Stay On Top of Your Employee Data Privacy Compliance Anywhere in the World!

Data Privacy Compliance: Anywhere in the world

Data protection laws protect employees from the misuse of their personal data – employee home addresses and beyond – sensitive data. As an employer, you’ll be trusted to safeguard and protect your employees’ data against a breach, meeting data privacy laws and regulations. 

Employers need to develop policies that take a compliant but balanced approach towards their employee data privacy and security. Organizations must implement the appropriate infrastructure, management and workforce to keep data compliant throughout its lifecycle because those accused of violating data privacy rights risk significant hits to the company’s reputation and employees’ trust. 

This article covers the most updated laws in personal data in 61 key jurisdictions across the Americas, Asia Pacific, the Middle East, Europe and Africa: 

UGANDA: The 2019 Data Protection and Privacy Act, was passed into law to complement the constitutional privacy protections under Article 27 of the Constitution of the Republic of Uganda. The Act itself regulates all personal data collection, processing, use and disclosure. It applies to any person, entity or public body within or outside of Uganda who collects, processes, holds or uses personal data. The Act requires an employer to obtain informed consent before collecting or processing personal data. The Act permits the processing or storage of personal data outside Uganda – if adequate measures are in place.

SOUTH AFRICA: The right to privacy is protected under the 1996 Constitution of the Republic of South Africa. The common law and the Protection of Personal Information Act, 2013 (POPIA), came into effect on 1 July 2020, however is subject to a grace period until 30 June 2021. Case law recognizes that the right to privacy is not absolute and may be limited where it is reasonable and justifiable to do so. Personal information may be processed based on one of the justifications for processing personal data under POPIA. These justifications include consent and where it is necessary for pursuing the legitimate interests of the responsible party or employer, or third party to whom it is disclosed.

NIGERIA: The National Information Technology Development Agency has published Data Protection Guidelines, 2019 which safeguard the rights of natural persons to data privacy

MOZAMBIQUE: The Constitution of the Republic of Mozambique, as well as the recently enacted Electronic Transactions Law (The Law No. 3/2017, of 9 January), prohibits access to databases or to computerised archives, files and records for obtaining information on the personal data of third parties, as well as the transfer of personal data from one computerized file to another that belongs to a distinct service or institution, except in cases provided for by law or by judicial decision. The Labor Law establishes that employers may not require an employee to supply information regarding their private life, except when particular requirements inherent to the nature of the professional activity so require. In addition, employees’ personal data obtained by an employer is subject to a duty of confidentiality. Information where the release of which would violate that employee’s privacy rights may not be given to a third party without the employee’s consent unless it is required by law. 

KENYA: The Data Protection Act, 2019 gives effect to Article 31(c) and (d) of the Constitution on the right to privacy. The Act establishes the Office of the Data Protection Commissioner, makes provision for the regulation of the processing of personal data and provides for the rights of data subjects and obligations of data controllers and processors, among others. The Act is modelled along the lines of the EU General Data Protection Regulations (GDPR). The Constitution guarantees the right to privacy. The Computer Misuse and Cyber Crimes Act, 2018 creates various offences, including the right to privacy, concerning computer systems.

KUWAIT: There are no clear laws in Kuwait comparable with those in the US or Europe concerning the handling and transmission of employees’ personal information, nor do any provisions address the cross-border flow of data. However, it is advisable to seek prior written consent to the processing of personal data from the employee to the extent necessary to address the various privacy protections set out in Kuwait law, including the protections set out in the Kuwait Penal Code and the Kuwait Constitution.

ANGOLA: The Data Privacy Law No. 22/11, 17 June, governs Angolan data privacy and determines, in general terms, how to collect, use, disclose, store and give access to “personal information.” There is no specific regulation on employee data privacy.

JAPAN: The receipt, maintenance of and access to personal information relating to an individual is regulated by the Act of Protection of Personal Information. Broadly, upon the collection of such information, the collector must notify the person of the purpose of the use of such information and after that must take necessary and proper measures to prevent leakage, loss or damage of that information, and take other reasonable steps to control the security of the personal information. In addition, the party maintaining such information is required to adopt internal regulations designed to ensure the confidential and secure maintenance of such information as long as it is held. Disclosure of personal information to third parties (parent and affiliated companies are considered third parties) is strictly limited.

INDIA: Employee records and employee access to data The Information Technology Act, 2000 covers data protection and violation of personal privacy. This statute safeguards against certain breaches concerning data from computer systems, prevents unauthorized use of computers and creates liability for damage suffered in the event of unauthorised access, downloading, extraction and copying of data from a computer system or network. It stipulates the penalty for breaches of confidentiality and privacy. The storage, management and handling of sensitive personal data or information belonging to persons located in India is regulated by the Sensitive Information Rules enacted under the Information Technology Act, 2000. The government of India has also released the Personal Data Protection Bill, 2019 (Data Protection Bill), which the Indian government is considering replacing the Sensitive Information Rules. Sensitive personal data or information is defined under the Sensitive Information Rules to include passwords, financial information, physical, psychological and mental health conditions, sexual orientation, medical records and history, and biometric information. Any body corporate receiving any of the above types of information due to either using the services of an individual or employing an individual must comply with the Sensitive Information Rules regarding the processing and storing of such information.

MALAYSIA: Governed by the Personal Data Protection Act 2010 (PDPA), employers must obtain employees’ consent (implied or express). Explicit consent is required if “sensitive personal data” is being collected. Businesses must notify their employees of the nature and purpose of the information being collected, to whom it is being disclosed, and that the employees have the right to access such data. Employee consent is also required before employee personal data is shared with third parties (external payroll service providers). As a result of the PDPA, an employee consent/notice document is required. This document has to be bilingual – in English and Bahasa Malaysia – and is usually a separate document and referenced in the employment contract.

SINGAPORE: Employers are required to notify employees the reason behind the usage of their personal data in connection with the management and termination of employment and/or obtain their consent where collecting, using or disclosing their personal data. However, under the PDPA, an employer is permitted to collect, use and disclose the employees’ personal data for purposes of managing or terminating an employment relationship without the need to seek employee’s consent, so long as the employee has been notified of the purposes of such collection, use and disclosure and/or provides their consent before such collection, use and disclosure. Further, employers may collect, use and disclose personal data without obtaining the employees’ consent or notifying them where it is necessary for evaluative purposes, including determining the suitability or eligibility of an individual to whom the data relates for employment continuance in employment or promotion. Note that employers must seek consent for purposes that are not related to or collect personal data that is not relevant to the management or termination of an employment relationship or that are not relevant for evaluative purposes unless any other exception under the PDPA applies.

THAILAND: The Personal Data Protection Act BE 2562 (2019) (PDPA) was enacted on 28 May 2019 and has full effect from 27 May 2020. The PDPA is the first-ever law relating to personal data protection in Thailand. Essentially, consent is required for the collection, use and/or disclosure of personal data. Under the PDPA, the term ‘personal data is defined as any data pertaining to a person that enables identifying that person, whether directly or indirectly, but specifically excluding data of someone deceased.

MYANMAR: There are no specific regulations or laws. However, according tothe Protecting the Privacy and Security of Citizens (enacted on 8 March 2017), a person is not allowed to do the following without permission of the relevant authorities: 

  • Request or acquire any private call data, electronic communications data and information from operators or supply such information
  • Open, search, seize, destroy or damage any envelope, parcel or correspondence communicated that are the personal affairs of other individuals; and
  • Criticize or interfere in the personal affairs and family affairs of any citizen or engage in conduct that may be detrimental to the good name, standing or dignity of an individual Other than the above, there are currently no other laws or regulations on data privacy.

VIETNAM: The Civil Code requires any person to seek an individual’s consent before collecting, storing, using or publishing their personal data. The parties to a contract are not permitted to disclose any information about the private life or personal affairs that they became aware of in the course of entering into and performance of the contract. The 2018 Law on Cyber Security covers any domestic or foreign enterprise that provides services on telecommunications networks, the internet or value-added services in Vietnam’s cyberspace. The law governs the collection, exploitation, analysis, and processing of personal data, data about service users’ relationships, and data generated by them in Vietnam. Under this law, any such data must be stored in Vietnam under the terms stipulated by the government. Any such foreign enterprise must have a branch or representative office in Vietnam.

Indonesia: Law No. 11 of 2008 on Electronic Information and Transactions, as amended, restricts the electronic use of private data without the data subject’s consent. Under Law No. 39/1999 on Human Rights, each individual has the right to their privacy and cannot be subjected to an investigation in relation to personal data without their agreement, except on the order of a court or other legitimate authority under prevailing legislation. A new draft of the Data Privacy Law has been prepared, but it is unclear when it will be introduced.

SOUTH KOREA: Under the PIPA, an employee is entitled to request the employer to allow access to, correct, or delete personal information. The PIPA requires an employer to obtain the consent of the individual employee when his or her personal information is obtained or provided to third parties.

UNITED ARAB EMIRATES: Except for the Dubai International Financial Centre Free Zone, there are no clear laws in the UAE concerning handling and transmitting employees’ personal information, nor are there any provisions addressing the cross-border flow of data. However, it is advisable to seek prior written consent to process personal data from the employee to the extent necessary to address the privacy protections set out in UAE law, including the protections set out in the UAE Penal Code, Cyber Crimes laws and the UAE Constitution.

SAUDIA ARABIA: The transfer of employee data outside of the KSA is not regulated under Saudi law. However, general Sharia principles provide for personal data protection rules. These imply that employers should include provisions in employment contracts where the employee’s consent is required for the employer to use or disclose the employee’s data to third parties, to the extent that such disclosures may be required.

TUNISIA: Under Tunisian law, all people have the right to protect personal data related to their private life, which applies to both automated and non-automated treatment of data. Personal data is defined as information that directly or indirectly permits identifying a physical person, except for data linked to public life or defined as such under the law. In general, any organization planning to use personal data must make a declaration of the data to the National Authority for the Protection of Personal Data. However, there are exceptions for employers using employee data. In addition, express written consent from the data subject is required in most cases.

TURKEY: Employees must be notified of personal data processing. Their prior written consent should be obtained (unless exceptions stipulated under the relevant legislation are present) for such processing and transfer of their personal data. Personal data should be processed: 1) In accordance with the law; 2) In good faith; 3) For definite, clear and legitimate purposes 4) In a relevant and measured manner; 5) Data controllers (i.e., individuals or legal entities that determine the purposes and means of processing personal data – for example, employers) are required to be registered with the Data Controllers Registry.

QATAR: According to law No. 13 of 2016 on Protection of Personal Data Privacy (Data Protection Law), businesses must protect the privacy of personal data or risk fines of up to QAR 5 million. Some of the key features of the new law are: Personal data is defined as data relating to an individual whose identity is determined, or able to be reasonably determined, either through the data or through linking this data with other data The Data Protection Law applies to personal data when it is processed electronically, or when it is accessed or collected or extracted otherwise in preparation for its electronic processing, or when it is processed in a traditional and electronic way together. The processing of personal data will be regulated in a way that bears similarities with existing data protection regulations elsewhere in the world. Particular protection will be provided to certain types of personal data, such as data relevant to children, to physical and mental health and crimes referred to as sensitive personal data.

OMAN: There are no clear laws in Oman comparable to those in the US or Europe concerning the handling and transmitting of employees’ personal information. However, the Electronic Transactions Law, RD 69/2008 (ETL), provides for the protection of personal data and regulates the transfer of personal data outside of Oman. The Cyber Crime Law, Royal Decree no. 12 /2011 (Cyber crime Law), provides an offense to violate the privacy of individuals through technology and prohibits the collection of private data. It is advisable to seek prior written consent from employees to process their personal data to the extent necessary to overcome the various privacy protections set out in the applicable civil and criminal laws.

Bahrain: Personal data privacy is protected under Law No. 30 of 2018 with respect to Personal Data Protection (PDPL). Employees must be notified before employers process personal data. Prior written consent should be obtained (unless exceptions stipulated under the relevant legislation are present) for such processing and transfer of their personal data. Transfers of personal data out of Bahrain is prohibited unless the transfer is made to a country or region that provides sufficient protection to personal data. Those countries have yet to be listed by the Personal Data Protection Authority or published in the Official Gazette.

PERU: During employment, organizations can collect employee personal data. However the processing of the data must be done in accordance with the guiding principles provided by the Peruvian Data Protection Law. And according to Peruvian Data Protection Law, personal data may only be processed and/or transferred with prior consent- consent must be free, informed, express and unequivocal. However, a company does not need the employee’s express consent to OBTAIN personal data (if this information is needed for employment. Still, it must comply with the duty of inform about the processing of personal data. 

BRAZIL: The upcoming (September 18, 2021) the new General Data Protection Law (Lei Geral de Proteção de Dados or LGPD) is Brazil’s first comprehensive data protection regulation. It applies to any processing operation carried out by a natural person or a legal entity, of public or private law, irrespective of the means used for the processing, the country in which its headquarters are located or the country where the data is located, provided that:

  • The processing operation is carried out in Brazil
  • The purpose of the processing activity is aimed at the offering or provision of goods or services or the processing of data of individuals located in Brazil, or
  • The personal data was collected in Brazil.
  • The LGPD does not contain specific employment provisions, but its provisions cover employment data.
  • The monitoring of corporate e-mail and internet use is allowed, but employees should be notified that they cannot expect privacy to use these work tools.

MEXICO: To process personal data, data controllers must provide a privacy notice to employees prior to collecting and processing the personal data. In the case of data transfers, the privacy notice must contain the name of the transferee or the person to whom the information is transferred. All transfers of personal data to domestic or foreign third parties must be per-approved by the data subject (i.e., the employee). 

MOROCCO:  In accordance with law No 09-08 on data protection, employees must be notified of data processing and their consent is required. Employees should be given the right to have access to and modify/amend their own personal data. Organizations must declare data processing to the National Control Commission for the Protection of Personal Data (Commission Nationale de protection des Données Personnelles). 

US: Certain states restrict the use of employees’ social security numbers for any identifying purposes. Medical information must be maintained separately from personnel files and kept confidential. Otherwise, employers are entitled to monitor or search corporate e-mails and internet traffic accessed by employee’s computer systems – on the premise; employees do not have an expectation of privacy in the use of their employer’s computer systems or corporate e-mails (especially with a policy that says so). Jurisdictions vary as to an employer’s ability to search or monitor personal e-mail addresses and websites accessed from an employer’s computer or premises.

VENEZUELA: Although there is no specific regulation regarding data privacy, employers have a general duty to uphold employees’ right to privacy and must observe the data protection principles determined by the Supreme Court (DP Principles). The DP Principles apply to systems, registers or compilations of data that allow the creation of a complete or partial profile of an individual forming part of such system, register or compilation (in this case, an employee, for example). There is no clear outline of what a “complete or partial profile” involves. This means that, in general, employee consent is required to process personal data. Venezuelan case law does not draw a distinction between forms of personal data. Therefore, there are no separate standards for the protection of sensitive data. According to the DP Principles, employers must (i) inform the employee what data has been collected, (ii) inform the employee of the purpose(s) of the collection of their personal data, (iii) inform the employee who will be the final users of the data (i.e., whether any third parties will have access to the data) and (iv) allow the employee to correct any erroneous data or delete any data that may be incomplete, inadequate or excessive in relation to the purpose(s) for which they were gathered (and this must be communicated to any third party who has been given access to the personal data). Venezuelan law also provides for the protection of private communications, and employers have a strict obligation to keep employee health information and records confidential.

COLUMBIA: To process personal data, data controllers must provide a privacy notice to the affected employees before collecting and processing personal data. In the case of data transfers, the privacy notice must contain the name of the transferee or the person to whom the information is transferred. All transfers of personal data to domestic or foreign third parties must be pre-approved by the data subject/employee. Employees have the right to know, update and correct their personal data. This right may be exercised in relation to partial, inaccurate, incomplete, split or deceptive data, and/or data that is prohibited from or not authorized for processing, such as race or ethnic origin, political orientation, religious or philosophical orientation and enrollment to unions or social organisations, among other items considered sensitive information. Employees may revoke the authorisation granted for the processing of their personal data and may request to remove their personal information from the employers or subcontractor’s databases by filing a formal claim, save for information directly related to their employment (e.g., HR core data, recruitment, performance, global compensation learning and training-related data and master data). This possibility is only applicable in the case of wrongful use of the employee’s information.

CHILE: The employer is obliged to maintain the privacy of the information and personal data related to its employees. The right to personal data protection has the status of a constitutional right, and therefore any breach can lead to litigation for impairment of fundamental rights.

ARGENTINA: The Argentine Data Privacy Law No. 25,326 (Ley de Protección de Los Datos Personales or LPDP) protects the personal data stored in files, registers, data banks or other technical storage of data processing, whether public or private, in order to guarantee the right to honour and privacy of the data of individuals, as well as to restrict the access to such information, in accordance with the provisions set out in Article No. 43, the third paragraph of the Argentine National Constitution.

AUSTRALIA: Australia has stringent data privacy obligations. As a general rule, personally identifiable data may only be processed if required for the employment contract’s performance and constitutes an employee record. Certain acts and practices are exempt from applying Australia’s data privacy laws, but strict criteria must be met for an exemption to apply. Employee records are generally exempt, but this exemption will not apply to documents that come into existence prior to the employment relationship (e.g., pre-employment or hire documentation) of any contractors engaged by the business. At the time it collects personal information, the employer is required to provide the individual with a statement setting out the company’s obligations under Australia’s data privacy laws and the individual’s rights. Further restrictions apply to sensitive personal data. Employee records – with the exception of tax file numbers – are not covered by the Australian notifiable data breach regime, which requires notification to the Office of the Australian Information Commissioner (OAIC) and to affected individuals of any data breach that could result in serious harm. However, the OAIC advises that it is good practice for employers to notify employees affected by a data breach so that they may take protective action. The monitoring of individuals and their data is covered by various surveillance legislation in each state or territory. Essentially, surveillance of employees is prohibited in sensitive areas, such as washrooms and change rooms, unless the surveillance device is installed pursuant to a warrant or authorization. Surveillance is permitted in public areas if it conforms with relevant legislation. Specific laws in some states govern the monitoring of an employee’s use of a work computer (i.e., e-mails and internet browsing).

ISRAEL: Employees generally must be notified of the terms of the employer’s personal data processing policy and must consent to it. Registrations in the Databases Register may be required. Special rules apply to data transfer outside Israel. Significant restrictions on monitoring e-mail and Internet use. Monitoring personal e-mail is restricted.

CANADA: Legislative requirements vary by jurisdiction. Where privacy laws apply, personal information must only be collected with consent and may only be used for its purposes. In most jurisdictions, e-mail and internet use may be monitored where notice has been given through clear employer policies.

PHILIPPINES: When an employer collects and processes personal information of its employees, especially sensitive personal information, the employer must comply with applicable guidelines on the adoption of organizational, physical and technical security measures and the registration thereof with the National Privacy Commission. The data subject must have given their consent prior to the collection or as soon as practicable and reasonable. An employer’s collection of personal information from its own employees does not require the employee’s prior written consent, provided the personal information collected and the processes applied to such information are only to the extent necessary for compliance with legal requirements prescribed for an employer-employee relationship.

RUSSIA: In certain cases, employers are required to obtain the prior written consent of their employees in order to process their personal data (e.g., transferring personal data to third parties, including cross-border transfers).

TAIWAN, REPUBLIC OF CHINA: The Personal Data Protection Act governs the collecting, processing, and using employee personal information. The Act has notice and consent requirements that may be applicable to the collection, processing and use of employee information. This applies to the cross-border transmission of the information or any use outside of the norms of a domestic employment relationship. Under amendments to the Employment Service Act that came into force in late 2012, the amount of personal information that an employer may request from an employee or prospective employee has been severely restricted. Prohibited or restricted requests for personal information include physiological information (e.g., medical tests and fingerprints), psychological information (e.g., psychiatric tests and polygraph tests) and personal lifestyle information (e.g., financial records, criminal records, family information/plans and background checks).

CHINA: The Regulations on Employment Services and Employment Management require that an employee’s personal data is kept confidential and not made public without the employee’s consent. The PRC Cyber Security Law imposes new security and data protection obligations on “network operators,” puts restrictions on transfers of data outside China by “key information infrastructure operators”, and introduces new restrictions on critical network and cybersecurity products. The Civil Code strengthens the protection of individuals’ privacy and personal information. It improves the legal definition of personal information and clarifies the connotation, principles, and conditions of handling personal information and strengthens the information security obligations of processors.

HONG KONG, SAR: The PDPO is principally concerned with 6 data protection principles (DPPs). Broadly, these require:

  • That personal data is only collected for a lawful purpose, that only personal data that is necessary and not excessive for that purpose is collected and that individuals are informed of certain things before data is collected or used (DPP 1)
  • That all reasonably practicable steps are taken to ensure that personal data is accurate and that it is only retained for as long as is necessary to fulfil its purpose (DPP 2)
  • That personal data is not, without the prescribed consent of the job applicant or employee, used for a purpose other than the purpose for which it was collected (DPP 3)
  • That all reasonably practicable steps are taken to ensure that the personal data is secure and protected against unauthorised or accidental access, processing, erasure or other use (DPP 4)
  • That all reasonably practicable steps are taken to ensure that an individual may access information about the data user’s policies and practices in relation to personal data, the kind of personal data about them that is being held and the purposes for which it will be used (DPP 5) and
  • With some exceptions, an individual is entitled to request access to all personal data held by a data user and correct that data if it is inaccurate (DPP 6).

There are provisions in the PDPO that restrict the transfer of personal data outside of Hong Kong, but these are not currently in force.

Europe GDPR

The European Union’s (EU) General Data Protection Regulation (GDPR) came into force in 2018. The GDPR was a response to massive worldwide data breaches that were undermining the trust and security of private citizens whose personal information was at stake. As both hackers exposed this data and, in some cases, simply through poor security measures, governments of the EU felt it was time to create a strong piece of governance to bolster protection. While the initial rollout of GDPR held some uncertainty and unknowns for organisations subject to its guidelines, there is now a much clearer picture of how its standards apply. The punishments for being caught out of compliance can be severe: Violators of the GDPR may be fined up to €20 million or up to 4 per cent of the annual worldwide turnover of the preceding financial year in case of an enterprise, whichever is greater.

SLOVAK REPUBLIC: Covered by the national data protection laws and GDPR. Processing of personal data is generally unlawful except as listed in relevant legislation or based on the consent of the individual. Special rules apply to data transfers outside the EEA. In general, an employer may collect personal information on an employee related to their qualifications and professional experience and other information relevant to the work carried out by the employee. From May 2018, Slovakia is subject to the GDPR, which introduced significant new obligations and onerous sanctions for employers. In specific cases, Act No. 18/2018 Coll. on Personal Data Protection, as amended, applies.

CZECH REPUBLIC: Generally, employees must be notified of personal data processing (e.g., camera recordings) and, in certain limited cases, give their consent (e.g., for the use of the employee’s personal data for marketing purposes)—significant restrictions on monitoring employees, including e-mail and internet use. The Czech Republic is subject to the General Data Protection Regulation (GDPR). The local law implementing the GDPR was issued in 2019.

BELGIUM: Employees generally must be notified of personal data processing and, in certain cases, give consent. Registrations with the Privacy Commission are required in certain cases. Special rules apply to data transfer outside the EEA. Significant restrictions on monitoring e-mail and internet use and use of cameras at the workplace. Since May 2018, Belgium has been subject to the General Data Protection Regulation (GDPR), which has introduced significant new obligations and onerous sanctions for employers.

FINLAND: Employees must usually be notified about personal data processing and give consent to this when necessary. Only necessary data may be processed. Special rules apply to data transfers outside of the EEA. There are significant restrictions on monitoring e-mail and internet use. From May 2018, Finland has been subject to the General Data Protection Regulation (GDPR), which introduced significant new obligations and onerous sanctions for employers.

ITALY:  Employees generally must be notified of personal data processing and give consent in certain cases. Special rules apply to data transfer outside the European Economic Area (EEA). It is impossible to control or monitor employees remotely with devices unless upon agreement with the works council or authorisation of the Labor Office, except the instruments used by the employee to carry out their work or to detect access or attendance. Since May 2018, Italy has been subject to the General Data Protection Regulation (GDPR), which introduced significant new obligations and onerous sanctions for employers.

NORWAY:  Notification to the employee is required. An obligation to notify the Data Inspectorate may apply. Significant restrictions on monitoring and control of employees. Special provisions apply for the transmission of data outside the EEA. 

SPAIN: Spain is subject to the General Data Protection Regulation of the European Union (GDPR). The Spanish legislation that implements the GDPR is the Organic Law 3/2018 on data protection and guarantee of digital rights (Ley Orgánica 3/2018 de protección de datos y garantía de los derechos digitales). Employees must generally be notified of personal data processing (and, in certain cases, must give consent). Registration of databases with the Spanish Data Protection Commissioner (AEPD) is no longer required. Special rules apply to data transfers, even between companies belonging to the same group. Prior stringent restrictions on international data transfers, monitoring e-mail and internet use in the workplace, and video surveillance at work have been eased and aligned with the GDPR, although significant compliance requirements remain.

Sweden: The General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR), applicable since 25 May 2018, applies to the processing of employees’ personal data. The employer must ensure that the fundamental requirements for the processing of the employees’ personal data are fulfilled (e.g., personal data must be correct, adequate and relevant in relation to the purposes of the processing and may not be retained for a longer period than is necessary in light of the purposes of the processing); there must be a legal basis for the processing, such as performance of the employment agreement or consent; and the employee must receive adequate information regarding the processing. Special rules apply to data transfers outside the EEA. Sweden has also issued national laws and regulations in addition to the GDPR, including the Swedish Data Protection Act (2018:218) and the Data Protection Ordinance (2018:19) (the DPA). The DPA regulates general aspects of data protection where the GDPR allows (e.g., processing social security numbers and processing data pertaining to criminal offences. The DPA entered into force on 25 May 2018. 

SWITZERLAND: In general, employees should be notified of any processing of their personal data – and, in certain cases, give consent. Registrations with the Federal Data Protection Commissioner are required in certain circumstances. Special rules apply to data transfers outside of Switzerland. There are significant restrictions on monitoring e-mail and internet use. 

France: The General Data Protection Regulation (GDPR) came into force on 25 May 2018. It applies to any processing of personal data within the EU. The GDPR implements new rights for data subjects, such as the right to access, data erasure, data portability and consent. Data processors/controllers process operations that require regular and systematic monitoring of data subjects on a large scale or special categories of data. A Data Protection Officer (DPO) must be appointed. Data transfers outside of the EU are subject to additional requirements. Significant restriction on monitoring internet and e-mail use even when on company’s IT device.

Germany: Covered by the EU-wide General Data Protection Regulation (Datenschutzgrundverordnung, or GDPR) entered into force in May 2018 and the complementing Federal Data Protection Act. Processing of personal data is generally unlawful except as listed by the Act and the General Data Protection Regulation, a works council agreement or free and individual consent. The appointment of data protection officers is required if more than nine individuals deal with electronically saved personal data. Special rules apply to data transfer outside the EEA. Significant restrictions on monitoring e-mail and internet use exist.

HUNGARY: Employers must balance their need to obtain, use, store and disclose information for effective management and business purposes with their employees’ right to privacy. The law distinguishes between “personal data” and “sensitive personal data.” Special rules apply for the transfer of personal data within and outside of the EEA. The National Authority for Data Protection and Freedom of Information is responsible for ensuring compliance and enforcing data protection. Since May 2018, Hungary has been subject to the General Data Protection Regulation (GDPR), which introduced significant new obligations and onerous sanctions for employers.

Ireland: Since May 2018, Ireland has been subject to the General Data Protection Regulation (GDPR), which introduced significant new obligations and onerous sanctions for employers. GDPR requires employers to identify a legal basis for their processing of personal data, and it is unlikely that a catch-all consent will enable the processing of employee data by an employer. Employers must ensure that they have GDPR-compliant documentation and that they are able to deal with the new rules on subject access requests. There continue to be significant restrictions on monitoring employees, including e-mail and internet use.

Romania: Employees must be informed of personal data processing (and, in certain limited cases, must give consent). Since May 2018, Romania has been subject to the General Data Protection Regulation (GDPR), which introduced significant new obligations and onerous sanctions for employers. Under the GDPR, specific rules apply to any personal data transferred outside the European Economic Area to ensure that appropriate safeguards are provided for the transferred personal data and that enforceable data subject rights and effective legal remedies for data subjects are available. Monitoring of employees, including e-mail and internet use, may be performed under very specific circumstances, provided that the legal provisions which impose restrictions on interference with the protection of private life, data privacy and electronic communications are complied with.

Portugal: Since May 2018, Portugal is subject to the General Data Protection Regulation (GDPR). Under the GDPR (Law no. 58/2019), the local privacy law entered into force on 9 August 2019. Limitations to the use of consent within a working relationship and video surveillance were introduced by this law.

Ukraine: In most cases, the processing of personal data requires the consent of the respective data subject. However, employers are allowed to process an employee’s basic personal data without consent to the extent required to perform the employer’s statutory obligations (e.g., pay salary, perform statutory reporting, etc.). Processing of sensitive data (e.g., health status data, data related to religious beliefs, political views, etc.) is prohibited unless the individual provides explicit consent or there is a statutory ground for processing these categories of data. The processing of sensitive data requires notification to the Ukrainian Parliament Commissioner for Human Rights. Cross-border personal data transfers require documents such as an intercompany agreement on the transfer of data, etc., in addition to the data subject’s consent.

UK: As of the end of the transition period following the UK’s exit from the EU, the UK is subject to the UK GDPR and the Data Protection Act 2018, which impose significant obligations and onerous sanctions for employers. Under this regime, it is extremely difficult for employers to rely on consent to process employee data, and other legitimate grounds generally must be identified.

DENMARK: Employers must comply with the GDPR as of 25 May 2018 and the Danish Data Protection Act. Employees have the right to detailed information about the processing of their data. All information provided must be concise, transparent, easily accessible and in plain language. Employers must provide information on the legal basis for processing and, if the data is sensitive, which of the conditions for processing special categories of personal data on which the employer relies. The notice must also advise the employees of their rights under the GDPR.

Austria: Employees must be generally notified of personal data processing – and, in certain cases, must give consent. Strict rules apply to data transfer outside the EEA. Monitoring employees usually requires an agreement with the work counsel, if any, or an individual agreement with each employee. Since May 2018, Austria has been subject to the GDPR, which has introduced significant new obligations and onerous sanctions for employers.

NETHERLANDS: Employees generally must be notified of personal data processing and give consent in certain cases. Registrations with the Information Commissioner are required. Special rules apply to data transfer outside the EEA. Significant restrictions on monitoring e-mail and internet use. From May 2018, the country is subject to the GDPR, which introduces significant new obligations and onerous sanctions for employers. In general, the GDPR aims to empower individuals (including temporary employees, job applicants, contractors, trainees and other workers) with regard to controlling the use of their personal data and harmonizing the data protection legislation across the EU.

New Zealand: The Privacy Act 2020 controls New Zealand data privacy and determines how employers collect, use, disclose, store and give access to “personal information.”

LUXEMBOURG: The GDPR is in force since 25 May 2018. It has been complemented by a law dated 1 August 2018. Since then, the processing of personal data is no longer subject to prior notification to/authorization from the National Data Protection Commission (Commission Nationale pour la Protection des Données or CNPD). However, the processing of personal data for the purpose of supervising employees in the context of employment relationships may only be carried out by the employer under certain conditions. The employee’s consent does not legitimise the processing of data. Employees and the Staff Delegation/the Labor and Mines Inspectorate (Inspection du Travail et des Mines or ITM) must be notified of any personal data processing. Data subjects have the right to lodge a complaint with the CNPD.

Cybersecurity: how to maintain GDPR compliance?

Even with extremely high fines and stringent requirements, GDPR violations and data breaches have been skyrocketing across the world. In 2020, the overall increase of fraudulent activities has been detected, based on ACFE’s “Fraud in the Wake of COVID-19: Benchmarking Report“: 77% of survey participants have seen an increase in the overall level of fraud as of August, compared to 68% who had observed an increase in May. Earlier, we wrote how the COVID-19 crisis triggered fraudulent activities and what can businesses do to support anti-fraud movements in their organisations and to strengthen their immunity to fraud. However, cyber-attacks are on the rise – the survey by the gov.uk continues to show that cybersecurity breaches are a serious threat to all types of businesses and charities. 39% of businesses and 26% of charities reported having cybersecurity breaches or attacks in the last 12 months. Like previous years, this is higher among medium businesses (65%), large businesses (64%) and high-income charities (51%). Find out how to protect your business from cyber breaches and how to maintain GDPR compliance here!

Middle East corruption: how can ISO 37001 help?

Political and governmental unrest can affect a region’s economy and the integrity of business transactions. The current state of the Middle East exemplifies this phenomenon. While governments in the region are making efforts to curb corruption, political instability and regime changes often undermine these measures. Bad actors understand how to take advantage of such vulnerabilities, leading to increased bribery and corruption across international borders. Recent cases and statistics show that the problem persists in most countries in the region. Against this backdrop, most government officials and private sector business leaders view it as a high priority to reduce bribery and corruption. One of the problems, however, is that some dishonest politicians use supposed anti-corruption efforts as a tool against political enemies. This makes clear that the best approach is for government agencies and businesses themselves to lead from the front. By adopting an internationally recognised set of anti-bribery anti-corruption standards, increased business integrity will result. Organisations that are committed this effort are adopting the ISO 37001 – Anti-Bribery Management Systems standard as a comprehensive approach to mitigating bribery and corruption risk. ISO 37001 and its elements can be tailored to any type of organisation, of any size. The key elements include adopting an anti-bribery policy, appointing a person to oversee anti-bribery compliance, training, risk assessments and due diligence on projects and business associates. ISO 37001 also calls for implementing financial and commercial controls, and instituting reporting and investigation procedures.

 

Corruption a Major Challenge in the Middle East

The Middle East lags behind several other regions when it comes to bribery and corruption. Even as these elements are on a slight decrease globally, the Transparency International Corruption Perceptions Index shows the troubled state of the Middle East and North Africa. “The Corruption Perceptions Index 2018 presents a grim reality in the Middle East and Northern Africa where, despite some incremental progress by a select few, most countries are failing in the fight against corruption”. Syria, Yemen and Libya are at the bottom (worst) end of the list. There are some bright spots, though. United Arab Emirates (UAE) and Qatar, both countries that have taken strong stances on fraud and corruption, score the highest for the Middle East. Morocco and Egypt showed some improvement. Overall, however, the political instability in the region has created a tumultuous business environment. According to the article: “In many Arab governments, powerful individuals have actively influenced government policies and diverted public funds and state assets for their own self-interest and enrichment at the expense of citizens. This reduces anti-corruption efforts to merely ink on paper, where laws pass, but are rarely enforced or implemented.”

This is underscored by limits and obstacles that corruption throws up in the way of those looking to enact real change. “Across much of the developing world, the corruption of courts and other government institutions threatens the free flow of goods and capital that promotes economic growth. Left unaddressed, such threats can lead to heightened tensions among nations and even outright trade wars. Diplomats operate under constraints that limit how much they can call out international bad actors who violate the rule of law. That’s why the role of outside watchdogs is so important in promoting the Rule of Law and holding nations to the standards of fairness and impartiality they claim to meet,” writes National Review.

 

Iran: Power Structures Hamper Progress

One country that exemplifies the Middle East difficulties with corruption is Iran. The problem is described by one analyst as “deeply rooted,” and even recognised by the country’s conservative rulers. In such a political structure as Iran’s, a campaign to combat “systemic corruption” is often seen as the lens of political reprisals against rivals. “In autocratic systems, every now and then, a campaign emerges under the banner of fighting corruption. The main reason is to buy legitimacy for the system. During the last years of the rule of the former Shah of Iran, in an attempt to tame the revolution, such a campaign led to the arrest of several prominent political figures, including Amir-Abbas Hoveyda, who served for 13 years as prime minister”.

“While the same impetus could be behind the current move by Raisi, there is strong speculation in Iran that the move also, and more importantly, aims to shape a consensus within the country to accept Raisi’s giant leap towards assuming the leadership of the country after Khamenei’s death”.

While there has been some concern that the corruption crackdown is a cover for prosecuting reformers, some disagree – positing that it depends more on which party is leading the effort. “Corruption in Iran is linked to political power. Therefore, whichever of Iran’s two main political factions—fundamentalist or moderate-reformist—takes over the executive branch, corruption among the members of that faction increases. At the end of former President Mahmoud Ahmadinejad’s term in office, for instance, his first vice president, Mohammad-Reza Rahimi, and his Vice President for Executive Affairs, Hamid Baghaei, were imprisoned for economic corruption and embezzlement. Such corruption reached an all-time high during his tenure in office”. In any case, it’s clear that most observers aren’t convinced that the country’s anti-corruption campaign is to be taken at face-value – yet.

 

Bribery Cases Exposed in UAE

Two bribery cases demonstrate some common characteristics among such schemes. While both of these instances were uncovered (and prosecuted) in the UAE, they are likely typical for the Middle East region and beyond.

In 2018, an Emirates Post revenue officer was sentenced to prison after being convicted of attempted bribery. The officer solicited a Dh100,000 bribe from a corporate customer. He was in a unique position to attempt the crime, as his duties included collecting and auditing profits for the Emirates Post office in Dubai. The Jordanian revenue officer, 28, collected and audited profits, among other duties, on behalf of Emirates Post office in Dubai. The offender perpetrated the scheme by leveraging fines on a shipping company based in India for supposed postal fee violations. The alleged fine, according to the revenue officer, totaled Dh2.4 million, and he attempted to negotiate a scheme with the client to have the fine reduced to Dh400,000 – in exchange for the Dh100,000 bribe. Instead of paying, the client wisely contacted the police. In a sting operation, the client was fitted with a listening device, and met and paid the bribe – under coordination of the police. As a result, the revenue officer was arrested, and subsequently convicted.

In another case, two Asian residents of UAE were sentenced to three years and one year in jail for giving and accepting a bribe. They were also fined Dh5,000. One of the perpetrators was a government officer. The first defendant, a trader, offered a bribe of Dh900 to the government officer, who works as a customs clearance staff member with the Saqr Port in Ras Al Khaimah. The goal was to ship two containers full of scrap iron out of the UAE without paying taxes or undergoing an inspection. When they were caught, the trader who gave the bribe claimed that it was just a loan, and that he had already paid “over DH50,000 in taxes and charges”. The other defendant (the customs officer) agreed, but the court did not accept their explanation. Both defendants will be deported to their home countries after serving their prison sentences. These types of cases are typical among positions of access, and can happen in any jurisdiction. They exemplify the problem that government agencies and companies alike are trying to reduce and prevent.

 

‘Relationship Building’ v. Bribery

To some degree, the same problems that plague the Middle East are endemic around the world. Among them, the dilemma of misunderstanding in terms of what constitutes bribery. In nearly all cultures, relationship building is considered an essential part of doing business. Often, business associates consist of numerous friends or even family members. When that is the case, there can be a slippery scale in terms of what is merely a favor or a gift, versus what constitutes bribery or corruption. The Foreign Corrupt Practices Act (FCPA) can provide some guidelines here. A case involving Bank of New York Mellon is instructive. “On 18 August 2015, Bank of New York Mellon (“BNYM”) consented to a Securities and Exchange Commission (“SEC”) Order requiring BNYM to pay $14.8 million to settle charges that it violated the FCPA by providing student internships to family members of foreign government officials affiliated with a Middle Eastern Sovereign Wealth Fund (“SWF”). All parties involved, except BNYM, have been anonymised in the Order so that the nationality of the foreign public officials and the SWF is publicly unknown beyond being described as ‘Middle Eastern’.

“The BNYM internships were given to three people: the son and nephew of one key figure of the SWF and the son of another. The internships were given despite the facts that the interns did not meet the rigorous selection criteria usually applied by BNYM and did not go through the standard (or any) recruitment process before being awarded the internships. In addition, these internships were found by the SEC to be more valuable than those offered to the regular applicants, who had endured the competitive admissions process against strict entry requirements. For example, rotation between business units was arranged, which is not an opportunity afforded to regular interns.”

“Emails between BNYM employees clearly demonstrate that the motivation behind the favour to the foreign officials was to influence the latter’s decision-making in the interests of BNYM. There can be no doubt that this was bribery in action – the BNYM employees expected to retain and gain business from the foreign officials in return for offering their relatives valuable internships to which they would not otherwise have had access”.

The case clearly describes what could be considered a “gray area” compared to some of the more extreme realities of bribery and corruption. One study of the Middle East and North Africa in 2016 suggested that people felt the need to bribe officials for basic services. “About 30 percent of those polled said that they had to access basic public services by bribing officials. If that figure holds across the entire MENA region, that would mean that about 50 million people, the majority of whom are poor, feel they must pay bribes in order to have access to basic public services. In five countries, the rich reported being far less likely to have to pay a bribe: 63 percent of poor Sudanese citizens versus 38 percent of wealthy ones, for example, and 23 percent versus 12 percent, respectively, in Algeria”.

 

ISO 37001:2016 to Combat Bribery & Corruption

Corruption certainly isn’t exclusively a Middle Eastern problem. Organisations around the world are taking action to reduce risk. They’ve found the structure and process they need in ISO 37001. ISO 37001 was issued by the International Organization for Standardization (ISO) in 2016 to help organisations worldwide increase and measure their efforts against bribery and corruption. Through ISO 37001 ABMS, organisations can implement standards at every level. These measures include adopting an anti-bribery policy and appointing a person to oversee anti-bribery compliance, training, risk assessments and due diligence on projects and business associates. It’s also critical that the organisation implement financial and commercial controls, along with reporting procedures and investigation processes.

CRI Group founded ABAC® (Anti-Bribery and Anti-Corruption) Center of Excellence to help organisations of all types and industries implement ISO 37001 certification and/or training. ABAC® has a team of experts around the world that include certified ethics and compliance professionals, financial and corporate investigators, forensic analysts, certified fraud examiners, qualified auditors, and accountants. They are trained and experienced in the implementation of ISO 37001’s key elements, helping clients more effectively prevent bribery and corruption. ABAC Certification is an accredited provider of ISO 37001 ABMS, and it provides certification and training for organisations of various types and industries.

There are requirements and guidance that the ISO 37001 standard prescribes for a comprehensive anti-bribery management system. The following bribery elements are addressed by ISO 37001 in relation to the organisation’s business processes and activities:

  • Bribery in the public, private and not-for-profit sectors
  • Bribery by the organisation
  • Bribery by the organisation’s personnel acting on the organisation’s behalf or for its benefit
  • Bribery by the organisation’s business associates acting on the organisation’s behalf or for its benefit
  • Bribery of the organisation
  • Bribery of the organisation’s personnel in relation to the organisation’s activities
  • Bribery of the organisation’s business associates in relation to the organisation’s activities
  • Direct and indirect bribery (e.g. a bribe offered or accepted through or by a third party)

Government organisations and companies can reduce the risk of bribery through ISO 37001’s best practices for anti-bribery and anti-corruption. The following are just a few of the ways ISO 37001 helps accomplish this goal:

  • Provide needed tools to prevent bribery and mitigate related risks
  • Help an organisation create new and better business partnerships with entities that recognise ISO 37001 certified status, including supply chain manufacturing, joint ventures, pending acquisitions and co-marketing alliances
  • Potentially reduce corporate insurance premiums
  • Provide customers, stakeholders, employees and partners with confidence in the entity’s business operations and ethics
  • Provide a competitive edge over non-certified organisations the organisation’s industry or niche
  • Provide acceptable evidence to prosecutors or courts that the organisation has taken reasonable steps to prevent bribery and corruption

It is important to note that “Conformity with (ISO 37001) cannot provide assurance that no bribery has occurred or will occur in relation to the organisation, as it is not possible to completely eliminate the risk of bribery”, according to ISO.  The certification is potentially an important piece of evidence, however, that shows regulators, prosecutors, and the courts that the organisation has taken meaningful action to prevent bribery and corruption.

 

Conclusion

All is not lost. Some Middle Eastern countries, like the United Arab Emirates, have made a commitment and continue to demonstrate positive strides toward combating corruption. UAE has expanded its laws, broadened the definitions of what is considered bribery and corruption, and increased punishments. But the country is largely an outlier in a region that is struggling under the weight of instability and corruption.

In this type of environment, both government organisations and the businesses they serve (and regulate) need ISO 37001. The sooner organisations implement the comprehensive measures prescribed by ISO 37001, the calmer the seas will be for international trade, business agreements and mergers, acquisitions and other positive elements of economic growth.

An established standard like ISO 37001 ABMS can help organisations address bribery and corruption through implementing best practices in a program of training and certification. While following the curriculum, the training process can easily be tailored to the organisation based on its size, type, industry or risk level. Bribery and corruption are pervasive problems that won’t be solved overnight. It will take a concerted effort by all major players in the region to make positive strides and reduce risk factors. ISO 37001 provides a blueprint for making those changes. Twenty or thirty years ago, organisations were mostly on their own went it came to developing an anti-corruption strategy. Today, there is a tried-and-true path forward. Committing to it is the first step toward making real progress in the Middle East.

 

Sources

  1. “Middle East & North Africa: Corruption Continues As Institutions And Political Rights Weaken,” Transparency International, 29 Jan. 2019,

< https://www.transparency.org/news/feature/regional-analysis-MENA> (accessed 25 Oct. 2019)

  1. John Fund, “Cleaning Up Corruption Is a Key to Middle East Stability,” National Review, 23 October 2019,

<https://www.nationalreview.com/corner/cleaning-up-corruption-is-a-key-to-middle-east-stability/> (accessed 25 Oct. 2019)  OECD, The rationale for fighting corruption. 2014

  1. Shahir Shahidsaless, “Iran’s conservatives are saying it: Corruption is ‘systemic’”, Middle East Eye, 7 Oct. 2019,

<https://www.middleeasteye.net/opinion/whats-behind-irans-crackdown-corruption> (accessed 25 Oct. 2019)

  1. Jalil Bayat, “Iran’s Goals In The Fight Against Economic Corruption,” Lobe Log, 18 Oct. 2019,

<https://lobelog.com/irans-goals-in-the-fight-against-economic-corruption/> (accessed 25 Oct. 2019)

  1. Salam Al Amir, “Emirates Post worker jailed for seeking Dh100k bribe from customer”, The National, 31 Oct. 2018,

< https://www.thenational.ae/uae/emirates-post-worker-jailed-for-seeking-dh100k-bribe-from-customer-1.786526> (accessed 10 Nov. 2019)

  1. Ahmed Sheeban, “Government officer jailed for accepting Dh900 bribe in UAE”, Khaleej Times, 13 April 2019,

< https://www.khaleejtimes.com/nation/ras-al-khaimah/government-officer-jailed-for-accepting-dh900-bribe-in-uae> (accessed 10 Nov. 2019)

  1. Andrew Hudson, “Middle East meets West: Where is the line between relationship-building and bribery?,” Al Tamimi 7 Co., September 2015,

< https://www.tamimi.com/law-update-articles/middle-east-meets-west-where-is-the-line-between-relationship-building-and-bribery/> (accessed 25 Oct. 2019)

  1. Ben Thompson, “Bribery worsening in the Middle East and North Africa, citizens say,” CSM, 3 May 2016,

< https://www.csmonitor.com/World/Global-News/2016/0503/Bribery-worsening-in-the-Middle-East-and-North-Africa-citizens-say> (accessed 25 Oct. 2019)

  1. “ISO 37001:2016 ANTI-BRIBERY MANAGEMENT SYSTEMS — REQUIREMENTS WITH GUIDANCE FOR USE”, www.ISO.org,

< https://www.iso.org/standard/65034.html > (accessed 5 Aug. 2019)

  1. Adam Vause, Zara Merali, “The UAE’s fight against bribery and corruption,” DLA Piper, 16 July 2019,

< https://www.dlapiper.com/en/dubai/insights/publications/2019/07/the-uaes-fight-against-bribery-and-corruption/> (accessed 25 Oct. 2019)

Meet Soraia Antunes, Chief Marketing Officer

Soraia is a technically and commercially astute professional with over a decade of B2B and B2C experience across various industries and cultures on a global scale. Who loves challenges and believes in enhancing customer loyalty via high impact marketing and communication strategies combined with engaging visual identities. She is passionate about creative excellence and driving innovation while influencing key stakeholders.

Track record in significantly enhancing a company’s brand market performance/effectiveness and profitability by improving name recognition, building credibility and inspiring employees. 

Feel free to reach out.

LET’S TALK!

e: soraia.antunes@crigroup.com | LinkedIn

Reach out for any marketing related questions
Languages spoken: English, Portuguese

 

How Risk Management and Due Diligence Interlock?

RISK MANAGEMENT AND DUE DILIGENCE: HOW DO BOTH INTERLOCK?

Risk management and due diligence: How both interlock? These are challenging and complex times. COVID-19 is forcing organisations to adapt quickly and change their business model in the process. In an era of compliance, with many regulations and regional “interpretations”, leaders and organisations need to be careful about how they conduct business, who conducts business in their name and with whom. This demands extraordinary attention to the means and mechanisms used by the organisation.

Due diligence, in legal terms, entails taking reasonable steps to satisfy any legal or regulatory requirement, regardless of the size or type of business conducted. Businesses also need to take several mandated steps to ensure that the organisation remains safe from any unwanted or unauthorised action taken on their behalf. For example, when making an investment such as a merger or an acquisition, the organisation needs to take the appropriate action on the proper due diligence necessary to make the most informed decision possible.

Being casual about the due diligence process is a failure to execute the proper level of investigation regarding the assets being purchased or financed or the management team being backed and vetted.

Where does Risk Management Come into Play?

Risk management is the identification, evaluation, and prioritisation of risks (defined in ISO 31000 as the effect of uncertainty on objectives) followed by coordinated and economical application of resources to minimise, monitor, and control the probability or impact of unfortunate events or to maximise the realisation of opportunities.

A formal business discipline that relies on the forecasting and evaluation of any risks, along with identification and (where feasible or warranted) implementation of procedures to avoid or minimise their impact. Using ISO 31000 can help organisations increase the likelihood of achieving objectives, improve the identification of opportunities and threats and effectively allocate and use resources for risk treatment.

DOWNLOAD ISO 31000 PLAYBOOK

Risks can come from various sources including your employees. From a risk management perspective, the penalties on conducting business that can result from unwanted or unauthorised third-party relationships or any employee unethical business action are exceedingly high making it imperative to perform due diligence when trying to protect your business and brand.

Inadequate due diligence can easily take down an organisation; from damaged reputation to brand devaluation, from regulatory violations to fines and jail terms for directors, the risks are exceedingly high.

The risks from losses of such potential magnitude should not be ignored. At such cost, implementing the most stringent and effective controls and protections in place even at a cost still makes absolute financial sense. And the only way to fully protect a corporation’s assets, therefore, is through a strong and viable 360 due diligence program.

Learn more about due diligence from this article. When is due diligence most critical?

Managing risk and due diligence should begin with a policy and a plan. Here we will focus on the human element of risk management, specifically background investigations. Organisations need to perform due diligence to make sure that their business is conducted by their employees and through their partners and vendors. Such insurance invariably includes regular security audits, ISO certification, pre-employment background checks, TPRM, etc.

There are several incentives to practice due diligence and perform risk management to ensure you conduct business appropriately and comply with all applicable laws and regulations. Anything less is just asking for trouble and losses!

What Can and Should Organisations and Risk Professionals Do?

The very first step to mitigating risks and exposures starts with a risk assessment. There are plenty of risk assessment checklists and tools available. If you want to dive deeper into how to start a risk assessment, just read our Risk assessment breakdown: Identification, Analysis, Evaluation to learn more. Once risk professionals get a handle on their due diligence processes and other compliance regimes, it’s time to start the entry process into the regulatory life cycle:

  1. Prioritisation and planning
  2. Implementation of a response
  3. Integration of related tools, technologies, audits, processes and procedures to integrate compliance into normal operations

 

The first steps toward achieving compliances are usually big ones and may require substantial time and effort. But after that, it’s just a matter of sticking to a routine to maintain compliance, meet reporting requirements and keep up with changes to governing regulations and day-to-day tools and operations.

About CRI Group™

Based in London, CRI Group™ works with companies across the Americas, Europe, Africa, Middle East and Asia-Pacific as a one-stop international Risk ManagementEmployee Background ScreeningBusiness IntelligenceDue DiligenceCompliance Solutions and other professional Investigative Research solutions provider. We have the largest proprietary network of background-screening analysts and investigators across the Middle East and Asia. Our global presence ensures that no matter how international your operations are we have the network needed to provide you with all you need, wherever you happen to be. CRI Group™ also holds BS 102000:2013 and BS 7858:2012 Certifications, is an HRO certified provider and partner with Oracle.

In 2016, CRI Group™ launched the Anti-Bribery Anti-Corruption (ABAC™) Center of Excellence – an independent certification body established for ISO 37001 Anti-Bribery Management SystemsISO 37301 Compliance Management Systems and ISO 31000 Risk Management, providing training and certification. ABAC™ operates through its global network of certified ethics and compliance professionals, qualified auditors and other certified professionals. As a result, CRI Group™’s global team of certified fraud examiners work as a discreet, white-labelled supplier to some of the world’s largest organisations. Contact ABAC™ for more on ISO Certification and training.

Prove that your business is ethical with our free Gap Analysis

Evaluation of Corporate Compliance Programs – Highest Ethical Business Assessment: Evaluating Adequate Compliance, Business Ethics, Anti-Bribery and Anti-Corruption Framework

Prove that your business is ethical. Complete our free Highest Ethical Business Assessment (HEBA) and evaluate your current Corporate Compliance Program. Find out if your organisation’s compliance program is in the line with worldwide Compliance, Business Ethics, Anti-Bribery and Anti-Corruption Frameworks. Let ABAC™ experts prepare a complimentary gap analysis of your compliance program to evaluate if it meets “adequate procedures” requirements under the UK Bribery Act, DOJ’s Evaluation of Corporate Compliance Programs Guidance and Malaysian Anti-Corruption Commission.

The HEBA survey is designed to evaluate your compliance with adequate procedures to prevent bribery and corruption across the organisation. This survey is monitored and evaluated by qualified ABAC™ professionals with Business Ethics, Legal and Compliance backgrounds. The questions are open-ended to encourage a qualitative analysis of your Compliance Program and to facilitate the gap analysis process.

The survey takes around 10 minutes to complete.

TAKE THE SURVEY NOW!

 

Risk management and its continuous improvement

Risk management requires continuous improvement. Without a company culture strongly aligned with principles of continuous improvement, organisations will struggle to implement, let alone maintain, successful risk management programs. This can be challenging in practice, as cultivating a risk management attitude within a company involves aligning risk initiatives with existing company values, policies and, to put it simply, convincing everyone involved that risk management is worthwhile. However, improving risk culture is possible, and, like many things, it becomes a lot easier when you have a process for it.

Such a process can be separated into three stages:

  • Cultural awareness
  • Cultural change
  • Cultural refinement

Phase one: Building and strengthening cultural awareness

The first stage is building cultural awareness; this will take the form of communications, training, and general education initiatives within the organisation. Here is where companies set risk management expectations and objectives, define roles and responsibilities, and communicate all of these things with their employees. You shouldn’t expect your employees to conform to your ideas about risk management without first taking the time to educate and inform them, whether through formal training or access to knowledge base material or similar.

Successfully building and strengthening cultural awareness about continuous improvement includes:

  • Establishing a common risk management vocabulary
  • Making sure communications are consistent with said vocabulary and that everyone in the organisation has clear access to all relevant documents
  • Being clear about risk management responsibilities and accountabilities.
  • Launching and maintaining training programs, providing training support and guidance where needed and as required by different roles and responsibilities within the organisation
  • Making sure onboarding processes adequately cover risk management.
  • Making sure recruitment processes adequately cover risk management.

Phase two: Changing the way the organisation operates

Once a firm foundation of cultural awareness regarding continuous improvement has been established, it’s time to start thinking about how to gradually change how the organisation operates to reflect these values. This phase begins by recognising and rewarding employees for paying attention to risk and responding to risk in a way that challenges the previously established (pre-continuous improvement) status quo. These motivational systems, rewarding and penalising behaviour according to the established ideals of continuous improvement outlined in the early planning stages, will result in the gradual but certain shift towards a proliferation of continuous improvement-conscious company culture. Another important element is recognising the talent that conforms with the desired vision of continuous improvement and capitalising on this alignment by placing them accordingly in relevant, optimised positions of responsibility or seniority. It’s getting people in the right place to drive the right results.

Some important considerations for this phase:

  • Utilising challenge as a motivator for driving cultural change
  • Gamifying and quantifying risk performance metrics and rewarding/penalising behaviour accordingly.
  • Considering risk management and continuous improvement culture in talent management approaches.

Phase three: Optimising and refining the cultural ecosystem

The third and final stage of cultural adoption of continuous improvement occurs once the company culture has matured to the point of widespread adoption and desired values are already well-entrenched. At this point, the focus shifts to monitoring performance versus expectations and attempting to tweak and refine the system to further improve cultural adoption. The expectations can and will be influenced by a wide range of stakeholders, not just top management; employees, a board of directors, analysts, customers, investors – they all have a say in the definition of cultural expectations because these expectations should directly reflect the whole entity that is the organisation, made up of all its constituent stakeholder parts.

Steps taken during this phase might include:

  • Iterating feedback and observations from risk management into training, education, resources, and communications.
  • Making sure stakeholders are held responsible for their actions
  • Make sure any risk performance metrics or quantifiers are adjusted to reflect risk strategy, goals, and objectives changes.
  • The capacity to redeploy and reassign individuals within an organisation according to desired risk culture goals
  • Continually reflecting on and refining risk culture by continually changing business goals, objectives, and strategies.

At CRI® Group, we are committed to spreading the knowledge about the riskcompliance management and negative impact of fraud, bribery, and corruption to global businesses and promote transparent business relations across the world. As part of this effort, we want to present you our in-depth risk management and compliance insights – articles, whitepapers, eBooks, and other publications to help organisations overcome fraud, compliance, bribery, and corruption management challenges and tackle risks more effectively.

Don’t miss the opportunity to step up towards transparency and better protection for your business and your career – CRI® Group’s risk management and compliance insights give you a chance to explore these topics in-depth. If you are interested in our solutions, please click below to a free quote or contact us today.

GET A FREE QUOTE

Any successful ethics and compliance strategy needs 5 key ingredients …

Once upon a time, the idea of business ethics was more of an abstract or philosophical notion that seemed more suited for discussion in a university lecture or at a business conference. Today, however, organisations of all sizes and industries must have concrete ways of addressing ethics and compliance issues as a principal component of their business processes and strategy. 

According to a study by PwC, 98 per cent of senior leaders say they’re committed to compliance and ethics; however, only 67 per cent have a process in place to identify the owners of compliance and ethics-related risks, with only a third having an officer in place for the overall compliance and ethics. Fifty-six per cent of the companies don’t have a chief ethics officer at all, and only 20 per cent have a Board of Directors that formed separate compliance and ethics committees. The study reports that 82 per cent of leaders communicated with employees on ethics, but 46 per cent of this is done in business meetings or by email. You can read the result on the full PwC website.

Business leaders are usually quick to communicate their expectations to employees, especially when it comes to financial goals or tasks that they want to be accomplished. However, what is often lacking is a clear, concise explanation of what the organisation expects regarding ethical behaviour and a compliance framework in place to follow. Today citizens, media, politicians and international bodies across all regions actively condemn abuses of power. And past scandals and their consequences have created a demand for increased regulations, greater transparency, and other rigorous scrutiny measures to be taken. To maintain (or regain) public trust, the ethics and compliance function has been placed at the centre of the strategic core of organisations by effective leaders.

Empower your organisation to mitigate risk!

To ensure a robust compliance and ethics strategy, five critical elements need to be implemented; 1) tone at the top; 2) corporate culture; 3) risk management, 4) a Chief Compliance Officer; and 4) testing and monitoring.

1 – Building Tone at the Top

“Tone at the top” is a term used to describe the ethical atmosphere created at an organisation or workplace by their leaders and their attitudes and behaviours. Tone at the top is vital in determining whether fraud, bribery, or corruption are likely to occur. Because all levels of management set it, it has a trickle-down effect on all employees. If the top leaders show a robust and zero-tolerance approach to fraud, employees are likely to lead by example.

An organisation with a strong ethical culture is usually led by a board of directors and senior management personnel who actively promote a culture of compliance and zero tolerance for fraud and other unethical business behaviour. Effective tone at the top will communicate to the organisation at all levels the expected type of conduct, what is considered unacceptable, and what the consequences will be for transgressions. A zero-tolerance approach should be followed at all times; it is vital in maintaining the culture of ethics and compliance at the organisation; below are some examples of failed tone at the top:

For more scandals, check out our list of the “Top 10 Bribery & Corruption Stories of 2020.

2 – Corporate culture

The prevailing norms, expectations, and recognised acceptable behaviour form the corporate culture of an organisation. By implementing an ethical code of conduct and compliance with all regulations a part of those norms, the organisation will help promote positive behaviour and integrity among its staff. 

You might be making assumptions that your employees know how to conduct themselves ethically when, in fact, this expectation only exists in a grey area in their minds – if at all. Some employees who have engaged in fraud, corruption or other unethical situations have claimed that while they knew their behaviour was wrong, they thought it was implicitly accepted by their bosses and, in some cases, their company on the whole.

Similar to establishing an effective tone at the top, fostering a positive corporate culture hinges on effective communication, and it needs to permeate different layers of the organisation. In other words, sending occasional emails about ethical behaviour isn’t enough to influence the culture at a company. Develop videos, team-building exercises, new employee orientations, and employee appreciation events; these provide opportunities to recognise positive behaviour and reinforce the company’s values. When employees see their colleagues being recognised and rewarded for maintaining a compliant and ethical corporate culture, they are more likely to help cultivate an ethical workplace. When the tone at the top and corporate culture are tied together, everyone understands what is acceptable and expected in being a part of the organisation’s success.

3 – Risk management: perform risk assessments

Risk management is identifying, evaluating, and prioritising risks (defined in ISO 31000 as the effect of uncertainty on objectives) followed by coordinated and economical application of resources to minimise, monitor, and control the probability or impact of unfortunate events to maximise the realisation of opportunities. In other words, before you establish an ethics and compliance framework – first, a risk assessment should be conducted to uncover any vulnerabilities that need to be addressed with new processes. 

Risk assessment breakdown: Identification, Analysis, Evaluation   

This means you need to assess how your business is conducted. So ask yourself:

  • Have the various roles at the company been appropriately allocated, and is there a proper separation of duties?
  • Are employees qualified for their responsibilities?
  • Is the workforce trained to recognise the red flags of unethical behaviour and fraud?

Once the risks are identified, they can be isolated and addressed as part of your organisation’s comprehensive approach to ethics and compliance. The risks should be prioritised:

  • Which ones pose an immediate threat?
  • Could they effectively shut down the business?
  • Do they pose a risk of financial, legal, or reputational risk – or all of the above?

Once prioritised, the identified risks should be assigned to critical members of the organisation. Whatever your reasons or motivations might be, if your organisation’s objective is to have an effective risk management strategy in place, then ISO 31000 can provide the principles, framework and a process for managing risk.

4 – A Chief Compliance Officer (CCO)

The implementation of a robust ethics and compliance strategy can give your organisation a competitive edge. A compliance officer or a CCO plays an essential and crucial role in the implementation. They are tasked with the day-to-day responsibility of overseeing the management of compliance and ethical risks whilst ensuring that the organisation is in compliance with the various regulatory requirements and that employees adhere to internal procedures and policies. Oversight should be provided by the board of directors (or ownership and executives) to ensure that problem areas have been adequately addressed and the organisation is taking a proactive approach to mitigating risk. 

5 – Testing and monitoring

When all the new processes have been implemented (the anti-fraud policy and employee code-of-conduct, anti-bribery and anti-corruption training and policies, allocation of duties and responsibilities, an anonymous reporting -hotline- process for unethical behaviour), a thorough testing and monitoring regimen is critical to ensure the new process is working. 

It is important to remember that having the best processes on paper won’t make a positive difference on its own. You need to monitor how they are being used and their success. A schedule should be in place that promotes frequent, regular check-ups of the ethics and compliance controls, with metrics that show results (i.e. surprise audits). A surprise audit is an effective way to test if any new controls have reduced the flagged irregularities. Before implementing ethics and compliance controls, the risk assessments should have identified risk areas with the new processes to mitigate that risk. Only by testing and testing frequently can the organisation determine if the new controls have the desired effect. If they are not, the company should develop new solutions that specifically robustly target these problem areas – and, in time, test them again.

Addressing ethics and compliance issues at an organisation can be a daunting task. However, with careful preparation, expert help, and a common-sense approach, any organisation can develop or enhance its corporate culture to be proactive in mitigating ethics and compliance risks. The benefits will be obvious – increased productivity, better security, and empowered employees who understand that their organisation values integrity and an ethical work environment.

Create a zero-tolerance approach to fraud with ISO 37001 ABMS

Creating a zero-tolerance approach to fraud doesn’t happen overnight. When your organisation enrols in ISO 37001:2016 ABMS training and certification, the program involves your entire team. The training helps establish an ethical culture by educating your employees on the following:

  • What constitutes fraud, corruption, and bribery, and why these are so damaging to business
  • How to identify red flags of fraud, corruption and bribery
  • The process for reporting fraudulent and unethical acts
  • The organisation’s zero-tolerance attitude toward unethical behaviour and willingness to terminate employees for breaches and prosecute unethical acts
  • The severe ramifications for committing fraud or bribery, the legal consequences, and the negative impact on one’s career

Employees shouldn’t be expected to follow a code of conduct that they aren’t aware exists. That’s why ISO 37001:2016 ABMS creates a communication plan through which organisation leaders regularly communicate their ethical behaviour expectations to the staff periodically. Read more on how to build trust in the workplace with ISO 37001 Certification.

About CRI Group

Based in London, CRI Group works with companies across the Americas, Europe, Africa, Middle East and Asia-Pacific as a one-stop international Risk ManagementEmployee Background ScreeningBusiness IntelligenceDue DiligenceCompliance Solutions and other professional Investigative Research solutions provider. We have the largest proprietary network of background screening analysts and investigators across the Middle East and Asia. Our global presence ensures that no matter how international your operations are, we have the network needed to provide you with all you need, wherever you happen to be. CRI Group also holds BS 102000:2013 and BS 7858:2012 Certifications, is an HRO certified provider and partner with Oracle.

In 2016, CRI Group launched the Anti-Bribery Anti-Corruption (ABAC®) Center of Excellence – an independent certification body established for ISO 37001:2016 Anti-Bribery Management SystemsISO 37301 Compliance Management Systems and ISO 31000:2018 Risk Management, providing training and certification. ABAC® operates through its global network of certified ethics and compliance professionals, qualified auditors and other certified professionals. As a result, CRI Group’s global team of certified fraud examiners work as a discreet white-labelled supplier to some of the world’s largest organisations. Contact ABAC® for more on ISO Certification and training.

Speak up – report any illegal, unethical, or improper behaviour

If you find yourself in an ethical dilemma or suspect inappropriate or illegal conduct, and you feel uncomfortable reporting through normal communication channels or wish to raise the issue anonymously, use CRI Group’s Compliance Hotline. The Compliance Hotline is a secure and confidential reporting channel managed by an independent provider. When reporting a concern in good faith, you will be protected by CRI Group’s Non-Retaliation Policy. COMPLIANCE HOTLINE

2nd ABAC Summit Announced in KL

After the great success of last year’s Anti-Bribery Summit, the 2nd ABAC Summit Announced in KL

CRI® Group is pleased to announce the upcoming Anti-Bribery Anti-Corruption (ABAC) Summit 2018 in Kuala Lumpur, Malaysia, 25 September 2018. This is the second year for the ABAC Summit, providing invaluable expertise in due diligence, internal controls and compliance issues, along with showcasing the latest resources and solutions to detect and combat bribery and corruption within organizations.

The one-day summit is a must-attend event for anyone working in anti-bribery and anti-corruption, due diligence, risk management, and anti-fraud such as CEOs, CFOs, Chief Legal Officers, Chief Compliance Officers, In-house Counsels, Compliance Managers, Lawyers and Auditors, Heads of Procurement and Other officers responsible for Compliance and Anti-Corruption.

Last year’s Anti-Bribery Summit was a great success, with critical topics presented by leading experts in anti-bribery and anti-corruption compliance. This year aims to be even better, with an agenda that includes the following highlights:

  • A welcome introduction by Zafar Anjum MSc, CFE, Intl. Dip. (Fin. Crime). As founder and CEO of CRI® Group, Zafar Anjum has dedicated 28 years to the areas of fraud prevention, protective integrity, security and compliance. His expertise helps create secure networks across challenging global markets.

  • Mohd Nur Lokman Bin Samingan, Assistant Commissioner at Malaysian Anti-Corruption Commission (MACC), will present “MACC (Amendment) Act 2018: Section 17A, ‘Offence by Commercial Organization’”. Mohd Nur Lokman Bin Samingan has vast experience as an investigator and a prosecuting officer, and is currently attached to the Community Education Division of MACC as the head of Private Sector Branch. He engages business entities, corporations and private companies in cultivating anti-corruption awareness.

  • Dr KM Loi, Vice-Chairman of ISO/PC 278 (ISO 37001:2016), Co-convenor of ISO/TC 309 WG2 (ISO 37001 Handbook), will present “ISO 37001:2016 – Management Tool to Address Corporate Liability Provision”. Dr KM Loi is an anti-bribery expert with 20 years of management skills in quality consulting, training and auditing with wide exposure to various industries in the context of ISO 9001, ISO 14001, ISO 13485, IATF 16949, ISO 26000, ISO 37001, SA8000 & OHSAS 18001.

  • Drago Kos, Chairman of Organization for Economic Co-Operation & Development, will present “Corporate Integrity Guarantees Prosperity”. Drago Kos is the Chairman of the OECD Working Group on Bribery in International Business Transactions, Co-Chair of the Defence Corruption Monitoring Committee in Ukraine and adviser to the Kosovo Anti-Corruption Agency.

  • Cristian Nicoara, Independent Expert Consultant; Justice, Anti-Corruption, and Security Sector Reform Adviser, will present “Anti-Corruption Agencies are Fighting an Imbalanced Battle. Where to Find the Allies?” Cristian Nicoara is a former Romanian investigative prosecutor with 15 years specialisation in major crimes, anti-corruption and financial investigations.

  • Md Alimuddin Rahim, Group Integrity Officer at Petra Energy Berhad, will present “Role of Malaysian Anti-Corruption Foundation (NGO) in assisting Malaysian Anti-Corruption Commission (MACC)”. Md Alimuddin Rahim has more than 20 years’ experience in his industry – he is the Secretary General at Malaysian Anti-Corruption Foundation and also works as Group Integrity Officer at Petra Energy Berhad.

  • Presenter Cynthia Gabriel, Executive Director at The Center to Combat Corruption and Cronyism (C4 Center), human rights advocate and anti-corruption leader in Malaysia will present “New Lessons from 1MDB: The evolving actors in modern money laundering”. Cynthia Gabriel has experience advancing and promoting human rights, good governance and democratic freedoms. She founded the Centre to Combat Corruption and Cronyism (C4), a NED grantee, which works to promote good governance and conducts a multifaceted project designed to encourage public participation in efforts to combat corruption.

  • A special panel discussion and Q&A session will feature all of the keynote speakers.

  • An hour at the conclusion for additional networking among attendees, with refreshments provided.

CRI® Group founder and CEO Zafar Anjum said that after the success of last year’s inaugural event in Pakistan, he is excited about the second Anti-Bribery Anti-Corruption Summit in Kuala Lumpur, Malaysia.

“This year’s agenda was developed to provide you with invaluable information and foresight into the forces that guide and dictate our everyday work life: the ongoing quest for solutions, balance, and insight into the oftentimes chaotic world of anti-bribery and corporate corruption compliance”, Anjum wrote.

This is a critical time for world markets and economies. The latest Corruption Perceptions Index shows that “most countries around the world are making little or no progress in ending corruption” (Transparency international, titled “Corruption perception index 2017”, 2018).

That’s why the expertise, best practises and resources shared by the leading industry experts at the ABAC Summit are more important than ever. In the Asia Pacific region alone, the majority of countries are in the lower half of this year’s Corruption Perceptions Index. This is because bribery is still a key problem, made worse by unaccountable governments, lack of oversight, instability and insecurity.

There are positive signs as well. Officials in Malaysia, the host country of this year’s ABAC Summit, have made strides in the fight against bribery and corruption. According to MACC, 879 offenders – from top management to lower level staff, in both the public and private sectors – were arrested last year. This demonstrates Malaysia’s commitment to bringing offenders to justice.

Time is running out to make your plans to attend ABAC 2018 and get an edge on the latest best practices, laws, regulations and compliance, presented by the foremost experts in the field. Meet the colleagues you networked with at last year’s event; or make new connections with CEOs, CFOs, other executives, directors, lawyers, auditors, legal officers, compliance officers and others who face the same anti-fraud and anti-corruption challenges as you.

Visit www.anticorruptionsummit.com and reserve your spot today. Early bird registration (50 percent off!) is available until 30 August.

Who is CRI® Group?

Based in London, CRI® Group works with companies across the Americas, Europe, Africa, Middle East and Asia-Pacific as a one-stop international Risk ManagementEmployee Background ScreeningBusiness IntelligenceTPRMDue DiligenceCompliance Solutions and other professional Investigative Research solutions provider. We have the largest proprietary network of background-screening analysts and investigators across the Middle East and Asia. Our global presence ensures that no matter how international your operations are, we have the network needed to provide you with all you need, wherever you happen to be. CRI® Group also holds BS 102000:2013 and BS 7858:2012 Certifications, is an HRO certified provider and partner with Oracle.

In 2016, CRI® Group launched the Anti-Bribery Anti-Corruption (ABAC®) Center of Excellence – an independent certification body that provides education and certification services for individuals and organisations on a wide range of disciplines and ISO standards, including ISO 31000:2018 Risk Management- GuidelinesISO 37000:2021 Governance of OrganisationsISO 37002:2021 Whistleblowing Management SystemISO 37301:2021 (formerly ISO 19600) Compliance Management system (CMS)Anti-Money Laundering (AML); and ISO 37001:2016 Anti-Bribery Management Systems ABMS. ABAC® offers a complete suite of solutions designed to help organisations mitigate the internal and external risks associated with operating in multi-jurisdiction and multi-cultural environments while assisting in developing frameworks for strategic compliance programs. Contact ABAC® for more on ISO Certification and training.

Internal Control: Identify Vulnerabilities through TPRM Assessment

CRI® Group’s Third-Party Risk Assessments are front-line tools used to ascertain whether an organisation has the appropriate policies and procedures in place to address all potential risks at the management, operations and financial levels and simulates the likelihood of those risks occurring.

A 3PRMTM assessment includes a review of internal auditing procedures, compliance guidelines, performance criteria, internal controls, reporting processes, and contractual requirements vital to fostering a long-term positive outcome with the third-party provider when looking at the relationship from a cost-benefit standpoint. A 3PRMTM assessment verifies whether the proposed third-party relationship is consistent with the organisation’s strategic plan and overall business strategy. Specific areas addressed in a 3PRMTM assessment include:

  • Audit and supervision functions that assign clearly defined responsibilities within the organisation
  • Business continuity plans that take into account natural disasters and third-party business closures
  • Supply-chain alternatives that react and respond to every possible scenario, from regional events to currency fluctuations
  • Jurisdictional considerations and affiliations with potential partners located in regions that may be prohibited by law
  • Data and intellectual property protection, which includes customer privacy and information security considerations
  • Anti-corruption and whistle-blower policies begin with staff education and extend to safe internal and external reporting mechanisms which are easily accessible to management and staff.

Our 3PRMTM assessments ensure tight controls to mitigate key risks and designate specific staff responsible for maintaining those controls. Any gaps detected in those controls are addressed during the assessment phase.

VIEW 3PRMTM BROCHURE

CRI® Group invites you to schedule a quick appointment with us to discuss how conducting our 3PRMTM assessment can help you and your organisation. 

GET A FREE QUOTE

 

Who is CRI® Group?

Based in London, CRI® Group works with companies across the Americas, Europe, Africa, Middle East and Asia-Pacific as a one-stop international Risk ManagementEmployee Background ScreeningBusiness IntelligenceTPRMDue DiligenceCompliance Solutions and other professional Investigative Research solutions provider. We have the largest proprietary network of background-screening analysts and investigators across the Middle East and Asia. Our global presence ensures that no matter how international your operations are, we have the network needed to provide you with all you need, wherever you happen to be. CRI® Group also holds BS 102000:2013 and BS 7858:2012 Certifications, is an HRO certified provider and partner with Oracle.

CRI® Celebrates 28 Years with a Trip to Thailand

2018 has been a big year for CRI® Group, a global leader in Risk, Compliance and Anti-Corruption Management Systems. First, the firm was granted accreditation by the Emirates International Accreditation Centre (EIAC) as an ISO 37001:2016 Anti-Bribery Management System Certification and Conformity Assessment Body (the first accreditation of its kind awarded to a certification body specialising in global anti-bribery and anti-corruption, risk and compliance standards).

Then, CRI® Group proudly announced that it will host its Anti-Bribery Summit 2018 in Kuala Lumpur, Malaysia – following the success of last year’s inaugural event. The two-day summit offers expert training and the sharing of best practices for fighting bribery and corruption.

Following both of these major announcements, more than 20 CRI® Group employees gathered in Bangkok, Thailand to celebrate the company’s 28th anniversary. CRI® Group organised the trip to help employees connect, share in their achievements together, and enjoy all of the sights, sounds and great cuisine of Thailand in the ultimate team building trip.

CRI® Group: A Brief History

CRI® Group was originally founded as the “Metropolitan Detective Agency” by Mr. Muhammad Anwar Naveed, the father of CRI® Group CEO Mr. Zafar I. Anjum. It was a one-man private investigation firm that dealt with insurance claim investigations. In 1990, Mr. Zafar Anjum (a former member of the Pakistan Rangers who had earned a Graduate Diploma from Pakistan Detective Training Institute PDTI) formally launched the business as a full flagged district level detection agency with a full range of services including insurance claim fraud investigations, background checks and due diligence.

While working one insurance fraud case in particular, Mr. Zafar Anjum realised that a certain aspect of the affair struck him: Whereas most types of crime are dealt with by the justice system, fraud is peculiar in that it often mandates investigation by an external agency or organisation which specialises in fraud detection.

“I noticed that such organisations were sorely lacking in Pakistan at the time – and that there was a distinct lack of counter fraud education in the general population, which aided those committing fraud greatly”, Mr. Zafar Anjum said. “Furthermore, even where individuals were aware that they were being defrauded, they lacked the knowledge of how to effectively resolve disputes between themselves and the defrauder. Therefore we started a very first corporate investigation company in Pakistan specialising in Fraud Risk Investigations, Risk Consulting and Compliance solutions”.

Mr. Zafar Anjum raised the firm to a new level in 2001 when he incorporated and registered it in Pakistan as a Private Limited Company with a new name: Corporate Research and Investigations (Private) Limited, offering full-scale investigative research services. Corporate Research and Investigations Limited was incorporated in 2006 in the UK, and Corporate Research and Investigations LLC DIFC was incorporated in 2008 in UAE. Today, the company stands as a leader in employee background screening services, investigative due diligence, third-party risk management services and Anti-bribery Management Systems. CRI® Group safeguards some of the world’s leading businesses by establishing the legal compliance, financial viability and integrity levels of outside partners, suppliers and customers seeking for affiliation.

Currently based in London, UK, CRI® Group is a global firm with experts and resources located in key regional marketplaces across the Asia Pacific, South Asia, the Middle East, North Africa, Europe and North America. The company’s success and growth continues, as it recently expanded into North and South America and Asia while opening three new branches: Toronto (Canada), São Paulo (Brazil) and Shanghai (China).

ABAC® Center of Excellence

While reflecting on CRI® Group’s history, Mr. Zafar Anjum said the recent EIAC accreditation is a major milestone and a result of the commitment and hard work of the entire team. CR®I Group administers ISO 37001:2016 Anti-Bribery Management System Certification through its Anti-Bribery and Anti-Corruption ABAC® Center of Excellence, which it launched in October of 2016.

“It is a special honour to be the very first accredited conformity assessment body in Middle East, Asia and the UK”, Mr. Zafar Anjum said. “This accreditation is a testament to the expertise of our global network of audit specialists and the result of 28 years providing high-level risk management and compliance solutions to organisations worldwide seeking to combat the detrimental effects of bribery and corruption”.

CRI® Group’s ABAC®  Center of Excellence was created to educate, equip and support the world’s leading business organisations with the latest in best-practice due diligence processes and procedures, providing world-class anti-bribery and anti-corruption solutions to organisations seeking to validate or expand their existing compliance frameworks to maintain a competitive edge in the world marketplace.

“We are striving to ensure compliance and ethics being best practices for companies and their third-party relationships, and we believe this is a very best defence against all corporate malpractices”, said Mr. Zafar Anjum.

A Time to Celebrate

The idea for the meeting in Thailand grew from CRI® Group’s achievements, and also the company’s focus on human connection as the key to career success, recognising the positive attitudes and encouraging efforts of all employees that help lead the company to new heights year after year. The trip to Thailand was an enthusiastic “thank you” for their hard work.

The group was made up of 22 CRI® Group employees from various worldwide locations. They were joined by Mrs. Kanwal Zafar, wife of Mr. Zafar Anjum, as they gathered in Bangkok for four days. They also visited Pattaya, took a trip to the Coral Island, took a cruise in the river and enjoyed Thai food, culture and each other’s company. As one of the most important aspects of the trip, they engaged in several team building activities to strengthen rapport and communication.

Dubai-based CRI® Group employee Ayesha said: “We had an amazing time in Thailand to celebrate our achievement of accreditation by EIAC. I wish for CRI® Group to have more success ahead so that lots of such trips come our way!”

Austeja, who is based in the UK, said: “The best thing is that we met each other. We do communicate internally a lot, but never met each other in person. I believe from now on, our communication will be even more effective and the bonds we built will help the company to reach even higher goals”.

Muhammad, from Pakistan office, mentioned: “It was my first trip abroad and it was a very peaceful and enjoying journey to Thailand with CRI® Family. Very effectively and thoroughly planned by HR and Admin department. Must say a very well-done job.  Thanks to Sir Zafar and Mam Kanwal for such a memorable trip.”

HR manager Ayesha concludes: “On this auspicious event, I would like to congratulate Mr. Zafar Anjum who have set the foundations of this company 28 years back and worked hard day in and day out to reach heights of success. And this 28th anniversary is very special for all of us as we have achieved EIAC accreditation in this year and we are an Accredited CB for the scope of ISO 37001:2016 ABMS. It is rightly said, and I quote: “Celebrate what you have accomplished, but raise the bar a little higher, each time you succeed”.”

Congratulations to Mr. Zafar Anjum and all CRI® Group employees for an anniversary to remember!

 

 

Employee Screening Process

How do you know the candidate you just offered a role to is ideal? Are you 100% sure you know that everything they’re telling you is the truth? 90%? They showed you a diploma; how do you know it’s not photoshopped? Did you follow the correct laws during your background check process? Background checks and necessary screenings are vital to avoid horror stories and taboo tales within HR, your business or even your brand – simply investing in proper employee screening can save you time, money and heartbreak. A complete employee screening process will result in fewer applications with serious discrepancies – it increases the quality of new hires due to an improved applicant pool and selection process. EmploySmart™ provides full in-depth background screening services for employees and candidates at all levels, from senior executives to shop-floor employees.

How Well Do You Know The People You Invest In?

CRI® Group has developed EmploySmart™, a robust new pre-employment background screening service to avoid negligent hiring liabilities. Ensure a safe work environment for all. EmploySmart™ can be tailored into specific screening packages to meet the requirements of each specific position within your company. We are a leading worldwide provider specialised in local and international employment background screening, including pre-employment and post-employment background checks.

Pre-employment checks/background checks/screening benefits:

  • Reduce turnover & training costs
  • Gain a competitive edge through the hiring of better people
  • Increase productivity – help your employees be more productive, knowing that everyone employed by your company has been screened.
  • Set your company apart & win more business
  • Reduce employee-related problems
  • Protect company reputation/brand & customer relations
  • Comply with mandates created by state or federal law for certain industries
  • Increase retention
  • Reduce negligent hiring claims
  • Avoid violence in the workplace (threats of violence & actual violence)
  • Reduce theft & espionage
  • Avoid lawsuits & the costs associated with the defence.
  • Avoid loss of goodwill.

Pre-employment checks/background checks, what are they?

These checks are essentially an investigation into a person’s character – inside and outside their professional lives. Some checks you probably already carry out in-house, such as candidate’s qualifications (documents provided), work history (with a reference check), right to work in the country and even a quick social media presence scan. However, we provide a full in-depth background screening service for candidates and employees at all levels – from senior executives through to shop-floor employees:

  • Address Verification (Physical Verification)
  • Identity Verification
  • Previous Employment Verification
  • Education & Credential Verification
  • Local Language Media Check
  • Credit Verification & Financial History (where publicly available)
  • Compliance & Regulatory Check
  • Civil Litigation Record Check
  • Bankruptcy Record Check
  • International Criminal Record Check
  • Integrity Due diligence… and more.

When should I conduct pre-employment checks?

Our pre-employment screening services will help you avoid adding potential fraudsters and other bad actors to your staff. These checks can be implemented before or after a job offer (with each having its pros and cons).

How to collect references, and what to ask?

Because it is impossible to know how your candidate will work daily from just one interview, you will need references. References are a great way to find out whether your candidates are suitable for the role or will fit with your company culture. A primary reference check asks for:

  • Employment dates
  • Employment main responsibilities
  • Attendance record
  • Any disciplinary actions against them
  • Any reasons why they shouldn’t be employed

These references will help you back up their CV – however, many candidates tend to exaggerate or misrepresent themselves. Our EmploySmart™ team goes beyond to get a fuller picture for you:

  • Greatest strengths?
  • Are they suitable for the role they’ve applied for?
  • Would they rehire the candidate?
  • Suitable management style?
  • Do they have any leadership skills?
  • Situations in which they have excelled at?

Some companies have policies of not giving references and just providing necessary employment details, while others direct you towards HR, but the EmploySmart™ team is persistent.

What specific legal requirement should I ask?

You will need to check if they have the right to work in the region you are recruiting for. You are subject to statutory penalties if you employ foreign nationals who don’t have the correct visas. You will need to request criminal records checks depending on the role you are recruiting. Such roles with children or vulnerable people are highly regulated – and all of these differ from country to country.

CRI Group™ carries the burden of knowing the laws, so we can assist you with staying compliant and helping you to make the best decisions for your company’s needs. We have established an interdisciplinary team of experts in employment law, best practices and data protection. We can manage your employment background screenings across borders for you! Country by country, we have documented the different approaches to employment screening, ensuring we operate in harmony with local culture and within the limitations of local legislation.

With extensive local language capabilities, flexible working patterns and time zone intelligent workflow, we provide a comprehensive and fully compliant global screening service.

At CRI Group™, we specialise in employment screening, working as trusted partners to HR and recruiting managers of corporations and institutions worldwide. Our people work with energy, insight and care to ensure we provide a positive experience to everyone involved – clients, reference providers and candidates.

CRI Group™’s unique identity and vision evolved from our fundamental desire to support our clients and candidates. We have a passion for Screening and a simple belief in setting new standards. These qualities fuel our commitment to excellence and drive our culture.

Our EmploySmart™ background screening services expose vulnerabilities and threats within your organisation and can significantly reduce business and financial crime, fraud and malpractice within your workplace. Our experienced EmploySmart™ Team can safeguard your data security and your business integrity while you can focus on human conversations and interactions. Together, your organisation can deliver outstanding screening experiences.

We provide a host of professional services to HR managers representing significant corporations worldwide. Employees should be screened regularly to reveal any new information relevant to the business. That’s why our background investigations services also include:

  • Employee monitoring and risk management
  • Data protection compliance
  • Employee testing and confidentiality
  • Employee risk management
  • Post-employment background checks

CRI Group™ is trusted by the world’s largest corporations and consultancies – outsource your employee due diligence to an experienced provider, and you will only ever have to look forward, never back.

BS 7858:2019 Screening: extra security level for your business and employees

CRI Group™ is trusted by the world’s largest corporations and consultancies – outsource your employee due diligence to an experienced provider, and you will only ever have to look forward, never back.

Get answers to frequently asked questions about background checks/screening cost, guidelines, check references etc. This eBook of compiled list of background screening related questions taken as a whole is the perfect primer for any HR professional, business leader and company looking to avoid employee background screening risks. It provides the tools and knowledge needed to make the right decisions.

READ MORE

Working with CRI Group™, you get:

  • Extensive global coverage, with expertise in domestic and international Screening; one of the largest, most experienced and best-trained integrity due diligence teams in the world
  • Our team of more than 50 full-time analysts is spread across Europe, the Middle East, Asia, and North and South America and is fully equipped with the local knowledge to serve your needs globally.
  • The ability to manage multiple background checks online
  • Quick turnaround times
  • Our solutions are easily customisable and flexible, and we will tailor our scope to address your concerns and risk areas, saving you time and money.
  • High-quality searches, backed by numerous checks and quality controls
  • We have a flat structure which means that you will have direct access to senior staff members throughout the due diligence process.
  • Our multi-lingual teams have conducted assignments on thousands of subjects in over 80 countries, and we’re committed to maintaining and constantly evolving our global network.
  • Our extensive solutions include due diligence, employee pre and post background screening, business intelligence and compliance, and facilitating any decision-making across your business, no matter what area or department.

GET A QUOTE

Who is CRI Group™?

Based in London, CRI Group™ works with companies across the Americas, Europe, Africa, Middle East and Asia-Pacific as a one-stop international Risk ManagementEmployee Background ScreeningBusiness IntelligenceDue DiligenceCompliance Solutions and other professional Investigative Research solutions provider.

We have the largest proprietary network of background screening analysts and investigators across the Middle East and Asia. Our global presence ensures that no matter how international your operations are, we have the network needed to provide you with all you need, wherever you happen to be. CRI® Group also holds BS 102000:2013 and BS 7858:2012 Certifications, and is an HRO certified provider and partner with Oracle.

LET’S TALK!