What ISO 37001 is and why buyers ask for it
ISO 37001 is the international standard for an Anti-Bribery Management System (ABMS). It sets out the measures an organisation can put in place to prevent, detect and respond to bribery — covering its own conduct, that of its staff, and that of the business partners and intermediaries acting on its behalf. It is designed to be practical and proportionate to the bribery risk an organisation actually faces.
The commercial case is strongest where corruption risk is real and scrutinised. Organisations bidding for public contracts, operating in higher-risk markets, or working through agents increasingly need to demonstrate a credible anti-corruption programme — and a certificate from an independent body carries more weight than a policy document. In the India market and in cross-border trade generally, ISO 37001 has become a recognised way to evidence integrity. It is part of the governance-focused ISO Certifications ABS provides.
What the audit covers
Certification is a two-stage assessment that examines how bribery risk is managed, including:
- Bribery risk assessment across operations, markets and relationships
- Anti-bribery policy and leadership commitment
- Due diligence on transactions, projects and business partners
- Controls over gifts, hospitality and donations
- Financial and non-financial controls that reduce opportunity for bribery
- Raising concerns and investigation — including whistleblowing mechanisms
Surveillance audits across the three-year cycle confirm the programme remains active and proportionate to the risks. Evidence of genuine operation, not just documented policy, is what auditors look for.
Transitioning to the 2025 edition
ISO 37001:2025 is the current, second edition, replacing ISO 37001:2016. It introduces a stronger emphasis on anti-bribery culture, renames the “anti-bribery compliance function” to the “anti-bribery function” with a clearer remit, and expects more involvement from the governing body and top management. Organisations certified to the 2016 edition have until February 2027 to transition. We support transition assessments for organisations certified to the 2016 edition — mapping your existing system to the 2025 requirements and closing the gaps.
Typical timeline
For most organisations, ISO 37001 implementation and certification readiness takes around 12–16 weeks from kick-off, depending on the complexity of your operations and the maturity of existing controls. Organisations with significant third-party exposure typically sit at the longer end. Each engagement begins with a fixed-price scoping call and a proposal within 24 hours.
Common questions
Does ISO 37001 certification guarantee that no bribery occurs?
No certification can guarantee that bribery never happens. What ISO 37001 demonstrates is that you have implemented reasonable, internationally recognised measures to prevent, detect and respond to bribery — a distinction regulators in many jurisdictions look on favourably.
Who needs ISO 37001?
Organisations exposed to bribery risk — those operating in higher-risk markets or sectors, bidding for public contracts, or relying on agents and intermediaries — use it to demonstrate integrity to partners, regulators and customers. It is especially relevant in financial services and cross-border trade.
How does ISO 37001 relate to broader compliance management?
ISO 37001 targets bribery specifically, while compliance management standards (such as ISO 37301) cover compliance obligations more broadly. Many organisations run ISO 37001 as a focused, certifiable programme within a wider framework, often alongside quality certification like ISO 9001.
