ISO 37001 Anti-Bribery Management System Certification
ISO 37001 gives a board something a code of conduct never could: independently audited evidence that anti-bribery controls exist and work. In enforcement terms, that is the difference between a policy and a defence.
4.9/5 average client rating · 500+ engagements delivered
What the standard requires
ISO 37001 is built on proportionality: your controls must be sized to your actual bribery risk, which you establish through a documented risk assessment covering geography, sector, transaction type, business partners and public official interaction.
It requires an anti-bribery compliance function with authority and independence, and it explicitly covers bribery by and of the organisation, its personnel and its business associates — including agents, consultants, distributors and joint venture partners.
- Bribery risk assessment across operations, geographies and third-party relationships
- Anti-bribery policy, governing body commitment and an independent compliance function
- Due diligence on personnel, business associates, projects and transactions, scaled to risk
- Financial and non-financial controls, including approvals, segregation of duties and procurement controls
- Gifts, hospitality, donations, sponsorship and facilitation payment rules
- Raising concerns (whistleblowing), investigation procedure and non-retaliation protection
Key facts
| Standard | ISO 37001 Anti-Bribery Management Systems |
|---|---|
| Key roles | Anti-bribery compliance function with direct access to the governing body |
| Core method | Bribery risk assessment driving proportionate due diligence and financial/non-financial controls |
| Typical timeline | 10–16 weeks |
| Supports | UK Bribery Act adequate procedures, US FCPA compliance programme expectations, Prevention of Corruption Act (India) |
What we implement
A working programme with real due diligence files and real training records — auditors look for both.
Bribery risk assessment
Documented methodology across country, sector, transaction, partner and public official exposure, refreshed periodically.
Due diligence framework
Tiered screening for third parties, sanctions and PEP checks, red-flag escalation and approval workflow.
Policy & control set
Anti-bribery policy, gifts and hospitality thresholds, donation and sponsorship rules, and facilitation payment prohibition.
Financial controls
Approval matrices, segregation of duties, expense and petty cash controls, and procurement integrity checks.
Speak-up system
Confidential reporting channel, case management, investigation protocol and non-retaliation safeguards.
Training & attestation
Risk-based training for staff and business associates, with attestation records and refresher cycles.
Who certifies
Organisations with exposure to public procurement, high-risk jurisdictions, agents and intermediaries — or whose multinational customers demand it.
- Infrastructure, EPC and construction companies bidding public tenders
- Pharmaceutical, medical device and healthcare organisations engaging practitioners
- Defence, aerospace, energy and extractive industry suppliers
- Companies operating through agents, distributors or consultants in higher-risk markets
- Financial services and professional services firms with regulatory compliance obligations
Enforcement mitigation
Evidence of adequate procedures is central to defence and to prosecutorial credit under UK, US and Indian regimes.
Tender qualification
Increasingly a prerequisite in public procurement and multinational supplier onboarding.
Third-party control
Structured due diligence surfaces the intermediary risk that most organisations cannot currently see.
Board assurance
Independent certification gives directors documented comfort on a personal liability risk.
How the engagement runs
Risk assessment
Exposure mapping across geographies, business lines, third parties and public sector interfaces.
Programme design
Policy suite, compliance function mandate, control thresholds and due diligence tiers proportionate to risk.
Deployment
Third-party screening rollout, contract clauses, training and speak-up channel launch.
Monitoring & investigation
Testing of controls, case handling protocol and management reporting to the governing body.
Certification
Internal audit, management review and accredited certification body audit support.
What you receive
- Documented bribery risk assessment and risk register
- Anti-bribery policy and compliance function charter
- Third-party due diligence procedure with tiering and red-flag criteria
- Gifts, hospitality, donations and sponsorship registers and thresholds
- Anti-bribery contract clauses and business associate attestations
- Whistleblowing channel, investigation protocol and case management records
- Training programme, attestation log, internal audit and certification support
ISO 37001 — frequently asked questions
No, and the standard says so explicitly. It attests that a management system designed to prevent, detect and respond to bribery is in place and operating. That is exactly what regulators assess when deciding whether an organisation had adequate procedures.
The Act’s six adequate procedures principles — proportionate procedures, top-level commitment, risk assessment, due diligence, communication and training, and monitoring and review — align closely with the standard’s clauses. Certification produces the documentary evidence those principles require.
Yes. Business associates are the highest-risk channel in most bribery cases. The standard requires risk-based due diligence, contractual anti-bribery commitments and, where risk is significant, training and audit rights over those parties.
A person or team with appropriate competence, authority and independence, with direct access to the governing body. In smaller organisations it is often the company secretary, general counsel or a senior finance leader — but it cannot report solely to someone whose targets it may need to challenge.
Yes. It follows the same Annex SL structure, so context, leadership, internal audit and management review can be run once across all management systems, with only the anti-bribery specific controls audited separately.
Still not sure what applies to you?
Ask an assessor directly — we answer scoping questions before anyone talks about a fee.
Get a realistic timeline and a fixed fee
A 30-minute call is usually enough to scope ISO 37001 accurately. You will leave with a timeline, an evidence checklist and a number — whether or not you engage us.