ISO 37001:2016
ISO 37001 certification for anti-bribery management
Independent certification of the controls your organisation uses to prevent, detect and respond to bribery.
- Valid for
- 3 years
- Surveillance
- Years 1 and 2
- Verification
- Public register
Accredited and empanelled
What is ISO 37001?
ISO 37001 sets requirements for an anti-bribery management system. It helps an organisation prevent, detect and respond to bribery, whether by its own personnel or by business associates acting on its behalf, and applies to bribery in the public, private and not-for-profit sectors.
Its core requirements include an anti-bribery policy, a compliance function with adequate authority and independence, and a bribery risk assessment that sets how far controls go. These lead to due diligence on transactions, business associates and personnel, financial and non-financial controls, rules on gifts, hospitality and donations, and channels for raising concerns without fear of retaliation.
Our certificates reference ISO 37001:2016. The standard has been through a revision that aligns it with the current harmonised structure and adds points such as anti-bribery culture and conflicts of interest; at quotation we confirm which edition your audit uses and how any transition applies.
Who it is for
- Contractors and suppliers to public authorities
- Companies using agents, distributors or joint venture partners abroad
- State-owned enterprises
- Banks and financial institutions
- Pharmaceutical and medical device sales organisations
- Development organisations handling international funds
What sets audit time and cost
Most organisations reach a certification decision ten to fourteen weeks after application; groups with many subsidiaries or high-risk markets may need longer for Stage 2 sampling.
- Number of personnel in scope
- Number and risk of business associates
- Bribery risk of the countries and sectors you operate in
- Number of sites and subsidiaries
- Extent of dealings with public officials
Why it matters
What ISO 37001 gives you
- 01
Evidence of adequate procedures
An audited system shows regulators, prosecutors and partners that bribery controls exist and operate, though it is not a legal defence in itself.
- 02
Better due diligence
Business associates and higher-risk transactions are checked before commitments are made.
- 03
Clear rules for staff
Thresholds and approvals for gifts, hospitality and donations remove guesswork from everyday decisions.
- 04
Concerns raised early
Protected reporting channels and investigation procedures bring issues to light before they escalate.
The audit
What our auditors examine
- 01
Bribery risk assessment
How bribery risks were identified by country, sector, project and business associate, and how often the assessment is reviewed.
- 02
Compliance function
Whether the anti-bribery compliance function has the authority, independence, competence and direct access to the governing body it needs.
- 03
Due diligence
Checks on business associates, transactions and personnel in roles with more than a low bribery risk.
- 04
Financial and non-financial controls
Payment approvals, segregation of duties, procurement controls and contract clauses with business associates.
- 05
Gifts, hospitality and donations
Rules, thresholds and registers for gifts, hospitality, sponsorships and donations.
- 06
Raising concerns and investigation
Reporting channels, protection against retaliation and how reports are investigated and closed.
How certification works
Every accredited certificate follows the same three-year cycle, with each step recorded and the result published in our register.
01
Application and quote
Tell us your scope, sites and headcount. We calculate audit time under the accreditation rules and send a fixed quote and audit plan.
02
Stage 1 audit
We review your documented management system, scope and readiness, and agree the Stage 2 plan. Any gaps are reported so you can close them first.
03
Stage 2 audit
Auditors check that the system works in practice: interviews, records and observation across the scope. Nonconformities are raised in writing.
04
Certification decision
Once corrective actions are accepted, a reviewer who did not take part in the audit makes the decision. Your certificate is issued and listed in the public register.
05
Surveillance audits
Shorter audits in the first and second years after certification confirm the system is maintained and improving. The register shows your current status throughout.
06
Recertification
Before the three-year certificate expires, a recertification audit reviews the whole system and renews the certificate for another cycle.
Related standards and audits
Often certified or audited alongside this one, sometimes in a single combined audit.
ISO certification
ISO 9001
Independent assessment of your quality management system against ISO 9001:2015, by an accredited certification body.
ISO certification
ISO 27001
Independent certification of your information security management system against ISO/IEC 27001:2022.
ISO certification
ISO 28000
Independent certification of how your organisation assesses and controls security risks to its operations and supply chain.
ISO certification
ISO 29001
Independent certification of a sector quality management system for suppliers to the petroleum, petrochemical and natural gas industries.
Industries we audit for
Government and public sector
CERT-In empanelled audits and accredited certification for departments, public sector undertakings and their suppliers.
Banking and fintech
Audits and certifications that support the security evidence regulators, partner banks and payment networks ask for.
Healthcare and life sciences
Quality and information security certification for organisations where patient safety and patient data both matter.
Manufacturing
Accredited certification for the quality, environmental, safety and energy systems customers audit you against.
ISO 37001 questions
We audit; we do not consult.
To keep certification independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.
Plan your ISO 37001 certification
Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.