, the controls that address it, the residual rating and the owner, written so the board can follow the reasoning
3. 3
   Phase 3

   Phase 3: Policy, Gifts, Hospitality & Donations

   5 tasks

   Reasonable and proportionate hospitality is a normal part of business, and the Ministry of Justice guidance says the Act is not meant to prohibit it. The register is where you show that what was given and received stayed reasonable, was approved and was recorded.

   • Review the anti-bribery policy and code of conduct — the stance on bribery, gifts, hospitality, donations, facilitation payments and intermediaries, whether it matches this year’s risks, and whether staff can read it in their own language
   • Review the gifts and hospitality register — entries against the policy limits and approvals, items in expense claims that never reached the register, and repeat or lavish items to the same people, especially public officials
   • Review charitable and political donations and sponsorships — each one approved and recorded, made to a genuine body, and not linked to a decision pending with anyone connected to it
   • Check how facilitation payments are handled — the Bribery Act has no exemption for them, while the FCPA has a narrow exception for routine governmental action; record every demand reported and how it was dealt with
   • Check recruitment, incentives and disciplinary controls — due diligence proportionate to the risk of each post, anti-bribery terms in contracts, bonus schemes that reward compliance rather than risk, and discipline applied to breaches
4. 4
   Phase 4

   Phase 4: Third Parties & Intermediaries

   7 tasks

   Agents, consultants and distributors are a common route for bribes. The answer on the second task decides whether the enhanced due diligence tasks appear.

   • List every third party that acts on the organisation’s behalf — agents, consultants, distributors, resellers, customs and visa agents, joint venture partners and lobbyists, with the countries they work in and how they are paid
   • Rate each third party’s bribery risk — from the country, the service, contact with public officials and the way they are paid; record whether any are high risk
   • Check due diligence files are complete and current — ownership, reputation, qualifications, any link to public officials, and the business reason for using them, to a depth that matches each rating
   • Check contracts carry anti-bribery terms — services described exactly, anti-bribery commitments, audit rights and the right to end the contract for a breach
   • Test payments to third parties — commissions and fees against the work done and market rates, success fees, payments to offshore accounts, and payments to anyone other than the contracted party
   • Run enhanced due diligence on each high-risk third party — direct enquiries, independent research and reference checks, their ties to public officials, and why the business needs them
   • Decide on each high-risk third party — continue with added controls such as training, audits and an annual compliance certificate, change the terms, or end the relationship; record who decided and why
5. 5
   Phase 5

   Phase 5: Books, Records & Financial Controls

   5 tasks

   Bribes are often hidden as legitimate payments such as commissions, consulting fees or marketing costs. The two accounting tasks appear only for a US issuer.

   • Test how high-risk payments are recorded — a sample of commissions, consulting fees, marketing, travel and entertainment, rebates, discounts, petty cash and miscellaneous expenses, looking for vague descriptions and missing support
   • Check approval controls over high-risk spending — delegated authority, separation of duties, and the approvals for gifts, hospitality, donations and third-party payments
   • Look for red flags in the ledgers — excessive commissions, large discounts to distributors, vague consulting agreements, round-sum and cash payments, and payments to offshore accounts
   • Test the FCPA books and records provision — books, records and accounts that in reasonable detail accurately and fairly reflect transactions, including those of subsidiaries and joint ventures you control; there is no materiality threshold
   • Test the FCPA internal accounting controls provision — transactions executed and access to assets allowed only with management’s authorisation, transactions recorded so financial statements can be prepared, and recorded assets compared with actual assets at reasonable intervals
6. 6
   Phase 6

   Phase 6: Training, Speak-Up & Investigations

   6 tasks

   Training should match the risk of each role, and people need a safe way to raise concerns. The last task asks whether the review itself has found a suspected bribery concern; Yes shows Phase 7.

   • Check training completion by role — induction training for all staff, and tailored training for higher-risk roles such as purchasing, contracting, distribution, sales and people working in high-risk countries
   • Review training content and results — practical scenarios in the local language, test results and feedback, and whether people know what the policy means for their own work
   • Check external communication of the policy — the anti-bribery stance in supplier and agent onboarding, in contracts and on the public website
   • Test the speak-up channel — confidential and open to staff and outsiders, with protection from retaliation for people who raise concerns, and every report logged
   • Review bribery concerns and investigations since the last review — each one investigated, documented and closed, any discipline applied, and the lessons fed back into controls and training
   • Record whether the review has found a suspected bribery concern — anything in this review that suggests a bribe may have been offered, paid, requested or received; answer Yes as soon as it is found, whichever phase you are in
7. 7
   Phase 7 — If a Concern Is Found

   Phase 7: Suspected Bribery Concern

   6 tasks

   Shown only when the review finds a suspected bribery concern. Its due dates count from the date the concern was identified, not from the board meeting, because a concern cannot wait for the report.

   • Escalate the concern to legal counsel the same day — what was found, where, and who may be involved, without confronting anyone or alerting the people concerned
   • Preserve the evidence — records, emails, payment files and the review’s workpapers, with routine deletion stopped for the people and systems involved
   • Brief the board approver — what is known, who has been told, and any decision that cannot wait
   • Route the concern to the investigation process — an investigator independent of the people involved, working under legal advice, with a case file of its own
   • Suspend affected payments or relationships where advised — payments to the third party or account concerned held while the investigation runs, if legal counsel advises it, with the reason recorded
   • Take legal advice on reporting to the authorities — in the UK the Serious Fraud Office and the National Crime Agency investigate international bribery; in the US the Justice Department’s FCPA Unit takes reports; record the decision and who made it
8. 8
   Phase 8

   Phase 8: Assess, Report & Board Approval

   8 tasks

   The assessment against the six principles appears for the UK, against the FCPA Resource Guide hallmarks for the US, and against local requirements for another country. Nothing after the board’s approval of the review and action plan can be completed until it is given.

   • Assess the programme against the six principles — proportionate procedures, top-level commitment, risk assessment, due diligence, communication including training, and monitoring and review, each rated with its evidence
   • Assess the programme against the FCPA Resource Guide hallmarks — the hallmarks of an effective compliance programme that DOJ and the SEC describe, each rated with its evidence
   • Assess the programme against the other jurisdictions’ requirements — each law recorded in Phase 1, with the gaps and the legal advice behind each rating
   • Write the action plan — each gap with an action, an owner, a due date and the risk it addresses
   • Compile the report to the board — the risk profile, the register review, third-party results, books and records findings, training, speak-up and investigations, the gaps and the action plan
   • Board approves the review and action plan — the board approver records the decision and any conditions; nothing after this task can be completed until it is done
   • Share the results and track every action to closure — each risk owner gets their risks and actions, and every action is closed with evidence or escalated when it passes its due date
   • Schedule the next review and the triggers for an earlier one — a new market, an acquisition, an incident of bribery, negative press, a change in the law or a change in the countries where you operate