Anti-Bribery Compliance: How to Build an Effective Programme
Three major regimes define the minimum standard for anti-bribery compliance: the UK Bribery Act 2010, applicable to any commercial organisation that carries on part of its business in the United Kingdom; the French Sapin II law of 9 December 2016, applicable to French companies and their subsidiaries above the employee and turnover thresholds set in Articles 17 and 18 of the law; and the United States Foreign Corrupt Practices Act of 1977, applicable to any issuer registered with the SEC and any US person. Each regime requires organisations to put in place preventive measures and to be able to demonstrate their effectiveness to regulators. The UK Serious Fraud Office, the French Anticorruption Agency (AFA), and the US Department of Justice each assess the adequacy of the programme, not merely the existence of a written policy. An effective programme is one that a regulator can verify: every measure must have a named owner, a documented process, and evidence of implementation. Optivalue.ai provides the evidence framework that turns a written programme into a verifiable one.
The Eight Mandatory Measures of an Anti-Bribery Programme
Article 17 of the French Sapin II law lists the eight measures that any in-scope company must implement: a code of conduct, an internal alert mechanism, a corruption risk map, third-party due diligence procedures, accounting control procedures, a training programme for exposed staff, a disciplinary regime for violations, and a second-level control and evaluation procedure. ISO 37001, the international standard for anti-bribery management systems, structures the same measures within a plan-do-check-act cycle. The UK Ministry of Justice guidance on adequate procedures under Section 7 of the Bribery Act 2010 uses six principles that map closely to the same measures. Each measure requires a named owner and a documented evidence trail; conflict-of-interest management, a pillar of every anti-bribery programme, is embedded in the third-party due diligence and code of conduct measures.
Corruption Risk Mapping: Method and Frequency
The corruption risk map is the diagnostic instrument of the programme. It identifies the exposure of the organisation to bribery and corruption risks, by business function, by geography, and by type of third party. Article 17(II)(3) of the Sapin II law requires the map to be regularly updated. The AFA's guidelines recommend an update when significant organisational or operational changes occur, and a full review on a defined cycle. The map is not a static document: it feeds directly into the third-party due diligence process by identifying which categories of third parties present elevated risk. Each risk entry must have a named owner, a severity assessment, and a documented treatment decision. A risk map that cannot be traced to a named owner and a review date is not a defensible document under AFA inspection.
Code of Conduct and Training: How to Document Them
The code of conduct must describe the behaviours prohibited by the law, the consequences of violation, and the procedures for raising a concern. It must be communicated to all employees and, in many jurisdictions, to third parties. Training must target exposed staff: those involved in sales, procurement, finance, and any function that interacts regularly with public officials or high-risk third parties. The AFA expects evidence that training has taken place, including attendance records and assessment results. A training log without individual completion records does not satisfy the standard. The internal reporting channel, a legal obligation in every anti-bribery programme, must also be described in the code of conduct and communicated to staff.
How Software Structures Each Measure and Produces Evidence for Regulators
Anti-bribery software structures the eight Sapin II measures in a single workspace: the risk map feeds the third-party screening workflow, the training log captures individual completions, the gifts and hospitality register records each declaration and approval, and the second-level control procedure generates a dated audit trail. Each document in the platform carries a creation date, a last-modified date, a named owner, and a version history; this chain of evidence is what the AFA or the SFO requests during an inspection. Optivalue.ai connects each measure to the others, so that a change in the risk map automatically triggers a review of the affected third-party screening criteria. The result is a programme that is not only written but demonstrably operational.
Book a demonstration with Optivalue.ai
FAQ
Which companies are in scope of the French Sapin II law?
Article 17 of the Sapin II law applies to French companies and their foreign subsidiaries when the French parent employs at least five hundred employees and has a turnover or consolidated turnover of at least one hundred million euros. Article 18 applies the same threshold to groups. The French Anticorruption Agency (AFA) is the authority responsible for verifying compliance; it may impose a public injunction to comply and refer serious breaches to the public prosecutor. Non-French companies with a French subsidiary above the threshold must also implement the programme for the subsidiary.
What is adequate procedures under the UK Bribery Act 2010?
Section 7 of the Bribery Act 2010 creates a strict liability offence for commercial organisations that fail to prevent bribery by an associated person. The organisation has a full defence if it can demonstrate that it had in place adequate procedures designed to prevent such bribery. The UK Ministry of Justice guidance on adequate procedures (published under Section 9 of the Act) sets out six principles: proportionate procedures, top-level commitment, risk assessment, due diligence, communication and training, and monitoring and review. Adequacy is assessed in light of the organisation's size, the nature and scale of its activities, and the markets in which it operates.
How often should the corruption risk map be updated?
The AFA's guidelines recommend updating the corruption risk map whenever a significant event affects the organisation's risk exposure, such as a merger, an entry into a new market, a change in distribution channels, or a material change in the third-party portfolio. Beyond event-driven triggers, a full review on a defined periodic cycle is expected. The cycle must be documented and the results of each review version-controlled, so that an inspection can trace the evolution of the risk assessment over time.
What is the scope of gifts and hospitality controls in an anti-bribery programme?
Gifts and hospitality policies must define the threshold above which a gift or invitation requires prior approval, the process for obtaining and recording that approval, and the prohibition on gifts or hospitality offered to or received from public officials. Many organisations set distinct thresholds for public-sector and private-sector counterparts. The gifts and hospitality register must log each item declared, the decision made, and the name of the approver. Entries in the register constitute evidence that the control is operational, not merely written.
How does ISO 37001 relate to national anti-bribery laws?
ISO 37001 is the international standard for anti-bribery management systems. It provides a framework for implementing, maintaining and improving an anti-bribery programme within a plan-do-check-act structure. Certification to ISO 37001 does not confer immunity from national laws such as the Bribery Act 2010 or the Sapin II law, but it provides structured evidence that the organisation has implemented an internationally recognised programme. Regulators in several jurisdictions have acknowledged ISO 37001 certification as a positive indicator when assessing the adequacy of a programme.
Back to top
On the same topic