Interview: The contribution of an Anti-Bribery Management System in organizations

Montevideo, July 12, 2021.

Sofis Solutions interviewed CPA Carlos Serra, Director and Manager of Datasec, who spoke about the importance of adopting mechanisms and international anti-bribery best practices in order to prevent, minimize, and control the risks associated with corruption in the activities and operations of organizations, as well as to safeguard their trust and reputation with all stakeholders.

The adoption of anti-corruption measures is an essential component for both states and public and private sector organizations. Through these measures, it is possible to implement mechanisms that protect their activities and operations, while increasing trust, credibility, reputation, and stakeholder interests.

The United Nations Convention against Corruption (UNCAC) acknowledges that states cannot fight corruption alone, and that private organizations have a vital role to play as allies in this effort. To date, this agreement is in force in over 170 countries and establishes common standards, policies, processes, and practices to support anti-corruption initiatives at the national level.

In this context, Sofis Solutions has worked for several years to uphold a zero-tolerance stance against bribery in all its forms. As part of this commitment, the company renewed in June its certification under ISO 37001:2016 Anti-Bribery Management System. According to the audit results, its management system is operating properly and in accordance with the compliance framework of the standard.

Given the importance of building an ethical and transparent business culture based on anti-bribery best practices, CPA Carlos Serra, Director and Manager of Datasec, shares in the following interview the significance of adopting and implementing mechanisms and controls to prevent, mitigate, and detect bribery in organizations — including the implementation of a management system based on ISO 37001.

Why do you believe it is important for organizations to implement a management system according to ISO 37001? What kinds of benefits do you think it provides?

"The reality is that every organization is exposed to fraud, corruption, and particularly bribery. It may be a more or less likely risk, but it’s hard to say it’s zero.

Adopting the ISO 37001 standard sends a message both internally and externally that 'bribery is not acceptable here' (neither giving nor receiving). In a global and particularly Latin American context where corruption frequently makes headlines, this is a powerful message. From my perspective, I see more and more people saying: No to corruption."

Based on your experience, what types of requirements related to anti-bribery controls or best practices would you recommend that international organizations or public entities demand from companies seeking to provide services?

"Unfortunately, unlike ISO 9001, for example, there are still relatively few organizations certified under ISO 37001 worldwide. We hope this will change over time.

In the meantime, an international body or public administration needs to know who they are dealing with. They should value organizations that have anti-bribery policies and controls — and even more so if they are certified, since in that case an independent third party has assessed their management system. Undoubtedly, requiring this will reduce the likelihood of facing situations that could damage their image and reputation by associating with, for example, corrupt suppliers. This can be achieved with proper legal advice and in accordance with each country’s regulations."

What do you believe is the relationship and impact between cybersecurity deficiencies and potential acts of bribery?

"Organizations must protect their information (internal, customer, patient data, etc.). Even though it may not appear on their financial statements, it is a highly valuable asset. Unfortunately, this isn’t fully appreciated until, for example, their data is 'held hostage' through a ransomware attack.

One consequence of the pandemic was the shift to remote work, which prioritized ensuring that employees could connect and work from home. This undoubtedly weakened cybersecurity controls and created vulnerabilities and threats that could be exploited — either accidentally or intentionally — by employees."

The implementation of ISO 37001 enables organizations to adopt a set of measures and controls to address bribery and support the fight against corruption. For Sofis Solutions, this is a priority and aligns with contributing to the achievement of the Sustainable Development Goals (SDGs) of the 2030 Agenda — specifically SDG 16: Peace, Justice, and Strong Institutions — which aims to promote societies based on transparency, ethics, and accountability in both public and private institutions, to respect human rights and ensure peaceful and stable environments for all.