Designing a risk-based anti-corruption audit schedule

Multinational companies often struggle to balance consistent global oversight with the different corruption risks they encounter in each market. A fixed annual audit may be too frequent for low-risk operations and too sparse for transactions involving government approvals, opaque intermediaries or sensitive imports. The schedule should therefore respond to exposure rather than simply mark a recurring date on the compliance calendar.

How to design a risk-based anti-corruption audit schedule for multinational operations is ultimately a governance exercise. It requires leadership, internal audit, compliance and business teams to agree on which risks merit independent testing, how often those risks should be reviewed and what evidence will demonstrate that controls are working.

Australian legislation provides an important foundation. The Corporations Act 2001 (Cth) addresses bribery of foreign public officials, misleading or conduit payments and principal liability for agents. Records, tax, sanctions, AML/CTF and modern slavery requirements may create additional obligations, including reporting under the Modern Slavery Act 2018 for qualifying entities with consolidated revenue above AUD 20 million.

Local operating conditions also shape the design. Many Australian organisations are headquartered in Sydney or Melbourne, with resource and logistics operations connected to Brisbane, Perth and regional centres. Digital payments, email approvals and tap-to-go transport are routine, yet cash may still feature in taxis, markets and smaller hospitality venues. Smaller Australian businesses may also continue to rely on spreadsheets for third-party and transaction tracking.

Start with exposure rather than geography

Begin with a risk universe that covers the company’s activities, not merely the countries where it has offices. Relevant exposures may include permits, customs, construction, mining, health procurement, utilities, state-owned enterprises, aid-funded projects and distribution routes. A low-risk sales office can present less concern than an agent collecting public-sector payments in a higher-risk jurisdiction.

Country profiles, legislation guidance and training resources can help teams organise this initial work. The portal’s resource disclaimer is a useful reminder that general information does not replace jurisdiction-specific legal advice or professional judgment.

Score each activity using consistent criteria: transaction value, payment complexity, government contact, third-party opacity, political exposure, prior findings and the effectiveness of existing controls. Keep inherent risk separate from residual risk. A weak control should increase urgency, while a strong and tested control may justify a longer review interval.

Translate risk into audit frequency

A practical frequency model can use four tiers. Critical-risk activity may require continuous monitoring, event-driven testing and at least one independent on-site review each year. High-risk activity generally warrants annual testing and more frequent desktop reviews. Medium-risk processes can receive risk-based testing over a two-year cycle, while low-risk activity may be covered by periodic control attestations and targeted analytics.

Ground the assessment in how business is actually conducted. A source such as this travel journal can prompt questions about cash payments, informal hospitality or transport practices that an Australian employee might otherwise overlook. Such observations are not substitutes for transaction evidence, but they can help identify scenarios that deserve further diligence.

Frequency should reflect both likelihood and potential impact. A single minor payment to a low-risk supplier may need less attention than repeated small payments routed through the same intermediary. Likewise, a new agent in a high-risk market may require immediate due diligence and an audit before it receives substantial value, regardless of the standard annual timetable.

Build an annual and event-driven calendar

Create a twelve-month schedule that combines planned assurance with targeted reviews triggered by change. Anchor recurring work around board reporting cycles, financial close, contract renewal peaks and the Australian financial year. This allows audit work to connect with known commercial pressures rather than operating as a disconnected compliance exercise.

Event triggers should have defined owners and response times. Examples include appointing a new sales agent, entering a government tender, changing a beneficiary bank account, receiving an unusual success fee, identifying a politically exposed person, or receiving a report of suspected bribery. Acquisitions, sanctions changes and regulatory requests can also trigger an immediate scope assessment.

Coordinate the calendar across regions without ignoring local capacity. Australian teams working across time zones need advance notice of document requests, while local holidays and operating seasons can affect the availability of staff and records. Central ownership provides consistency, but local business or compliance personnel should help validate whether planned tests reflect conditions on the ground.

Select scope, methods and independence

Each audit should have a defined scope covering transactions, third parties and relevant controls. Transaction testing may examine payments above risk thresholds, while third-party testing assesses due diligence, contracting, approval and monitoring. Control testing should determine whether escalation, documentation and remediation actually occur rather than merely confirming that policies exist.

Use methods proportionate to the risk. Analytics can identify duplicate invoices, round-dollar payments, split transactions and repeated payments to connected beneficiaries. Interviews and walkthroughs can then explain why those patterns arose. Some high-risk relationships warrant a physical site visit; others can be tested remotely, provided the reviewer has sufficient local knowledge and access to original records.

Independence and evidence quality need explicit safeguards. Internal audit should retain the ability to escalate findings and challenge management responses. Reviewers should document sampling rationales, preserve source records and protect confidential information. Where reviews involve Australian employee or customer data, privacy obligations and data minimisation should inform how evidence is collected, shared and retained.

Match evidence to legal obligations

Build an obligation map alongside the risk assessment. For each activity, identify applicable foreign bribery laws, facilitation-payment restrictions, procurement rules, accounting requirements, sanctions controls and anti-money-laundering duties. Australian head-office controls should not overlook local requirements that impose stricter disclosure, approval or recordkeeping obligations.

Country comparisons can expose important distinctions. The Sub-Saharan legal analysis illustrates why descriptions such as “small”, “customary” or “facilitation” require careful legal analysis. Teams should not assume that a payment is acceptable merely because it is modest, made to speed up a routine service or authorised locally.

Audit evidence should preserve a clear account of who requested, approved and received each payment. Vague descriptions such as “government fees” or “local assistance” may conceal an improper purpose. Findings should move promptly through legal, compliance and disciplinary channels, with protections against retaliation and appropriate preservation of records where an investigation may follow.

Set a practical planning cycle

A workable schedule should be translated into a compact set of planning rules:

• Review the legal and business risk map annually and whenever operations, agents or payment routes change.
• Rank activities using consistent inherent and residual risk criteria.
• Match independent testing frequency to risk tier, transaction value and control maturity.
• Define event triggers, responsible owners and maximum response times.
• Require documented approval before engaging a new intermediary in a sensitive activity.
• Record audit coverage, findings, root causes, remediation owners and closure evidence.
• Report overdue high-risk actions and repeat findings to the appropriate governance forum.

These rules should be owned jointly by compliance and internal audit, with business leaders accountable for resources and corrective action. A central schedule can summarise status while local teams provide the context needed to assess whether emerging patterns are genuine control failures.

Make the schedule a living accountability record

The schedule should evolve as the business changes. Version control, approval records and short explanations of timing changes allow the board and external reviewers to see how decisions were made. Adding a higher-risk country without increasing audit coverage should be visible as a gap, while removing a low-risk activity should be supported by evidence rather than an unsupported assumption.

Board reporting should focus on meaningful indicators: risk coverage, overdue reviews, repeat findings, unresolved third-party concerns and the age of remediation. Trend information can reveal whether the audit programme is reducing exposure or merely documenting recurring weaknesses. It also helps management distinguish isolated issues from problems embedded in the business model.

The lasting principle is that a defensible schedule turns changing corruption exposure into proportionate, documented and independently tested assurance.