A CORRUPTION MAKEOVER
You might have heard that Montreal has had its scuffles with corruption, but there is hope that our reputation will lift a little courtesy of ISO 37001, new international anti-corruption standards crafted with the help of Jacques Duchesneau and soon to be
Quebec isn’t the only place fighting corrupt and collusive practices in government and private contracting, but it is about to become one of the first places in the world where companies and public bodies will be able to go to school to learn a new international standard for fighting corruption.
Enter two former top directors of the Sûreté du Québec, Jean Bourdeau and Serge Barbeau, who this spring will begin teaching a five-day course at École de technologie supérieure in Montreal that was developed for organizations that want to certify for a new anti-bribery ISO standard launched globally last fall.
The International Organization for Standardization, or ISO, developed the new ISO 37001 with the help of an international panel over two-and-a-half years to address the fact that corruption and bribery are global problems.
“I think it’s the certification that will become the most popular because it addresses corruption,” said Bourdeau, who served as deputy general director of criminal investigations for the SQ from 1997 to 2001 and now runs a private investigation firm with Barbeau, a former general director of the SQ.
Those who are unfamiliar with ISO will have seen banners with the words “ISO 9001 Certified” outside some office buildings around Quebec. That’s one other type of certification, and it refers to a management system that was developed by the international standards-setting body to focus on customer service and satisfaction.
The new ISO 37001 specifies a series of internal processes and policies to help organizations prevent, detect and address bribery, including adopting whistleblower protection, developing ethics policies, appointing an internal compliance officer, providing training for employees to combat bribery, conducting risk assessments, setting up internal financial controls and developing procedures to report and investigate deviations.
“It doesn’t guarantee individual integrity,” Bourdeau said, “but it guarantees that the organization is taking measures to have overall integrity.”
An ISO -certified company is required to have continual internal and external monitoring and to provide documentation to demonstrate that it continues to comply with the international standards.
The organization must designate an internal auditor, who will have to be certified by an outside ISO-certified auditing firm, and the organization has to be audited regularly by an external auditor, who also has to be ISO-certified.
There’s a lot of paperwork involved in an ISO certification, said Eric Lessard, general manager for Quebec-based PECB North America Inc., an international standards certification firm that developed the five-day course that Bourdeau and Barbeau will instruct at ÉTS.
PECB has partnered with ÉTS Formation, the professional continuing education section of the École de technologie supérieure, to offer the course, which costs $2,795. The first session begins in May and a second course is already scheduled for September.
Courses are starting to be offered in other countries, too, he added.
The bigger investment for an organization comes after completing the course, when it will spend months implementing the processes and policies that are required to obtain the ISO 37001 certification.
“It’s not just about signing a code of ethics,” Lessard said. “It’s about having processes in place that are audited and documented. This is a controlled environment. This is not just simple basic policies and a whistleblower line.”
Jacques Duchesneau, the former Montreal police chief who was just appointed the first inspector general of St-Jérôme, was part of the international committee that developed the hundreds of articles contained in the ISO 37001 standard over the last two-and-a-half years.
One feature that sets the ISO certification apart from other anticorruption initiatives in Quebec is that everyone, from top managers down to employees, is part of the certification process, he said.
Moreover, the example is being set by an organization’s executives, Duchesneau said. “Just by accepting to be audited sends a very powerful message to employees.”
At the same time, the ISO 37001 certification complements the existing initiatives in Quebec, he said.
For example, firms vying for certain types of public contracts are required to have authorization to bid from the Autorité des marchés financiers (AMF). That process requires a background check on a firm’s executives that’s carried out by the province’s anti-corruption squad, UPAC.
And St-Jérôme has just joined Montreal and Laval in creating an inspector general’s office to investigate contracts.
“UPAC (and inspectors general) are looking for bad guys doing bad things,” Duchesneau said.
“So (ISO 37001) is a prevention tool, while the others are reactive.”
Duchesneau said he will recommend ISO 37001 for St-Jérôme.
But even he says ISO certification isn’t foolproof. The CEO of the first company in the world that obtained the ISO 37001 certification, in Italy, was arrested just a few days after the company received the certification, he said.
“So there will be charlatans that might be in the business,” Duchesneau said, adding that he wouldn’t be surprised if some companies will seek the certification merely for image.
That’s why the strength test for ISO 37001 will be in the quality of the external auditors who will make sure an organization is compliant, he said.
Christian Levesque and members of his Quebec-based firm, Levesque Strategies & Public Affairs Inc., took training courses in Dubai and Paris this year and were certified by a Paris-based company to act as external auditors for ISO 37001 companies.
His firm is also certified to help organizations obtain ISO 37001 certification.
“It’s not cheap, but it’s not that expensive,” Levesque said of the cost to obtain ISO 37001 certification. “It’s just processes that they have to put in. And they don’t have to put them all in at once.”
The company that gets the certification will see the money returned in the form of business, he added.
“It shows the public that they can trust the company they’re working with,” said Levesque, who represented the Canadian government on the international panel that developed the ISO 37001 standard.
“How do you show that you don’t have corruption within your organization? You can say it, but we’re at a time when people don’t just want you to say it but to show them that you’re doing what’s necessary.”
The ISO 37001 requirements, particularly whistleblower protection and an ethics code, will seem like a no-brainer for any organization that’s serious about rooting out corruption.
However, Pierre-Olivier Brodeur, who worked as a research associate for the Charbonneau Commission and is spokesperson for a watchdog committee that wants to ensure the government implements the commission’s recommendations, said he doubts that more than a small number of companies and municipalities have introduced such basics as an independently managed whistleblower hotline.
The new ISO 37001 is earning praise from corruption fighters like Brodeur because it’s the first time, he said, that anyone has established best practices among anti-corruption measures. Moreover, it comes with the “stick” of requiring continual compliance lest the company lose its certification, risk international shame and lose business.
In fact, the new ISO certification comes at a good time, he said, because a new industry has blossomed in Quebec in the wake of the Charbonneau Commission report released in November 2015. Management consulting firms, accounting firms and law firms are selling their services to companies to put in place anti-corruption programs and help them get their AMF authorization.
“But there have been no standards to date,” Brodeur said. “So with these new international standards, companies or municipalities or governments that want professional consultants to help them to protect against corruption will know they can answer to international standards set out in ISO 37001 . ... It’ll help avoid having just anything offered in the marketplace.”
Bourdeau, meanwhile, said he hopes to see municipal officials among his pupils when his class starts in May.
It’s too early for public bodies that award contracts to require bidders to have ISO 37001 certification, Bourdeau said, but he added that he wouldn’t be surprised if that happens down the road.
In Montreal, Mayor Denis Coderre’s administration said it’s aware of ISO 37001 and is open to seeing how it might be applied at the city.
“The inspector general (Denis Gallant) has identified a person on his team to analyze and propose an application of its principles adapted to the city of Montreal,” administration spokesperson Noémie Brière-Marquez said.
Bourdeau said an inspector general’s office has its uses, but many municipalities don’t have the financial means to operate such an office. That said, any municipality can afford to adopt the ISO 37001 standards, he said.
“They already have a management system in place called the city manager’s office,” he said.
“They just need to take a position where they say, ‘No, we’re going to do things right’ . ... You don’t need additional investigative powers. What you need is to ensure that the call-for-tenders system is right and that employees are trained and know that their bosses want things done cleanly.”
It’s about having processes in place that are audited and documented. This is a controlled environment. This is not just simple basic policies and a whistleblower line.