I don’t think that’s exactly enough for serious things, like Anti-Money-Laundering or Bribery in finance. The company also needs to make be able to prove they (

I don’t think that’s exactly enough for serious things, like Anti-Money-Laundering or Bribery in finance. The company also needs to make be able to prove they (1) actually implemented reasonable policies to prevent it (e.g. having access controls, educating employees on relevant legislation, etc.) and (2) make sure that they’re not just avoiding the problem (e.g. by telling employees not to do it but then not investigating, or by hiring another local company to do the bribing).