A practical guide to Vietnam’s 2018 Anti-Corruption Law and ISO 37001:2025, covering bribery risks, controls, training evidence and legal limits.
Vietnam Anti-Bribery Training: How Law 2018 and ISO 37001:2025 Fit Together
A useful anti-bribery course does more than recite a policy. It helps a tour operator, hotel group or travel company recognise an improper advantage, pause a risky payment, escalate the concern and preserve an audit trail. The legal starting point and the management-system starting point should be taught together, but they should not be presented as the same thing.
1. What do the two frameworks cover?
Vietnam’s Anti-Corruption Law
Vietnam’s Law on Anti-Corruption No. 36/2018/QH14 was issued on 20 November 2018 and took effect on 1 July 2019 . It is a national legal instrument dealing with prevention, detection and handling of corruption and related violations. Whether a particular duty applies to a company, employee or transaction depends on the organisation’s status, activities, public-sector relationships and other applicable rules.
ISO 37001:2025
ISO 37001:2025 is an anti-bribery management-system standard. ISO describes it as a framework for establishing, implementing, maintaining and improving measures to prevent, detect and respond to bribery in public, private and not-for-profit organisations . ISO’s FAQ explains that adoption is generally voluntary, although a law, contract, procurement condition or supply-chain requirement may make it relevant or required in a particular setting .
Bribery is not the same as every form of corruption. ISO’s FAQ describes corruption as the broader concept and notes that ISO 37001 focuses on bribery, while an organisation may choose to extend its system to other misconduct risks .
2. Where do tourism bribery risks appear?
Common exposure points include licensing and inspections, customs or border processes, destination suppliers, guides, agents, commissions, gifts, hosted travel, charitable contributions and cash payments without reliable documentation. A third party can create risk when it acts for, or benefits, from the company’s business.
Training should make the warning signs concrete: a request for a personal bank transfer, a “facilitation fee” with no official basis, an unusually urgent approval, a hidden commission or a request to keep the payment off the books. Employees should not be expected to conduct their own investigation. They need a safe route to ask for advice and report concerns.
3. What controls and training should an organisation use?
ISO’s official FAQ lists anti-bribery policy, leadership responsibility, communication, a responsible function, personnel controls and training, risk assessment, due diligence, financial and non-financial controls, reporting, monitoring, investigation, audit, corrective action and continual improvement among the relevant measures . These are system elements, not a promise that every organisation must use identical forms.
A role-based programme works best:
- Front-line staff: refuse, pause and report an improper request.
- Procurement and finance: apply segregation of duties, approval limits, reliable invoices and supplier checks.
- Managers: handle exceptions, conflicts of interest and escalation.
- Leadership: set expectations, allocate resources and avoid rewarding results achieved through misconduct.
The training record should show the learning objective, audience, date, materials, attendance and a practical knowledge check. A signature alone proves attendance, not competence.
4. A practical implementation sequence
First define the system scope. It may cover the whole organisation or a defined activity, entity or business process. Next map exposure points and rate risk using factors such as public-sector contact, intermediary use, geography, transaction value and prior concerns. Then publish a short policy and approval route for gifts, hospitality, sponsorships and unusual payments.
After that, perform proportionate due diligence on higher-risk business associates and place suitable anti-bribery, reporting and termination provisions in contracts. Establish a reporting channel, document how cases are triaged, and review whether controls actually work. Finally, record corrective action and revisit the risk assessment when the business, supplier or legal environment changes.
5. Evidence and people responsibilities
Useful evidence can include the approved policy, risk assessment, training plan and results, due-diligence records, gift and hospitality register, exception approvals, supplier clauses, payment controls, reports, investigation records, audit results and corrective-action logs. Keep sensitive case information restricted and manage retention under applicable privacy and records rules.
Leadership owns commitment and resources. The anti-bribery or compliance function oversees the programme. Operational managers apply controls. Employees complete training, follow the policy and report actual or suspected non-compliance. ISO’s FAQ stresses that everyone has responsibilities in planning, implementation and maintenance .
Example scenario
A local agent asks a travel company to pay cash to “speed up” a permit. The employee should not pay or negotiate privately. They should record the request, contact the designated function, verify the official fee route and allow the company to decide whether the relationship can continue. The evidence should connect the risk, advice, decision and follow-up.
6. Frequently asked questions
Does ISO 37001 certification prove legal compliance?
No. Certification or implementation does not replace a review of Vietnamese law, sector rules, contracts or current guidance.
Does ISO 37001 guarantee that bribery will not happen?
No. ISO expressly states that conformity or certification cannot assure that bribery has not occurred or will not occur, and does not provide absolute protection from prosecution .
What changed in 2025?
ISO lists ISO 37001:2025 as the current published edition and shows the 2016 edition as withdrawn . Vietnam also issued Law No. 132/2025/QH15 amending the Anti-Corruption Law, with an effective date of 1 July 2026 . The detailed effect on a particular organisation should be checked against the current official text, implementing documents and transitional provisions.
Contact us for Vietnam Anti-Bribery Training on Law 2018 and ISO 37001:2025 consulting in Vietnam.
ISC Global
Hotline/Zalo: +84 933 096 426 – +84 868 591 260
Email: info@iscglobal.asia | van.pham@iscglobal.asia
Website: iscglobal.asia | iscglobal.edu.vn
No responses yet