ISO 37001: ISO 37001 – Tutorial (about 60 minutes)

ISO 37001 is the international standard that sets out the requirements for an anti-bribery management system: a structured, repeatable way for an organisation to prevent bribery, detect it early when it happens anyway, and respond to it properly. Companies that win public contracts, work through agents and distributors abroad, or simply want to show customers and lenders that they take corruption risk seriously use it, and many obtain an independent certificate. After this tutorial you will be able to explain what the standard covers and what it deliberately leaves out, describe its clause structure, run a bribery risk assessment, apply due diligence and controls in proportion to risk, understand how certification audits work, and avoid the mistakes that turn anti-bribery programmes into paperwork.

Free tutorial · about 60 minutes · 7 lessons · 4 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is ISO 37001:2025, Anti-bribery management systems — Requirements with guidance for use, the second edition, prepared by ISO technical committee ISO/TC 309 (Governance of organizations) and published on 28 February 2025. It is a technical revision of ISO 37001:2016, which it cancels and replaces, and it incorporates the 2016 edition's Amendment 1:2024 on climate change. The 2025 edition keeps the same overall structure and core requirements but aligns the text with the latest ISO harmonized structure for management system standards, gives anti-bribery culture its own leadership subclause, defines conflicts of interest more fully and asks for awareness of reporting them, and clarifies the role of the function that runs the system, now called the anti-bribery function (the 2016 edition called it the anti-bribery compliance function). Verified 2026-10-29 against the national standards catalogue of Standards Norway (status "published", edition 2, replacing ISO 37001:2016) and the publication notes of ANSI and PECB; check the ISO catalogue for the official record. Organisations certified to the 2016 edition must move to the 2025 edition within a transition period run through the accreditation system; certification bodies such as DQS and DNV describe it as two years from publication, which DQS puts at 28 February 2027. Confirm the exact deadline with your certification body.

Who it is for: compliance, legal, risk and internal audit professionals; finance, procurement and sales managers; project managers in sectors such as construction, engineering, energy, healthcare and defence; and anyone asked to help "get ISO 37001" without having read the standard.

Prerequisites: none. Some familiarity with another ISO management system standard such as ISO 9001 helps, because the clause layout is the same, but every term is explained here.

By the end of this tutorial:

You will be able to explain what bribery means in ISO 37001 and which forms of bribery the standard covers.
You will be able to describe the clause 4 to 10 structure and where the bribery-specific requirements sit.
You will be able to carry out and document a simple bribery risk assessment.
You will be able to choose proportionate due diligence and controls for personnel, transactions and business associates.
You will be able to explain how concerns are raised, investigated and acted on without retaliation.
You will be able to describe how certification audits work and what a certificate does and does not prove.
You will be able to position ISO 37001 next to ISO 37301, ISO 37002 and anti-bribery laws.

Lesson 1 – Origins, purpose and scope

Why a standard for bribery?

When a contract is won with a bribe, the honest competitor loses the work, the customer overpays or gets a worse product, and in sectors such as construction people can be harmed by unsafe work an inspector was paid to ignore. For the organisation that pays, consequences include prosecution, large fines, exclusion from public tenders and lasting reputational damage. Individual managers can go to prison.

International treaties such as the OECD Anti-Bribery Convention and the United Nations Convention against Corruption (UNCAC) committed states to criminalise bribery, including of foreign public officials. Well-known national laws include the US Foreign Corrupt Practices Act (FCPA), the UK Bribery Act 2010 and France's Sapin II law. Several expect organisations to have effective preventive procedures; the UK Act even makes failing to prevent bribery an offence, with a defence for adequate procedures.

That raised a question for boards: what do "adequate" anti-bribery procedures look like, and how can you show an outsider that you have them? Guidance existed, but no internationally agreed, auditable set of requirements. ISO 37001 filled that gap. Its first edition was published in 2016, drawing heavily on the British standard BS 10500, and it became one of the first management system standards in the area that ISO now calls governance of organisations.

What the standard does

ISO 37001 specifies requirements, and gives guidance, for establishing, implementing, maintaining, reviewing and improving an anti-bribery management system (often shortened to ABMS). A management system is simply the set of policies, processes, roles and records an organisation uses to achieve something consistently. The ABMS can stand alone or be built into an existing management system, for example one for quality or for broader compliance.

The standard is designed to help an organisation do three things: prevent bribery, detect bribery that gets through, and respond to bribery when it occurs. It also helps the organisation meet its anti-bribery legal obligations and any voluntary commitments it has made, such as a code of conduct promised to customers.

Scope: which bribery?

The scope is deliberately broad. It covers bribery in the public, private and not-for-profit sectors, so paying a hospital procurement officer is covered just as much as paying a government customs officer or the purchasing manager of a private retailer. It covers bribery by the organisation itself, by its personnel acting on its behalf or for its benefit, and by its business associates acting on its behalf or for its benefit. It also covers bribery of the organisation and of its personnel or business associates in connection with the organisation's activities — for example, a supplier paying your buyer to choose them. Bribery can be direct or indirect, such as through or by a third party.

Two boundaries matter. First, the standard is about bribery only. It is not a general standard for fraud, cartels and other competition offences, money laundering or other corrupt practices, although an organisation may choose to extend its system to cover them. Second, the standard does not promise that no bribery will ever occur. No system can guarantee that. What it requires is that the organisation takes reasonable and proportionate measures designed to prevent, detect and respond to bribery.

Who uses it

ISO 37001 applies to organisations of any type and size: multinational groups, small family companies, state-owned enterprises, government agencies, universities and charities. The requirements are written to be scaled. A twenty-person firm that sells only in one low-risk market can meet them with a short policy, a simple risk assessment and a handful of controls; a global engineering group working through agents in high-risk countries will need far more. The phrase you will meet again and again in this tutorial is "reasonable and proportionate", always judged against the bribery risks the organisation actually faces.

Lesson 2 – Key concepts and vocabulary

ISO 37001 uses the common vocabulary of ISO management system standards plus a set of anti-bribery terms. The definitions below are paraphrased; the standard's own clause 3 contains the formal wording.

Bribery – any offer, promise, payment, request or acceptance of an undue advantage, large or small, in money or in kind, made directly or through someone else and in any country, which breaks the applicable law and is meant to induce or reward a person for doing, or not doing, something connected with their duties. The advantage does not have to be cash: a job for a relative, a holiday or a donation can qualify.
Anti-bribery management system (ABMS) – the policies, objectives, processes, roles and records an organisation uses to prevent, detect and respond to bribery.
Organisation – the person or group with its own functions, responsibilities and authorities that implements the ABMS; the scope defines which parts are included.
Governing body – the group or body with ultimate responsibility and authority for the organisation's activities, governance and policies, such as a board of directors or supervisory board, to which top management reports. Not every organisation has one separate from top management.
Top management – the person or group who directs and controls the organisation at the highest level, such as the chief executive and the executive team.
Personnel – everyone who works inside the organisation, from directors and officers to permanent and temporary employees and volunteers.
Business associate – any outside party the organisation does business with or intends to: for example customers, suppliers, contractors and sub-contractors, consultants and advisers, joint venture and consortium partners, and agents, distributors and other intermediaries.
Public official – a person holding a legislative, administrative or judicial office, or exercising a public function, including people working for state-owned enterprises and public international organisations, and candidates for public office.
Third party – a person or body that is independent of the organisation.
Anti-bribery function – the person or team responsible for running the ABMS day to day, who needs suitable competence, status, authority and independence. The 2016 edition called it the anti-bribery compliance function, and many organisations still use that name.
Bribery risk assessment – the documented, periodic process of identifying the bribery risks the organisation can reasonably anticipate, analysing and prioritising them, and evaluating whether existing controls are suitable and effective.
Due diligence – a process to further assess the nature and extent of bribery risk, helping the organisation decide about specific transactions, projects, activities, business associates and personnel.
Conflict of interest – a situation where business, financial, family, political or personal interests could interfere with a person's judgement in carrying out their duties for the organisation. The 2025 edition defines it more fully and expects personnel to be made aware that they must report potential and actual conflicts.
Anti-bribery culture – the values, ethics, beliefs and behaviour throughout the organisation that support preventing bribery. Since 2025 it has its own subclause under leadership (clause 5), making its promotion an explicit requirement.
Facilitation payment – an unofficial, improper payment made to a public official to secure or speed up a routine or necessary action, such as clearing goods through customs. The standard's guidance treats such payments as a form of bribery that should be prohibited, even though a few laws have historically tolerated them.
Raising concerns – the procedures that let people report attempted, suspected or actual bribery, or weaknesses in the ABMS, in good faith or on the basis of a reasonable belief, in confidence and without fear of retaliation.

The two directions of bribery

A key idea in ISO 37001 is that bribery can flow in both directions. "Outbound" bribery is bribery paid by or for the organisation to win or keep business. "Inbound" bribery is bribery paid to the organisation's people, usually to influence what they buy, approve or overlook. Both are within scope, but the controls differ: preventing outbound bribery leans on sales, finance and third-party controls, while preventing inbound bribery leans on procurement controls, segregation of duties and conflict of interest rules.

Figure 1 – The forms of bribery in scope: outbound bribery by the organisation, its personnel and its business associates, and inbound bribery of its own people.

"Reasonable and proportionate"

Almost every operational requirement is qualified by risk. Due diligence must be proportionate; controls must be reasonable; the standard allows the organisation to apply simpler measures where bribery risk is low and stronger measures where it is high. This is not a loophole. It is how the standard keeps the effort focused where bribery is most likely, instead of spreading identical paperwork over everything. The flip side is that the organisation must be able to explain, from its risk assessment, why it chose the measures it did.

Lesson 3 – Structure of the standard

ISO 37001 follows the ISO harmonized structure shared by ISO 9001 (quality), ISO 14001 (environment), ISO/IEC 27001 (information security), ISO 37301 (compliance) and many others. Clauses 0 to 3 are introductory; clauses 4 to 10 contain the requirements; an informative Annex A gives guidance on implementing them. The common structure is why organisations can combine several management systems into one integrated system with shared processes for document control, internal audit and management review.

Clauses 0 to 3

The introduction (clause 0) explains why bribery matters and what the standard can and cannot achieve. Clause 1 sets out the scope described in Lesson 1. Clause 2 is reserved for normative references, and there are none. Clause 3 defines the terms used throughout.

Clause 4 – Context of the organisation

The organisation must understand the internal and external issues relevant to its purpose that affect its ability to achieve the ABMS's objectives. Since the 2024 amendment, now built into the 2025 text, it must also consider whether climate change is a relevant issue, and recognise that interested parties may have climate-related requirements. It identifies interested parties and their requirements — regulators, customers, lenders, employees, shareholders — and defines the scope of the ABMS. Clause 4 also contains the requirement that is the engine of the whole system: the bribery risk assessment (clause 4.5). Placing it in clause 4 signals that everything that follows is built on an understanding of the organisation's actual bribery risks.

Clause 5 – Leadership

Leadership requirements are split between the governing body, if there is one, and top management. The governing body approves the anti-bribery policy, makes sure the strategy and policy are aligned, receives information about the ABMS at planned intervals, requires adequate resources, and exercises reasonable oversight. Top management carries the operational responsibility: making sure the system is set up, integrated into business processes, resourced, communicated, and actually working, and promoting the right behaviour. The 2025 edition adds an explicit requirement to develop, maintain and promote an anti-bribery culture throughout the organisation.

Clause 5 also requires an anti-bribery policy, defined roles and authorities, the anti-bribery function, and controls on delegated decision-making so that people who are given authority to make decisions with bribery risk act within an appropriate process with oversight.

Clause 6 – Planning

The organisation plans actions to address the risks and opportunities identified in clause 4, sets measurable anti-bribery objectives at relevant functions and levels (for example "complete due diligence on all high-risk agents before contract signature"), and, in the 2025 text aligned with the harmonized structure, plans changes to the system in a controlled way.

Clause 7 – Support

Support covers resources, competence, awareness, training, communication and documented information. Two bribery-specific parts stand out. The employment process must include controls such as screening of people who will hold positions with more than a low bribery risk, a requirement for personnel to comply with the policy, and the ability to discipline those who do not. Bonuses and performance targets must be reviewed so that they do not encourage bribery. Awareness and training must be appropriate to each role and must also be considered for business associates who pose more than a low risk.

Clause 8 – Operation

Clause 8 contains most of the anti-bribery controls. It requires operational planning and control, due diligence, financial controls, non-financial controls (for example in procurement, sales and project management), implementation of controls by controlled organisations and business associates, anti-bribery commitments from business associates, rules on gifts, hospitality, donations and similar benefits, a process for dealing with situations where controls are inadequate, procedures for raising concerns, and procedures for investigating and dealing with bribery.

Clause 9 – Performance evaluation

The organisation monitors and measures the ABMS, runs internal audits, and holds management reviews by top management and reviews by the governing body. A bribery-specific addition is the review by the anti-bribery function, which must continually assess whether the system is adequate and effectively implemented and report to top management and the governing body.

Clause 10 – Improvement

When a nonconformity occurs — a requirement not met — the organisation reacts, finds the cause, takes corrective action and checks that it worked. It also continually improves the suitability, adequacy and effectiveness of the ABMS.

Annex A – Guidance

Annex A is informative — it adds no requirements — but it explains "reasonable and proportionate", due diligence, gifts and hospitality, facilitation and extortion payments, and conflicts of interest. Many implementers read it alongside each clause.

Figure 2 – How clauses 4 to 10 form a Plan-Do-Check-Act loop, with the bribery risk assessment at the start and improvement feeding back into it.

Lesson 4 – How it works in practice

This lesson walks through the main building blocks in the order most organisations implement them. The order is not mandated, but it follows the logic of the standard: risk first, then commitment, then controls, then checking.

Step 1 – Define the scope

Decide which legal entities, sites, activities and countries are inside the ABMS. A narrow scope (for example one subsidiary) is acceptable if it is honest and clearly stated, but a scope that excludes the riskiest activity — say, the export sales team that uses agents — undermines the value of the whole system and will be challenged by stakeholders and auditors.

Step 2 – Assess bribery risk

The bribery risk assessment asks: where could bribery reasonably happen in our business, how likely is it, how severe would it be, and how well do our current controls address it? Typical risk factors include the countries the organisation operates in (corruption perception indices are a common, if imperfect, input), the sector (extractives, construction, defence and healthcare are traditionally higher risk), the type of transaction (public tenders, licences, permits, customs), the use of intermediaries, interactions with public officials, and the size and complexity of projects. The organisation sets criteria for evaluating its level of risk, documents the assessment and keeps it current — reviewing it periodically and whenever there is a significant change, such as entering a new market or making an acquisition.

The output is not a ranking for its own sake. It decides where due diligence is needed, which controls are strong enough, and where people need more training. In ISO 37001 language, activities, business associates and positions are often sorted into "low" bribery risk and "more than low" bribery risk, because several requirements apply specifically to the latter.

Step 3 – Commit at the top and write the policy

The anti-bribery policy must prohibit bribery, require compliance with applicable anti-bribery laws, encourage raising concerns in good faith or on the basis of reasonable belief, explain the authority and independence of the anti-bribery function, explain the consequences of not complying, and commit to meeting ABMS requirements and to continual improvement. It must be appropriate to the organisation's purpose, available as documented information, communicated in suitable languages to personnel and business associates who pose more than a low risk, and available to relevant interested parties.

Leadership commitment must be visible: what convinces staff is a chief executive who walks away from a deal because an agent's fee looks suspicious.

Step 4 – Appoint the anti-bribery function

Someone must own the system day to day. The anti-bribery function oversees design and implementation, gives advice and guidance to personnel, makes sure the ABMS meets the standard, and reports on performance to top management and the governing body. It must have adequate resources, the right competence, sufficient status in the organisation and appropriate independence. In particular, it needs direct and prompt access to the governing body (if there is one) and top management when an issue or concern about bribery arises. In a small company this may be a part-time role held by a senior manager; in a large group it may be a team. Parts of the work can be outsourced, but top management keeps responsibility and oversight.

Step 5 – Build the people controls

For all personnel, employment conditions should require compliance with the policy and the ABMS, and the organisation must be able to take disciplinary action. For positions exposed to more than a low bribery risk — such as sales staff dealing with public customers, buyers, or people approving payments — the organisation applies extra measures: due diligence before appointment or promotion, periodic declarations of compliance with the policy, and a review of bonuses and targets so that pay does not reward results that could only be achieved through bribery. Training is tailored: a general module for everyone, and deeper, scenario-based sessions for higher-risk roles.

Step 6 – Due diligence on transactions and business associates

Due diligence is the organisation's way of looking before it leaps. Before engaging an agent, entering a joint venture, acquiring a company or bidding for a large public contract in a high-risk country, the organisation gathers enough information to judge the bribery risk. Typical questions include: Who really owns and controls this party? Are any owners or managers public officials or related to them? Is the proposed fee in line with the market and the service? Does the party have the qualifications and resources to do the work? Is there adverse media or a history of enforcement? Will they accept anti-bribery commitments and audit rights?

The depth of due diligence follows risk. A well-known global logistics company with a strong compliance record may need only a questionnaire and a database check; a newly formed consultancy proposed by a customs official's cousin needs much more, and may not be acceptable at all. Due diligence is also refreshed periodically, because relationships change.

Figure 3 – A risk-based due diligence path for business associates: the depth of checks and the controls required grow with the bribery risk.

Step 7 – Financial and non-financial controls

Financial controls make bribery harder to pay and easier to spot: segregation of duties so one person cannot both raise and approve a payment, tiered approvals, two signatures for larger payments, confirming services were received before paying, restricting cash, and correct classification in the accounts. Non-financial controls cover procurement, sales, human resources and other activities: pre-qualifying contractors, checking that services are necessary and legitimate, fair and transparent tendering, and protecting tender information.

Step 8 – Gifts, hospitality, donations and similar benefits

Gifts and hospitality are a normal part of business in many cultures, but they can be used to disguise bribes. The standard requires procedures designed to prevent the offering, provision or acceptance of gifts, hospitality, donations and similar benefits where they could reasonably be perceived as bribery. Typical procedures set value limits, ban cash and cash equivalents, require approval and recording above a threshold, apply stricter rules for public officials and during tenders, and cover charitable donations, sponsorships, political contributions, and travel paid for third parties. The test that matters is not only "is it lavish?" but "could a reasonable observer see it as an inducement?" — timing and context matter as much as value.

Step 9 – Controlled organisations and business associates

Where the organisation controls another organisation (for example a majority-owned subsidiary or joint venture), it must require that organisation to implement reasonable and proportionate anti-bribery controls, either as part of the same ABMS or its own. Where a business associate that poses more than a low risk is not controlled, the organisation considers whether the associate has suitable controls of its own and, where practicable, requires anti-bribery commitments in the contract — a commitment to prevent bribery, and the right for the organisation to terminate the relationship if bribery occurs.

Step 10 – When controls are not enough

Sometimes due diligence reveals that the risk cannot be managed by the existing controls. The organisation must then take steps to deal with it: terminate, suspend or withdraw from the transaction or relationship as soon as practicable, or, where that is not possible, apply extra controls. The key behaviour is not to sign first and worry later.

Step 11 – Raising concerns and investigating

Prevention will never be perfect, so detection matters. The organisation must provide procedures for raising concerns that encourage and enable people to report attempted, suspected or actual bribery, or any violation or weakness in the ABMS. Reports must be treated confidentially (allowing anonymous reporting where appropriate), and the organisation must prohibit retaliation and protect people who report in good faith or on reasonable belief. Guidance on whistleblowing systems is available in ISO 37002.

Every report that suggests bribery must be assessed and, where appropriate, investigated by people who are competent and independent of the matter under investigation. Investigations lead to action: stopping the conduct, disciplinary measures, improvements to controls, and — depending on the law and the organisation's decision — reporting to the authorities. Investigation results are reported to the anti-bribery function and, as appropriate, to top management and the governing body.

Figure 4 – From a raised concern to action: protection, assessment, independent investigation, response and improvement of the controls.

Step 12 – Monitor, audit and review

The organisation decides what to monitor and measure — for example the share of high-risk agents with completed due diligence, training completion rates for exposed roles, gifts register entries, the number and type of concerns raised, and the time taken to close investigations. Internal audits check whether the ABMS conforms to the standard and to the organisation's own requirements and whether it is effectively implemented. Auditors must be competent and objective, so they cannot audit their own work. Top management reviews the system at planned intervals, and the governing body reviews it based on reports from top management and the anti-bribery function. The anti-bribery function's own continual assessment closes the loop.

Throughout, keep documented information — the ISO term for documents and records. Records of due diligence and approvals are often what lets an organisation show, years later, that a payment was legitimate.

Lesson 5 – Assessment, certification and compliance

Ways to demonstrate conformity

Because ISO 37001 contains requirements ("shall" statements), conformity can be assessed. There are three broad options. An organisation can make a self-declaration based on its own internal audits. It can ask an interested party, such as a major customer, to assess it (second-party assessment). Or it can engage an independent certification body (third-party certification), which is the option most organisations choose when they want external recognition.

Accredited certification

Certification bodies should themselves be accredited by a national accreditation body to show that they are competent and impartial. Accreditation for management system certification is based on ISO/IEC 17021-1, and for anti-bribery management systems there is a specific supplement, ISO/IEC TS 17021-9, which sets competence requirements for those who audit and certify ABMS. When choosing a certification body, check that its accreditation covers ISO 37001 and that its auditors understand your sector and countries.

The certification cycle

Certification follows the usual management system pattern. A stage 1 audit reviews the design of the system: scope, risk assessment, policy, documented information and readiness. A stage 2 audit then examines whether the system is implemented and effective, using interviews, document sampling and observation — for example tracing a sample of agent contracts back to their due diligence files and approvals. If the audit finds major nonconformities, these must be corrected before a certificate is issued. A certificate is normally valid for three years, with surveillance audits at least once a year and a recertification audit before expiry. Throughout, the organisation must keep the system working, not just prepare for audit days.

What certification proves — and what it does not

A certificate shows that, on the evidence sampled, an independent auditor found the organisation's ABMS to conform to ISO 37001. It is a valuable signal to customers, lenders and partners, and many public and private buyers now ask for it or award points for it in tenders. But a certificate does not guarantee that bribery will never occur, and it is not by itself a legal defence: under laws such as the UK Bribery Act, courts and prosecutors judge whether procedures were adequate from the facts. A well-run ABMS is strong evidence of serious effort, not an automatic safe harbour.

Common audit focus areas

Auditors tend to probe whether the risk assessment is specific to the business, whether the anti-bribery function is genuinely independent, whether due diligence happens before contracts are signed, whether gifts records match the procedure, and whether internal audits and reviews lead to actions that are followed up.

Moving to the 2025 edition

Organisations certified to ISO 37001:2016 need to update their systems and be audited against the 2025 edition within the transition period set through the accreditation system. Typical gap work includes documenting how the organisation develops and promotes an anti-bribery culture, revisiting conflict of interest rules and awareness so that personnel know they must report potential and actual conflicts, reviewing the role description of the anti-bribery function (renamed from "anti-bribery compliance function"), adding climate change to the context analysis where relevant, and aligning wording such as "planning of changes" with the harmonized structure. Certification bodies expect the impact on a well-run system to be small.

Lesson 6 – Worked example

This example follows a fictional but realistic company through its first year with ISO 37001. Names and figures are invented for teaching.

The organisation

Harbourline Pumps is a 650-person manufacturer of industrial pumps and water treatment equipment, headquartered in one European country with a factory there and sales offices in three other countries. About 40 % of revenue comes from public tenders for municipal water utilities, partly in markets where the company uses local sales agents and distributors. A large customer, a development-bank-funded utility, has announced that from next year it will give extra tender points to suppliers with an anti-bribery management system certified to ISO 37001. The board decides to implement the standard.

Month 1 – Scope and leadership

The board, acting as governing body, approves a project and asks the chief executive to lead it. They choose a scope that covers the whole group, including the export sales channel, because excluding it would exclude the main risk. The chief executive appoints the head of legal as anti-bribery compliance officer, part-time, supported by an analyst. To give the role independence, the board resolves that she has a direct reporting line to the board's audit committee, can escalate concerns without going through the chief executive, and cannot be dismissed from the role without board approval.

Months 1–2 – Bribery risk assessment

The compliance officer runs workshops with sales, procurement, finance, logistics and the country managers. Together they list the situations where bribery could reasonably happen. The top risks they identify are: agents in two export markets passing part of their commission to utility officials; site engineers being offered "inspection fees" to approve installations; customs clearance delays in one country, where facilitation payments are commonly requested; procurement staff accepting kickbacks from casting suppliers; and hospitality for utility delegations visiting the factory. Each risk is rated for likelihood and impact using criteria the board has approved, and existing controls are assessed. The highest-rated risk is the agents.

Month 2 – Policy and objectives

The board approves a two-page anti-bribery policy in the four working languages. It prohibits bribery including facilitation payments, explains how to raise concerns and the protection against retaliation, describes the compliance officer's authority, and states that breaches lead to disciplinary action. Objectives for the first year include: due diligence completed and approved for every active agent within six months; anti-bribery training completed by all staff in positions with more than a low bribery risk within four months; and a gifts and hospitality register in use in all offices.

Months 2–4 – People controls and training

Human resources identifies 85 positions exposed to more than a low bribery risk, including all sales staff, buyers, site engineers and payment approvers. New hires into these roles now undergo background checks, and existing holders sign an annual declaration of compliance. The sales bonus scheme is reviewed: it previously paid a large bonus solely on won tender value. It is changed so that part of the bonus depends on compliance behaviours, such as completing due diligence before agent engagement, and a bonus can be withheld if compliance procedures are breached. Everyone completes a short online module; the 85 exposed staff attend a half-day workshop built around realistic dilemmas, including what to do when a customs officer asks for a "speed fee".

Months 3–6 – Due diligence on agents

Harbourline has 14 active agents. The compliance team sends each a questionnaire on ownership, links to public officials, other clients and anti-bribery controls, runs database and adverse media checks, and compares commission rates with market norms. Eleven agents are cleared with standard contract updates. Two need enhanced checks: one has a director who is the brother-in-law of a regional water official, and another asks for its commission to be paid to a bank account in a third country. After further inquiries, the first agent agrees to remove the related director from any dealings with that region, and the relationship is approved with extra monitoring. The second cannot give a credible business reason for the offshore account and the relationship is ended. The fourteenth agent has been inactive for two years and is formally terminated. All approved agents sign new contracts with anti-bribery commitments, audit rights and termination clauses.

Months 3–6 – Financial and non-financial controls

Finance introduces a rule that agent commissions are paid only to an account in the agent's own name in the country where the services are performed, only against an invoice describing the services, and only after the sales manager confirms delivery. Payments above a threshold need two approvers. Procurement introduces a requirement for three quotes for casting purchases above a set value, rotates buyers between supplier categories every two years, and requires buyers to declare potential conflicts of interest annually and whenever a new one arises. For customs, logistics uses a reputable broker, plans for normal clearance times, and is told that a delayed shipment is acceptable while a facilitation payment is not; a demand made under threat to personal safety must be reported immediately.

Months 4–6 – Gifts, hospitality and concerns

A gifts and hospitality procedure sets a low value limit for gifts, bans cash, requires prior approval for any hospitality for public officials, and forbids hospitality for utility staff while a tender is open. Factory visits by utility delegations are limited to reasonable travel and meals directly related to the technical inspection, paid directly to the travel provider and recorded. An external hotline provider is contracted so that concerns can be raised in all four languages, anonymously if the reporter wishes. In month 7, an anonymous report says that a buyer is receiving payments from a casting supplier. An internal auditor with no link to procurement investigates and finds that the buyer had an undeclared financial interest in the supplier. The buyer is dismissed, the supplier's contracts are reviewed, and conflict declarations are now cross-checked against supplier ownership data.

Months 8–10 – Checking

Internal audit, using two trained auditors who were not involved in designing the controls, audits each clause. They find that the gifts register is used inconsistently in one sales office and that two site engineers missed the workshop. Corrective actions are raised and closed. The compliance officer reports to the audit committee on the objectives, the hotline case and the audit results. Top management holds a management review, and the board reviews the system and approves an updated risk assessment that now includes a new market the company plans to enter.

Months 11–12 – Certification

Harbourline selects an accredited certification body whose accreditation scope includes ISO 37001. At stage 1 the auditor asks for clarification of how the compliance officer's part-time role is protected from conflicts with her legal duties; the board's terms of reference are updated. At stage 2 the auditor samples agent files, payment approvals, gifts records, training records and the hotline case file, interviews staff in two countries and finds one minor nonconformity about the frequency of due diligence refresh. Harbourline corrects it and receives its certificate. The board is clear that the certificate is a beginning, not an end.

Lesson 7 – Relationship to other standards and frameworks

ISO 37001 sits in a family of governance and compliance standards and in a landscape of laws and international conventions. Knowing the neighbours helps you decide what to combine and what not to duplicate.

Within ISO's governance family

ISO 37000 gives guidance on the governance of organisations, describing principles for governing bodies. ISO 37301 specifies requirements for a compliance management system covering all of an organisation's compliance obligations, from data protection to export controls. ISO 37002 gives guidelines for whistleblowing management systems. ISO 37001 is the specialised, bribery-focused member. An organisation that already runs ISO 37301 can integrate ISO 37001 as a bribery module, and the shared harmonized structure makes this practical.

Other management system standards

ISO 9001 (quality), ISO 14001 (environment) and ISO/IEC 27001 (information security) share the same clause structure, so document control, internal audit, management review and corrective action can be run once for all. ISO 31000 offers general risk management guidance that can inform the bribery risk assessment method, and ISO 19011 gives guidance on auditing management systems that internal auditors can use.

Laws and conventions

The standard does not replace law. Anti-bribery laws such as the FCPA, the UK Bribery Act and Sapin II define offences and penalties, and official guidance such as the UK Ministry of Justice's guidance on adequate procedures or the US Department of Justice's guidance on evaluating corporate compliance programmes describes what prosecutors expect. ISO 37001 translates those expectations into an auditable management system. Where a law is stricter than the organisation's procedures, the law wins.

Standard or framework	What it is	Certifiable?	Relationship to ISO 37001
ISO 37301	Requirements for a compliance management system covering all compliance obligations	Yes	Broader umbrella; ISO 37001 can be integrated as the bribery-specific part
ISO 37002	Guidelines for whistleblowing management systems	No (guidance)	Helps design the raising-concerns and investigation processes
ISO 37000	Guidance on the governance of organisations	No (guidance)	Frames the governing body's oversight role that ISO 37001 requires
ISO 31000	Guidelines for risk management	No (guidance)	Method source for the bribery risk assessment
ISO 9001	Requirements for a quality management system	Yes	Same harmonized structure; common processes can be shared
ISO/IEC TS 17021-9	Competence requirements for auditing and certifying ABMS	Used for accreditation	Applies to certification bodies, not to the organisation
UK Bribery Act 2010, FCPA, Sapin II	National anti-bribery laws	Not applicable (law)	Define offences; ISO 37001 helps build the procedures they expect

Integrating does not mean merging everything into one generic procedure: the best integrated systems share the management machinery and keep the bribery controls specific.

Common pitfalls and best practices

Pitfalls to avoid:

A generic risk assessment – copying a template that lists "corruption" as a single risk, instead of naming the real situations, people and markets where bribery could happen.
Excluding the riskiest activity from scope – certifying the head office while the overseas sales agents stay outside the system.
An anti-bribery function without independence – an officer who reports only to the executive whose results they must challenge, with no route to the governing body.
Due diligence after the event – signing the agent contract first and collecting questionnaires later, or never refreshing them.
Incentives that reward bribery – sales bonuses based only on won contract value, with no compliance conditions.
A silent hotline – a reporting channel nobody knows about or trusts, so zero reports are taken as proof that all is well.
Treating the certificate as the goal – a system that comes alive for audit days and is ignored in between.

Best practices:

Start from real scenarios – build the risk assessment in workshops with the people who face the risks, and update it after incidents and business changes.
Make leadership visible – the chief executive and board talk about why bribery is unacceptable and act consistently when it costs business.
Scale controls to risk – light checks for low-risk relationships, deep due diligence and contract protections for intermediaries in high-risk settings.
Put controls into the payment path – commission rules, account checks and dual approvals in the finance system, not only in a policy document.
Train with dilemmas – use realistic cases for exposed roles, including how to refuse a request politely and whom to call.
Protect and thank reporters – confidential and anonymous channels, a clear no-retaliation rule, and feedback when a case is closed.
Measure and learn – track a few meaningful indicators and use audits, investigations and reviews to improve the controls each year.

Summary and key takeaways

ISO 37001:2025 is the current, second edition of the international requirements standard for anti-bribery management systems, replacing the 2016 edition.
It covers bribery in public, private and not-for-profit sectors, by and of the organisation, its personnel and its business associates, directly or through third parties — and only bribery.
It follows the harmonized clause 4 to 10 structure, so it can be integrated with ISO 9001, ISO 37301 and other management systems.
The bribery risk assessment drives everything: scope, due diligence, controls, training and objectives must all be proportionate to the risks found.
Leadership must be visible, an anti-bribery culture must be promoted, and an independent, competent anti-bribery function must have direct access to top management and the governing body.
Core operational controls include due diligence, financial and non-financial controls, commitments from business associates, gifts and hospitality rules, raising concerns without retaliation, and investigations.
Accredited third-party certification is available and widely requested, but a certificate is neither a guarantee that bribery cannot happen nor an automatic legal defence.

Reflection questions

Think of your own organisation or one you know well. Where could outbound bribery most plausibly happen, and where could inbound bribery happen? Which would you rate higher, and why?
Your company wants to keep the ABMS scope to its head office for the first certification. What arguments would you give the board for and against, and what would you recommend?
Design a short due diligence approach for three different business associates: a global courier, a newly formed local consultancy, and a joint venture partner. How and why do the checks differ?
How would you tell whether your organisation's reporting channel is trusted? Which indicators would you track, and what would you do if no concerns were raised for two years?
Your sales director argues that tightening agent controls will lose contracts to competitors who pay bribes. How would you respond, using what you have learned about risk, law and leadership?