ISO 37001 - Ethics & Compliance
Business Ethics and Compliance make the difference between successful long-term businesses and one-off or obscure operations that aim to profit no matter what and, in practice, there are different ways of taking ethics into consideration and the commitment to an ethical way of doing business.
Having an ethical business behavior may be a tough challenge in an extremely competitive world where the challengers do not always play fairly and the “shortcuts” used by them appear to be very tempting and profitable.
But, in fact, "the perfect crime does not exist" is the right idea and bearing in mind that the "dirty" profit could turn into disaster and incalculable losses is healthy for a strong and consistent business. Moreover, recent cases that shook large international organizations have shown that a good reputation means much more than a good image.
This is why we help our clients preserve their business reputation properly in each action and day-to-day business by avoiding without hesitation "compromising compromises" and by managing the business in perfect compliance.
We have gained significant experience in providing a full legal assistance package to organizations aiming to obtain the ISO 37001:2016 certification - Anti-bribery Management Systems, by redesigning the processes, the documentation and the structures in order to be compliant with the standard.
We have relevant exposure and we are experienced and qualified to assist our clients in the design of Ethics Policies and their implementation, legal audit and training on Ethics & Compliance, but also in performing special investigations where appropriate.
For reference, the topic is managed directly byMihai ACSINTE.
Frequently Asked Questions
Is ISO 37001 certification mandatory in Romania?
No. ISO 37001:2016 is a voluntary international standard for anti-bribery management systems, and Romanian law does not require private companies to be certified. Organizations seek certification to demonstrate to business partners, authorities and investors that they have implemented reasonable measures to prevent bribery, and some clients or tenders may ask for it. Certification is issued by an independent, accredited certification body after an audit. It does not guarantee that bribery will not occur, but it supports a credible compliance position.
What does an ISO 37001 anti-bribery management system include?
ISO 37001:2016 requires an anti-bribery policy endorsed by top management, a designated compliance function with adequate authority, and a documented bribery risk assessment. Key controls include due diligence on employees and business associates, financial and non-financial controls, rules on gifts, hospitality and donations, anti-bribery clauses in contracts, training, and channels for raising concerns. The system must also include procedures for investigating suspicions, internal audits, management reviews and continual improvement based on lessons learned.
Which companies must set up internal whistleblowing channels in Romania?
Under Law no. 361/2022 on whistleblower protection, private employers with at least 50 employees must set up internal reporting channels and procedures. Medium-sized companies may share resources for receiving and investigating reports. Employers must ensure confidentiality, designate an impartial person or department to handle reports, acknowledge receipt, provide feedback within set deadlines, and protect whistleblowers against retaliation. Reports can also be made externally, including to the National Integrity Agency, and non-compliance can lead to fines.
Can a compliance program reduce a company's liability for bribery in Romania?
Romanian criminal law does not expressly provide a stand-alone "adequate procedures" defense for companies, as some foreign laws do. Even so, a well-designed and genuinely applied compliance program matters. It helps prevent misconduct, detect issues early and document that management acted diligently, which can be relevant when authorities assess the company's role and when penalties are individualized. It is also increasingly expected by foreign parent companies, lenders and business partners operating under their own anti-bribery laws.