Top management establishes an anti-bribery policy which: forbids bribery; demands that the anti-bribery laws applying to the organization are obeyed; fits the organization's purpose; gives the basis on which anti-bribery objectives are set; commits to satisfying applicable requirements; encourages people to raise concerns confidentially, in good faith or on a reasonable belief, without fear of retaliation; commits to continually improving the system; sets out the anti-bribery function's authority and its independence; and sets out what follows from breaching the policy. The policy is held as documented information, communicated inside the organization, made available to interested parties where appropriate, and communicated to business associates presenting a bribery risk above low.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.