An anti-bribery policy is only one record. Evidence should show risk-based decisions and functioning controls in the activities actually included.

01

Trace a transaction through its controls

For a hypothetical intermediary fee, connect due diligence, approved terms, service evidence, payment authorisation and any exceptions. Match records and decision owners. A supplier questionnaire is not meaningful review if contradictory information was never examined. Update scrutiny when the relationship or risk changes.

02

Protect reporting and follow-up integrity

Explain how concerns are received, handled and escalated with appropriate confidentiality and protection. Use anonymised or controlled evidence where necessary; sensitive cases do not justify showing no process. Track findings, cause, action and effectiveness, and oversight of unresolved matters. Do not invent a complaint or investigation to make the file appear complete.

03

Compare fees and verify certificate limits

Risk review, process changes, legal work and consultancy are separate from initial audit, surveillance, recertification and travel. Compare scope and assumptions, then verify issuer, entity, activities, sites, edition, status and claimed accreditation. Certification does not clear a transaction or prevent official investigation. Neither a proposed timetable nor preparation consultancy can guarantee approval.

04

Preparation and independent decision

ISO does not issue certificates. Verify the proposed issuer, standard and activity against any claimed accreditation scope. Consultancy cannot guarantee approval; the competent body evaluates evidence and makes the independent decision. The applicant implements the system and prepares procedures specific to its own operations and operating records. A certification enquiry to Kayra concerns actual activities, sites, application information, authority and impartiality risks; this role does not include designing or implementing the client’s system. A management-system certification body, other parts of the same legal entity and controlled entities cannot offer or provide management-system consultancy; separate contracts do not remove this restriction.

Sources and application limits

Examples are hypothetical checks. Actual evidence and control gaps determine readiness; criminal or regulatory decisions remain with competent authorities.