Implementation walkthrough
How to implement ISO 37001: video walkthrough
A walkthrough of implementing an ISO 37001 anti-bribery management system, from the bribery risk assessment to controls proportionate to the risks you actually face.
Key takeaways
- ISO 37001 covers bribery only; other financial crime is outside unless you extend it.
- Business associates acting on your behalf fall within the system.
- The bribery risk assessment drives proportionate controls.
- An anti-bribery function needs the authority and independence to oversee and report.
- Certificates to the 2016 edition stay valid only until 28 February 2027.
An anti-bribery programme that stands up to scrutiny
ISO 37001 is the international standard for anti-bribery management systems. It sets requirements, with guidance, for a system to prevent, detect and respond to bribery in the public, private and not-for-profit sectors: bribery by your organisation, your personnel or business associates acting on your behalf, bribery of them, direct or indirect. It addresses bribery only; fraud, cartel conduct and money laundering are outside it unless you choose to extend the system.
The question for a board is uncomfortable but simple: could a payment, a gift, a donation or a well-connected agent secure an advantage for or from your organisation without anyone being obliged to notice? ISO 37001 answers with measures that are reasonable and proportionate to the bribery risks you face. This short film walks through how those measures are put in place.
The ISO 37001 implementation path
Define what the certificate must cover: the entities, sites and activities, the categories of business associate in scope, who the governing body is and what the tender or regulator expects. A gap analysis then tests the existing policy, due diligence, financial controls and reporting channel against the standard, keeps what works and agrees actions, owners, dates and resources.
Next comes the bribery risk assessment, by country, business line, transaction type and business associate category, followed by controls proportionate to the risks it finds: a policy prohibiting bribery, an anti-bribery function with the authority and independence to oversee, due diligence, financial and non-financial controls, a channel for raising concerns and a route to investigation. Internal audit and management review test the system before an independent, accredited certification body audits it and decides.
Sterling's expert and experienced consultants carry out the risk assessment with your leadership and build the controls under Sterling OS™, with the evidence held in Effivity. The current edition is ISO 37001:2025, and certificates to the 2016 edition stay valid only until 28 February 2027.
ISO 37001 at a glance
- Purpose
- Anti-bribery management: reasonable and proportionate measures to prevent, detect and respond to bribery by or against the organisation
- Relevant to
- Public, private and not-for-profit organisations of any size, above all those that tender, use intermediaries or deal with public officials
- Edition
- ISO 37001:2025; certificates to the 2016 edition stay valid only until 28 February 2027
- Certification
- Assessed and decided by an independent, accredited certification body
- Sterling's role
- Risk assessment and implementation with your team, Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO 37001 ABMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months
ISO 37001: questions people ask
Can a small business implement ISO 37001?
Yes. The standard expects measures that are reasonable and proportionate to the bribery risk, so a small organisation with few higher-risk relationships needs a short risk assessment, a clear policy, a few well-placed controls and a way to raise concerns, not a compliance department.
Does ISO 37001 certification guarantee that bribery cannot happen?
No. The standard itself says that conformity cannot provide assurance that bribery has not occurred or will not occur, and no certificate decides a legal case. What a properly implemented system gives you is documented, proportionate procedures and evidence that they operate, which is what procedures-based legal defences, regulators and customers look for.
Is ISO 37001 certification mandatory?
No law requires it in general, although public procurement rules, development-bank projects, group policies and supplier codes increasingly make an anti-bribery programme a condition of doing business. Many organisations implement ISO 37001 with no external demand at all, because the governing body wants evidence rather than assurances.
Does Sterling issue the ISO 37001 certificate?
No. Sterling's role is consulting. The certification audit and the decision are the work of an independent, accredited certification body. Anyone offering to do both is selling paper.
What is the difference between ISO 37001 and ISO 37301?
ISO 37001 is the requirements standard for an anti-bribery management system; ISO 37301 is the requirements standard for a compliance management system covering all of an organisation's compliance obligations. Both are certifiable and use the harmonised structure, so organisations with a wider compliance agenda often implement them together.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO 37001
Start with the ISO 37001 page, or go straight to the guide you need.
On the ISO 37001 page
Guides
- ISO 37001:2025 changes
- ISO 37001 bribery risk assessment
- ISO 37001 case study
- ISO 37001 certification process, step by step
- ISO 37001 certification cost
- ISO 37001 due diligence on business associates
- Effivity ISO 37001 guide
- ISO 37001 gifts and hospitality
- ISO 37001 requirements explained
- ISO 37001 vs ISO 37301
More videos: Governance, risk and resilience
- ISO 37500 guidance explainedTwo-minute brief · 2 min
- How to implement ISO 31000Implementation walkthrough · 3 min 15 s
- ISO 31000 guidelines explainedTwo-minute brief · 2 min
- How to implement ISO 37301Implementation walkthrough · 3 min 15 s
- ISO 37301 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 22301Implementation walkthrough · 3 min 24 s
- ISO 22301 requirements explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO 37001 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice