Anti-Bribery and Corruption Risk Assessment Services  — ABAC Framework, FCPA & UK Bribery Act Compliance, Third-Party Due Diligence

Anti-Bribery and Corruption Risk Assessment Services in India

Bribery and corruption are among the most consequential risks a company operating in India faces — not because corruption is uncommon or unknown, but because the legal and reputational consequences of getting it wrong have never been higher. An Indian subsidiary that allows a sales agent to pay a customs official to expedite a clearance has potentially exposed its US-listed parent to an FCPA enforcement action with criminal penalties and Securities and Exchange Commission consequences. A company with any UK business connection whose distributor bribes a procurement officer has potentially triggered a UK Bribery Act prosecution. And the Prevention of Corruption (Amendment) Act 2018 has made the Indian legal position equally serious — bribe givers now face the same penalties as receivers.

The consequence is that every company with meaningful India operations — whether Indian, multinational, or Indian subsidiary of a foreign parent — needs a structured Anti-Bribery and Corruption (ABAC) risk assessment to understand its exposure, evaluate the adequacy of its existing controls, and build the compliance infrastructure that the law requires. For a company subject to the UK Bribery Act, 'adequate procedures' is not a best-practice aspiration — it is the only available defence against a corporate bribery prosecution.

N D Savla & Associates provides Anti-Bribery and Corruption risk assessment services for companies across Mumbai and India — from initial risk universe mapping through third-party due diligence, ABAC policy review, internal control testing, and board-level risk reporting. Our ABAC advisory is integrated with our corporate governance advisory and internal audit services — so the ABAC risk assessment feeds directly into the company's broader risk and governance framework. For the regulatory framework, refer to the Ministry of Corporate Affairs at mca.gov.in.

FCPA vs UK Bribery Act vs Prevention of Corruption Act — Key Differences

India's ABAC landscape is governed by a layered framework of domestic and international laws — and for many companies, multiple laws apply simultaneously. Understanding which laws apply to your company is the essential first step before an ABAC risk assessment:

Highest-Risk ABAC Areas for Companies in India

The ABAC risk landscape in India is shaped by the intersection of regulatory complexity, government interface frequency, and third-party dependence. Based on our risk assessment experience across Indian industries, the highest-risk areas are:

Government Procurement and Contract Awards

Companies that sell to government entities — central government departments, state governments, public sector undertakings (PSUs), railways, defence establishments, and municipal bodies — face the highest inherent bribery risk. The combination of large contract values, significant official discretion, and complex procurement procedures creates an environment where bribery pressure is persistent. The FCPA enforcement record for India shows government procurement to be the single most common trigger for enforcement actions.

Licences, Permits, and Regulatory Approvals

Companies that require government licences — factory licences, pollution clearances, drug licences, FSSAI approvals, SEBI registrations, and sector-specific permits — face chronic bribery risk at the interface with the licensing authority. The use of third-party agents to 'manage' licence applications is a particularly high-risk practice that frequently appears in FCPA and PCA enforcement actions.

Customs and Border Clearance

Import-dependent businesses and exporters face bribery risk at customs — both at the point of filing and at physical examination. The time pressure of perishable goods or production-line materials creates a vulnerability to 'facilitation payments' for expedited processing — payments that are explicitly prohibited under both FCPA and UK Bribery Act, regardless of local custom or business necessity.

Third-Party Agents and Intermediaries

The single most dangerous channel for bribery is the third-party intermediary — the sales agent who 'knows the right people', the consultant retained specifically for government relationship management, or the distributor in a high-risk state whose actual sales volume doesn't match their reported commission earnings. Under FCPA and UKBA, the company is responsible for the conduct of its agents even if the company claims it was unaware of the specific bribery. Our Risk Control Matrix services map the specific third-party relationships that represent highest ABAC exposure.

Land Acquisition and Real Estate Transactions

Companies acquiring land for manufacturing, warehousing, or commercial development in India face bribery risks across multiple interaction points — revenue department, town planning, conversion approvals, registration, and mutation. The combination of large transaction values and multi-stage government involvement makes real estate one of the consistently high-risk ABAC areas in India.

Tax and Compliance Administration

Direct tax assessments, GST audits, professional tax, and customs duty disputes all create interface points with government officers where bribery demand can arise. A company that relies on its tax consultant to 'handle' revenue authorities without adequate oversight and documentation is creating undisclosed ABAC exposure.

What Should an ABAC Policy Framework Include?

An effective ABAC policy framework is the written articulation of a company's anti-bribery commitments and procedures. Our SOP implementation services design and implement the documented process controls that make ABAC policies operational. A complete ABAC policy framework covers:

• Anti-Bribery and Corruption Policy: The overarching policy statement — what constitutes bribery, what is prohibited (including facilitation payments under FCPA/UKBA), what is required of employees, and the consequences of violation.
• Gifts, Hospitality, and Entertainment Policy: A specific policy with value limits, approval requirements, and documentation obligations for receiving and giving gifts and hospitality. A gift register is a mandatory control under most ABAC frameworks.
• Political Contributions Policy: Restrictions and controls on corporate political contributions — which are prohibited under FCPA for influencing foreign government officials.
• Charitable Donations and Sponsorships Policy: Controls on charitable contributions that could be used to benefit government officials or their relatives — a common FCPA and UKBA red flag.
• Third-Party Due Diligence Procedure: The documented process for screening, approving, contracting with, and monitoring third parties — including sanctions list checks, PEP screening, adverse media, and contractual ABAC representations.
• Whistleblower and Ethics Hotline Mechanism: A confidential channel for reporting suspected bribery or corruption — with a documented non-retaliation policy and a defined investigation procedure.

How We Conduct an ABAC Risk Assessment — Our 7-Step Process

1. Law and Jurisdiction Mapping
   We begin by identifying which anti-bribery laws apply to the company — Indian PCA, FCPA, UKBA, or other jurisdiction-specific laws. For Indian subsidiaries of multinational companies, the applicable law framework can include multiple jurisdictions simultaneously. We map the specific compliance obligations that arise from each applicable law — including facilitation payment prohibition (FCPA/UKBA), adequate procedures requirements (UKBA/PCA 2018), and books-and-records obligations (FCPA).
2. Bribery Risk Universe Mapping
   We work with the company's management across functions — procurement, sales, regulatory affairs, customs, finance, and legal — to map all processes, transactions, government interactions, and third-party relationships that create bribery exposure. The risk universe mapping covers both domestic operations and (where applicable) operations across multiple states or international locations.
3. Inherent Risk Scoring and Prioritisation
   Each identified risk area is scored on two dimensions: likelihood of a bribery event occurring (based on industry norms, geography, government interaction frequency, and third-party dependence) and impact if it does (regulatory penalty, reputational damage, business disruption). The scores produce a heat map of the company's ABAC risk landscape — directing the depth of assessment to the highest-risk areas.
4. Third-Party Due Diligence Review
   We review the company's entire third-party portfolio against the bribery risk criteria — classifying parties by risk level, reviewing existing due diligence documentation, identifying gaps in screening and contractual protection, and flagging relationships with red flags for deeper investigation. This is the most time-intensive step for companies with large agent or distributor networks. Where forensic investigation is warranted for specific third parties, our forensic investigation and dispute advisory capabilities support deeper investigation.
5. ABAC Policy and Control Gap Assessment
   We review existing ABAC policies, procedures, training programmes, approval authorities, payment controls, gift registers, and monitoring mechanisms against the requirements of the applicable laws and international best practice frameworks (including the UK MoJ's six principles for adequate procedures). Each gap is documented, rated for severity, and included in the remediation plan.
6. Internal Control Testing
   For the highest-risk control areas identified in Step 5, we conduct substantive testing — reviewing samples of transactions, approvals, gift register entries, third-party payments, and management override instances to assess whether the controls that exist on paper are actually functioning in practice. Control failures identified in testing are reported to management and the audit committee.
7. Risk Report and Remediation Plan
   We prepare a comprehensive ABAC risk report — covering the risk universe, risk scoring, due diligence findings, control gap assessment, and testing results — with specific, prioritised remediation recommendations for each identified gap. The report is structured for audit committee and board presentation. Where the ABAC risk assessment reveals systemic governance gaps, we connect the findings to the company's broader corporate governance and internal audit programmes for integrated remediation.

Who Needs an ABAC Risk Assessment in India?

Indian Subsidiaries of US-Listed or US-Connected Companies

The FCPA applies to any company whose securities are listed in the US — and to their subsidiaries worldwide. For any Indian subsidiary of a US-listed parent, every payment to an Indian government official is a potential FCPA event. DOJ enforcement practice consistently holds parent companies responsible for subsidiary conduct when the parent had governance systems that should have detected the payment.

Indian Subsidiaries of UK Companies

The UKBA's extra-territorial reach applies to any company that 'carries on a business or part of a business in the United Kingdom' — and courts have interpreted this very broadly. A company with a UK sales office, a UK shareholder, or UK-based management has potential UKBA exposure for bribery conducted anywhere in the world, including through Indian agents and distributors.

Indian Companies Seeking to List Internationally or Attract Foreign Investment

Indian companies pursuing overseas listings — on NYSE, NASDAQ, or AIM — or seeking investment from US or UK institutional investors face ABAC due diligence scrutiny as a standard part of the pre-listing or pre-investment process. An absence of documented ABAC risk assessment and compliance programme is a significant red flag for sophisticated foreign investors.

Companies in High-Risk Sectors

Pharmaceuticals, construction and real estate, energy and mining, defence, infrastructure, telecommunications, and financial services are consistently identified as high-risk sectors for corruption in India — based on the combination of government interface frequency, large transaction values, and historical enforcement patterns. Companies in these sectors face elevated ABAC risk regardless of their ownership structure.

Why N D Savla & Associates for ABAC Risk Assessment

• Integrated with internal audit and corporate governance. ABAC risk assessment is most effective when it connects to the company's existing internal audit programme and corporate governance framework — not conducted as a standalone exercise that produces findings no one acts on. We design every ABAC engagement to feed into the annual internal audit plan and the audit committee's risk oversight agenda.
• Process-level control assessment. Bribery risk is a process-level control risk — it arises where specific processes have inadequate controls. Our risk control matrix expertise means we assess ABAC controls within the existing process control framework, not as an overlay that duplicates existing audit work.
• Multi-law capability. India's ABAC landscape involves PCA, FCPA, and UKBA — three different legal frameworks with different standards, different defences, and different enforcement authorities. We advise on the requirements of each framework as applied to the specific company's fact pattern — not a generic ABAC checklist that ignores the differences between them.
• Board-ready reporting. Every ABAC risk assessment produces a report designed for audit committee and board presentation — clear, actionable, and candid about the risk exposure the company faces. We do not produce reports that minimise findings to avoid uncomfortable conversations. The purpose of an ABAC risk assessment is to give management and the board an accurate picture.
• Partner-led engagement. Every ABAC engagement is supervised by a CA partner with risk advisory experience. Risk scoring, control gap assessments, and third-party review findings are reviewed at partner level before the report is finalised.

Frequently Asked Questions — Anti-Bribery and Corruption Risk Assessment in India