Skip to content


Harry Cassin
Publisher and Editor

Andy Spalding
Senior Editor

Jessica Tillipman
Senior Editor

Bill Steinman
Senior Editor

Richard L. Cassin
Editor at Large

Elizabeth K. Spahn
Editor Emeritus

Cody Worthington
Contributing Editor

Julie DiMauro
Contributing Editor

Thomas Fox
Contributing Editor

Marc Alain Bohn
Contributing Editor

Bill Waite
Contributing Editor

Shruti J. Shah
Contributing Editor

Russell A. Stamets
Contributing Editor

Richard Bistrong
Contributing Editor

Eric Carlson
Contributing Editor

Resource Alert: The TRACE Bribery Risk Matrix

One of the main components of a comprehensive anti-bribery risk assessment is evaluating the risks pertaining to a given country. Both the FCPA Guidance and the UK Bribery Act 2010 Guidance highlight country risk as one of the key areas that should be addressed when conducting an assessment.

But measuring business bribery risk without the right tool can be a perilous exercise. Relying on perceived levels of overall corruption represented by a single number, as provided by indices such as Transparency International’s Corruption Perceptions Index (CPI), can result in an incomplete picture of the risk to businesses in any particular country, causing companies to under- or over-invest in compliance. Conducting a more accurate assessment of country risk requires companies to understand the factors that affect their likelihood of encountering bribe demands, as well as where significant corruption problems may lie.

The TRACE Bribery Risk Matrix (TRACE Matrix), originally published in 2014, was developed to provide the compliance community with more reliable, nuanced information about the risks of commercial bribery worldwide.

Perception based indices tend to group bribe demands from teachers or doctors with those of customs officials and regulators, when in fact the prevalence of the different demands may vary considerably. This makes the information less applicable to companies.

The TRACE Matrix aggregates relevant data obtained from leading public interest and international organizations, including the United Nations, the World Bank and the World Economic Forum, and provides a total of fourteen risk scores per country.

Each country is assigned not only an overall risk score between 1 and 100 — with 100 representing the greatest risk — but also scores for each of the four domains and nine subdomains. This allows companies to understand what is driving the overall risk score in order to analyze the information in the context of their unique risk profile and specific deals.

Based on a conceptual framework that reflects the nature of business bribery risk, the TRACE Matrix helps companies examine the conditions that allow commercial bribery to flourish. The four domains are:

(1) business interactions with the government

(2) anti-bribery laws and enforcement

(3) government and civil service transparency, and

(4) the capacity for civil society oversight.

The first domain reflects the risks associated with business interactions with government agencies, including three subdomains measuring the frequency of government interaction, the degree to which bribery is expected and tolerated in such interactions and the overall regulatory burden.

The second domain measures a country’s legal infrastructure related to combatting bribery with two subdomains that reflect the quality and enforcement of anti-bribery laws.

Domain three addresses the attributes of government administration, relying in particular on measures of transparency with respect to the government budget and potential financial conflicts.

The fourth domain captures the role played by non-government actors in monitoring and controlling corruption, including the critical role of the media and the ability of civil society to expose corruption.

By aggregating this data at a domain and subdomain level, the TRACE Matrix brings more granularity and precision to the risk assessment process. Companies can use the domain and subdomain scores to understand where they are vulnerable to business bribery risks based on the nature of their particular business activities and to make better resource allocation decisions.

Drawing on the 2017 TRACE Matrix scores for Italy and Brazil, one can see how this works in practice.

Italy ranks 43rd among 200 countries in the TRACE Matrix, with an overall risk score of 34, placing it in a “low” risk category. Its scores across the four domains are: 42 (domain 1), 60 (domain 2), 22 (domain 3) and 23 (domain 4). Italy scores well in domains three and four but its relatively high score for domain two points to a lack of effective national anti-corruption efforts, and an elevated score of 59 in subdomain 1.2 (expectation of paying bribes) could indicate that bribery is fairly common and institutionalized. This information coupled with a company’s extent of interaction with government, third party relationships and other factors, might encourage a company to adopt more comprehensive anti-bribery measures than they typically would for a low risk country.

Brazil, which ranks 129th, is considered moderate risk, with an overall risk score of 54, primarily due to comparatively low scores in domains three and four. High risk scores in domain 1 and subdomains 1.2 and 1.3, however, point to a high expectation of bribes and very high regulatory burden. Accordingly, companies in industries with a high degree of government interaction should be prepared to build more time into obtaining necessary clearances, licenses, and other regulatory approvals lawfully and may also consider leveraging e-government mechanisms to reduce the number of opportunities for bribe demands.

*     *     *

While the scale and complexity of corruption in any given country is impossible to measure with complete accuracy, the TRACE Matrix provides the most nuanced and detailed model available.

More importantly it provides greater insight into the specific nature of business bribery risk worldwide by including additional information on the risk factors within a given country. With this information, users can examine the domain and subdomain scores and assess them in the context of their company’s own characteristics and business activities, resulting in a more thoughtful and defensible risk assessment strategy.

The TRACE Matrix is free to use and is publicly available at


Virna Di Palma is a Senior Director at TRACE, an anti-bribery business organization and leading provider of third party risk management solutions. She helps companies leverage TRACE tools and resources to reduce compliance costs. She’s a member of the Basel Institute’s International Centre for Collective Action (ICCA) Steering Committee and active participant in the United Nations Global Compact. She can be contacted here.

Share this post


Comments are closed for this article!