ISO 37001 certificationAnti-Bribery Management

Not automatically. Section 7 of the Act provides a defence if an organisation had adequate procedures to prevent bribery by associated persons. Certification shows that an independent body has assessed your anti-bribery system against ISO 37001, which can form part of the evidence of adequate procedures. Whether the defence succeeds is decided by the courts on the facts of each case.

The second edition was published in February 2025, replacing the 2016 edition and its 2024 climate change amendment. Changes reported include greater emphasis on anti-bribery culture, clarification of the anti-bribery compliance function, and alignment with the current Harmonized Structure, including consideration of climate change under clause 4.1. Organisations certified to the 2016 edition will need to transition.

Transition periods for new editions are set by the accreditation community and normally run for a defined period from publication, during which certificates to the older edition remain valid. We will confirm the applicable deadline and plan a transition audit, usually alongside a surveillance or recertification visit. Contact us to discuss timing for your organisation.

ISO 37001 specifically addresses bribery. It does not cover fraud, money laundering, competition law or other forms of corruption, although many of its controls overlap with them. Organisations wanting a broader compliance framework often use ISO 37301 compliance management systems alongside it. Separate legal obligations, such as UK failure to prevent fraud rules, need their own consideration.

It is the person or people with responsibility and authority to oversee the design and implementation of the anti-bribery management system, advise personnel, and report to top management and the governing body. It must have adequate resources, competence, status and independence. In smaller organisations it can be a part-time role held by someone with other duties.

No. Due diligence must be proportionate to the bribery risk assessed. Lower-risk business associates may need little or no due diligence, while agents, intermediaries, joint venture partners or suppliers in high-risk jurisdictions need more detailed checks. Your risk assessment should explain how you decide the level of due diligence for each category.

Yes. The standard is designed to be applied proportionately according to size, structure, sector, jurisdictions and the nature of bribery risks. A small business with limited international activity will have simpler controls than a multinational contractor. Auditors assess whether your measures are reasonable and proportionate for your circumstances, not whether they match those of larger organisations.

No. ISO/IEC 17021-1 prevents certification bodies from designing or implementing the systems they certify. You can develop your anti-bribery management system internally, with legal advisers or with an independent consultant. We can offer an optional pre-assessment that gives an impartial view of readiness against ISO 37001.