ISO 37001 anti-bribery management system certification

What ISO 37001 certification covers

ISO 37001 sets the requirements for an anti-bribery management system. It covers bribery in all its forms: offered or received, direct or through third parties, involving public officials or private companies. It applies to any organization, but it is most often asked for in public procurement, construction, energy, defence, healthcare and companies with agents and intermediaries in many countries.

The audit looks at how you assess bribery risk and the controls that follow from it. That includes the anti-bribery policy, a compliance function with enough independence and authority, due diligence on higher-risk transactions, business associates and staff in sensitive positions, controls on gifts, hospitality, donations and sponsorships, financial and non-financial controls, and a channel for raising concerns without fear of retaliation.

ISO 37001 cannot promise that no bribery will ever happen. What it asks for, and what the auditor checks, are reasonable and proportionate measures designed to prevent, detect and respond to it.

• Stage 1 review of the bribery risk assessment, policy and documented system
• Stage 2 audit of controls, due diligence, training and investigations
• Certification decision and three-year certificate
• Certificate listed on our verification portal
• Yearly surveillance audits and recertification

The standard also expects the governing body, such as the board, to oversee the system. The auditor checks that the board receives anti-bribery information and acts on it, not only that management has approved a policy.

Choosing the scope and the audit format

Some organizations certify the whole company; others start with the business units or countries where bribery risk is highest. The scope should be honest about where the risk sits. A scope that leaves out the sales office in a high-risk market while covering the head office is unlikely to convince buyers.

Much of the ISO 37001 audit is document review and interviews: risk assessment, due diligence files, gift registers, finance controls, training records and investigation files. These suit online auditing well. For larger organizations or higher-risk operations, interviews in person at key sites can add value, and we discuss this when we quote.

ISO 37001 shares the high-level structure of other management system standards and fits closely with ISO 37301 for compliance management. Many organizations run anti-bribery inside a wider compliance management system and certify both together.

Group structures need care. If subsidiaries or joint ventures fall outside the scope, the standard still expects you to consider the bribery risk they create for the certified organization, for example through shared agents or intercompany payments.

What decides the price

ISO 37001 certification with EUROTECH starts at $800. Audit time depends on the size and risk profile of what is in scope.

• Number of people in scope, with attention to staff in sensitive roles
• Countries and sites where you operate or use agents
• Business associates: agents, distributors, joint venture partners and subcontractors
• Exposure to public officials through tenders, licences, permits or customs
• Integration with ISO 37301 or other management systems

We confirm audit days and all fees in a written quote. A clear register of business associates with their risk ratings and due diligence status saves audit time.

Organizations with many intermediaries, such as agents paid on commission in several countries, usually need more audit time, because due diligence and payment controls are sampled for a representative number of them.