Anti-Bribery Management System Certification
ISO 37001:2025

2. KEY REQUIREMENTS OF ISO 37001:2025

The requirements in Clauses 4 to 10 form a management cycle covering planning, implementation, evaluation and improvement. Within this cycle, bribery risk assessment provides the basis for selecting and adjusting controls. Leadership commitment, clearly assigned responsibilities and an anti-bribery culture help ensure that the system is implemented consistently in everyday operations.

2.1. Context, scope and bribery risk assessment – Clause 4

The organization needs to identify factors that may affect anti-bribery management, including its structure, decision-making authority, locations, sectors, business model, relationships with business associates and the extent of its interactions with public officials. It also needs to consider entities it controls, entities that exercise control over it, and relevant legal, contractual and other obligations. The scope of the ABMS must be clearly defined and documented.

• Identifying, assessing and prioritizing risks: Identify situations in which bribery may occur; analyse, assess and prioritize risks for action using criteria established by the organization. Activities such as tendering, procurement, sales through agents, licensing procedures, acceptance of work and payments need to be considered in their actual operating context.
• Evaluating existing controls: Assess the suitability of each control and its ability to reduce risk. Use the assessment results to select, supplement or adjust controls and improve the ABMS.
• Reviewing and updating risks: Review risks at planned intervals and when significant changes occur in the organization’s structure or activities, such as entering new markets, undertaking major projects, changing key personnel or changing how agents and intermediaries are used.

2.2. Leadership, culture and anti-bribery responsibilities – Clause 5

Where the organization has a separate governing body, that body is responsible for approving the anti-bribery policy, overseeing implementation and requiring appropriate resources to be allocated. Where there is no separate governing body, top management carries out these responsibilities. Top management has overall responsibility for implementing and complying with the ABMS and integrating anti-bribery requirements into management and operational processes.

• Anti-bribery policy and culture: The policy must prohibit bribery, require compliance with applicable anti-bribery laws, encourage reporting in good faith or on the basis of a reasonable belief, and explain the consequences of violations. Leaders need to demonstrate their commitment through consistent conduct, specific decisions and the way violations are addressed at every level.
• The department or person responsible for anti-bribery: The organization must assign the anti-bribery function to persons with appropriate competence, status and authority. The organization must ensure their independence, provide sufficient resources and enable direct and prompt access to the governing body and top management. This function oversees the design and implementation of the ABMS, ensures conformity with the standard, provides guidance and reports on performance. Managers of individual units remain responsible for applying and complying with the ABMS within their units.
• Delegated decision-making and conflicts of interest: For decisions assessed as involving more than a low bribery risk under the organization’s risk classification criteria, the organization must establish an appropriate decision-making process and levels of authority, ensuring that they are free from actual or potential conflicts of interest. Delegation does not remove management’s responsibilities.

2.3. Objectives, resources, personnel and information – Clauses 6 and 7

The organization must identify risks and opportunities that may affect the results of the ABMS, plan actions and establish anti-bribery objectives. Each objective needs to be linked to responsible persons, resources, deadlines and a method for evaluating results. Objectives must be measurable where practicable, monitored and updated as appropriate. Changes to the system must also be planned before implementation.

• Personnel controls based on risk: For positions exposed to more than a low bribery risk and persons assigned to the anti-bribery function, due diligence is needed before recruitment, transfer or promotion. The organization must periodically review performance targets, bonuses and incentive arrangements to avoid encouraging bribery. Personnel in these groups, top management and the governing body need to confirm their compliance with the policy and the ABMS at intervals proportionate to the risks.
• Awareness and training: Personnel need to understand the policy, their responsibilities, situations in which bribery may occur, how to recognize and respond to them, and how to raise concerns. Awareness and training activities must be appropriate to their roles and risk exposure and provided from the start of employment and at planned intervals. The organization also needs to identify training needs for business associates that pose more than a low bribery risk and act on its behalf or for its benefit.
• Communication and records management: Communicate the policy in languages appropriate to its recipients; control the creation, updating, access, confidentiality and retention of documents and records. Retain evidence of personnel competence and the delivery of awareness and training programmes, including their content, recipients and dates.

2.4. Due diligence and controls over transactions and business associates – Clauses 8.1 to 8.6

Due diligence is the process of collecting and evaluating information to clarify the bribery risks associated with a specific transaction, project, activity, business associate or individual. Where a category of such subjects is assessed as posing more than a low bribery risk, the organization needs to determine the necessary level of due diligence for the subjects within that category and update information at a defined frequency.

• Focused due diligence: Depending on the subject and the risks, due diligence may consider owners and beneficiaries, capacity to perform the work, relationships with public officials, information on previous violations, the justification for services, fees and payment methods. The scope of due diligence needs to be tailored to each case.
• Financial controls: Manage bribery risks in expense approval, payments, accounting records and cash management. Examples include separating responsibility for requesting, approving and making payments; checking supporting documents against the goods or services actually provided; and examining unusual commissions or payments to third parties without a clear justification.
• Non-financial controls: Manage risks in supplier selection, tendering, sales, recruitment, contract performance, legal affairs, mergers and acquisitions, and activities involving regulatory authorities. Measures may include transparent selection criteria, independent review and controls over conflicts of interest.
• Controls in controlled entities and business associates: Require controlled entities to apply the organization’s ABMS or their own anti-bribery controls, as appropriate to the risks. For business associates outside its control that pose more than a low bribery risk, review their anti-bribery controls and, where practicable, require controls to be established or strengthened when these can help reduce the relevant risks.
• Anti-bribery commitments: As far as practicable, require business associates posing more than a low bribery risk to commit to preventing bribery in connection with the transaction, and establish agreements allowing the relationship to be terminated if bribery occurs. Where these requirements cannot be met, the organization must consider the implications in its risk assessment and risk management. The standard does not require every business associate to hold ISO 37001 certification.

2.5. Gifts, benefits and inadequate controls – Clauses 8.7 and 8.8

The organization needs procedures to control the offering, provision or acceptance of gifts, hospitality, donations and similar benefits to prevent bribery. This consideration also needs to cover circumstances in which the conduct could reasonably be perceived as bribery. Control factors may include purpose, value, frequency, timing, recipients, approval authority and records.

ISO 37001 does not prescribe a universal value limit for gifts or benefits applicable to every organization. Even a benefit of low value may be associated with bribery. Unofficial payments to secure or expedite routine procedures to which the payer is entitled (facilitation payments) are treated as bribes under the standard; its guidance recommends prohibiting such payments within the ABMS.

Where due diligence shows that existing controls are insufficient to manage the risks, the organization needs to consider additional controls or changes to the transaction. If it cannot or chooses not to take the necessary measures, it must:

• For new transactions, projects or relationships: Postpone or decline to proceed.
• For existing transactions, projects or relationships: Take appropriate steps to suspend, terminate or withdraw as soon as practicable.

2.6. Reporting concerns, protecting reporters and investigations – Clauses 8.9 and 8.10

The ABMS needs to enable people to report actual, ongoing or suspected bribery, as well as violations and weaknesses in the system. The reporting arrangements must protect confidentiality, allow anonymous reporting and protect those who report in good faith or on the basis of a reasonable belief from retaliation. Applicable legal limitations need to be taken into account.

Reports must be reviewed, verified and investigated where necessary, with the findings used to determine appropriate action. Investigators and the recipients of investigation reports must not belong to the department or hold the role being investigated. The organization needs to give investigators sufficient authority, require cooperation from relevant personnel, protect the confidentiality of the investigation and its results, and report its status and findings to the anti-bribery function and other relevant compliance functions, as appropriate.

2.7. Evaluating effectiveness and improvement – Clauses 9 and 10

The organization must monitor, measure, analyse and evaluate performance to determine whether the ABMS is being maintained and achieving its objectives. Internal audits must be conducted as planned, ensuring objectivity and preventing auditors from auditing their own work. Top management and the governing body review the system in accordance with their assigned responsibilities. The anti-bribery function continually assesses the adequacy of controls and the effectiveness of ABMS implementation, reporting at planned intervals or on an ad hoc basis as needed.

Possible indicators include the percentage of due diligence files completed before transaction approval, training coverage for personnel in positions exposed to risk, the time taken to handle reports and the percentage of corrective actions that achieve their intended results. Few or no reports do not, on their own, demonstrate that the system is working well; the organization also needs to consider whether personnel know about, can use and trust the reporting arrangements.

When a nonconformity is identified, the organization must address the issue and its consequences, analyse the causes, take corrective action and verify the results. This information needs to be used to adjust controls, prevent recurrence and improve the system.

Value and limitations of certification: ISO 37001:2025 certification confirms that the anti-bribery management system meets the standard’s requirements within the assessed scope. Certification does not guarantee that bribery has never occurred or will not occur, nor does it replace the organization’s responsibility to comply with the law. ISO publishes the standard; certification bodies conduct audits and issue certificates. When using and promoting certification, businesses need to state the correct scope and standard edition and comply with the relevant rules.