Two-minute brief
ISO 37001 requirements explained: video brief
A two-minute brief on ISO 37001:2025 and the anti-bribery requirements built into the shared management system structure.
Key takeaways
- The bribery risk assessment sits in clause 4 and is reviewed over time.
- The governing body oversees; top management leads the anti-bribery culture.
- The anti-bribery function needs competence, status, authority and independence.
- Due diligence is applied where the risk calls for it.
- A channel for raising concerns and a route to investigation are required.
Anti-bribery specifics inside a familiar structure
ISO 37001:2025 follows the harmonised structure shared by the ISO management system standards, clauses 4 to 10, and adds the anti-bribery specifics inside it: the bribery risk assessment in clause 4, the governing body, culture and anti-bribery function in clause 5, and a clause 8 that runs from due diligence to investigation. This short film walks through them.
Clause 4 asks you to understand the issues that shape your exposure, including whether climate change is relevant, the interested parties and the scope, and to identify, analyse, prioritise and review the bribery risks you can reasonably anticipate. The evidence is a scope statement naming entities, sites and activities and a documented risk assessment by country, business line, transaction type and business associate category, with existing controls rated against each risk. Clause 5 asks the governing body to oversee, top management to lead and both to promote an anti-bribery culture, with a communicated policy that prohibits bribery and an anti-bribery function with the competence, status, authority and independence to oversee and report.
Requirements are applied in proportion to the bribery risk, so a small exporter and a multinational contractor build very different programmes from the same text.
From due diligence to investigation
Clause 8 turns the risk assessment into operation: due diligence on transactions, projects, business associates and personnel where the risk calls for it, financial and non-financial controls, anti-bribery controls implemented by controlled organisations and business associates, controls on gifts, hospitality and donations, procedures for raising concerns, and investigating and dealing with bribery.
Performance evaluation includes internal audit and reviews by top management, the governing body and the anti-bribery function, and improvement corrects nonconformities. The requirements apply to any organisation, whatever its size, sector or ownership, in proportion to its bribery risk. Certification is assessed and decided by an independent, accredited certification body.
The standard addresses bribery only. Fraud, cartel conduct and money laundering sit outside it unless an organisation chooses to extend its system to cover them.
ISO 37001 at a glance
- Purpose
- Anti-bribery management: reasonable and proportionate measures to prevent, detect and respond to bribery by or against the organisation
- Relevant to
- Public, private and not-for-profit organisations of any size, above all those that tender, use intermediaries or deal with public officials
- Edition
- ISO 37001:2025; certificates to the 2016 edition stay valid only until 28 February 2027
- Certification
- Assessed and decided by an independent, accredited certification body
- Sterling's role
- Risk assessment and implementation with your team, Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO 37001 ABMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months
ISO 37001: questions people ask
Can a small business implement ISO 37001?
Yes. The standard expects measures that are reasonable and proportionate to the bribery risk, so a small organisation with few higher-risk relationships needs a short risk assessment, a clear policy, a few well-placed controls and a way to raise concerns, not a compliance department.
Does ISO 37001 certification guarantee that bribery cannot happen?
No. The standard itself says that conformity cannot provide assurance that bribery has not occurred or will not occur, and no certificate decides a legal case. What a properly implemented system gives you is documented, proportionate procedures and evidence that they operate, which is what procedures-based legal defences, regulators and customers look for.
Is ISO 37001 certification mandatory?
No law requires it in general, although public procurement rules, development-bank projects, group policies and supplier codes increasingly make an anti-bribery programme a condition of doing business. Many organisations implement ISO 37001 with no external demand at all, because the governing body wants evidence rather than assurances.
Does Sterling issue the ISO 37001 certificate?
No. Sterling's role is consulting. The certification audit and the decision are the work of an independent, accredited certification body. Anyone offering to do both is selling paper.
What is the difference between ISO 37001 and ISO 37301?
ISO 37001 is the requirements standard for an anti-bribery management system; ISO 37301 is the requirements standard for a compliance management system covering all of an organisation's compliance obligations. Both are certifiable and use the harmonised structure, so organisations with a wider compliance agenda often implement them together.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO 37001
Start with the ISO 37001 page, or go straight to the guide you need.
On the ISO 37001 page
Guides
- ISO 37001:2025 changes
- ISO 37001 bribery risk assessment
- ISO 37001 case study
- ISO 37001 certification process, step by step
- ISO 37001 certification cost
- ISO 37001 due diligence on business associates
- Effivity ISO 37001 guide
- ISO 37001 gifts and hospitality
- ISO 37001 requirements explained
- ISO 37001 vs ISO 37301
More videos: Governance, risk and resilience
- ISO 37500 guidance explainedTwo-minute brief · 2 min
- How to implement ISO 31000Implementation walkthrough · 3 min 15 s
- ISO 31000 guidelines explainedTwo-minute brief · 2 min
- How to implement ISO 37301Implementation walkthrough · 3 min 15 s
- ISO 37301 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 22301Implementation walkthrough · 3 min 24 s
- ISO 22301 requirements explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO 37001 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice