ISO 37001 · Anti-bribery management systems
ISO 37001 certification consulting for an anti-bribery programme that stands up to scrutiny.
Get ISO 37001 certified by an independent, accredited body, first time, on your timeline. Sterling's expert and experienced consultants assess your bribery risks with your leadership, build controls proportionate to those risks, prepare the evidence and stay with you through the certification audit and after it, in 60+ countries. We ensure successful certification for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced anti-bribery and compliance consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
8,100+ client engagements in 60+ countries.
ISO 37001 client experience
What it is
What is ISO 37001 and what is it used for?
ISO 37001 is the international standard for anti-bribery management systems. It sets requirements, with guidance, for establishing, implementing, maintaining, reviewing and improving a system to prevent, detect and respond to bribery. It covers bribery in the public, private and not-for-profit sectors, bribery by your organisation, your personnel or your business associates acting on your behalf, bribery of them, and bribery that is direct or indirect; but it addresses bribery only. Fraud, cartel conduct and money-laundering are outside it unless you choose to extend your system to them.
The useful question for a board is uncomfortable but simple: could a payment, a gift, a donation or a well-connected agent secure an advantage for or from your organisation without anyone being obliged to notice? ISO 37001 answers it with measures that are reasonable and proportionate to the bribery risks you actually face, from a documented risk assessment and a policy the governing body owns to due diligence, gifts and hospitality controls, a channel for raising concerns and a way of investigating what is raised. The standard is candid that conformity cannot provide assurance that bribery has not occurred or will not occur. What certification shows is that you took proportionate, verifiable steps, which is what regulators, prosecutors, customers and lenders ask to see.
Current edition. ISO 37001:2025, the second edition, was published in February 2025 and replaces ISO 37001:2016 and its 2024 climate-change amendment. The structure and core requirements are retained; the main changes are subclauses on climate change and on anti-bribery culture, an explicit treatment of conflicts of interest, a clarified anti-bribery function, harmonised wording and the latest harmonised structure. The transition requirements issued in October 2025 by the international accreditation cooperation, whose role has since passed to Global ACI, set a two-year period ending 28 February 2027: certificates to the 2016 edition are not valid after that date, and since 31 August 2026 initial and recertification audits are conducted only to the 2025 edition. The transition is assessed at a surveillance audit, at recertification or in a separate audit, on the timetable your certification body confirms. ISO 37001:2025: what changes and how to transition
Who it is for
Who needs ISO 37001 certification?
ISO 37001 is written for any organisation, whatever its size, sector or ownership, and its requirements are applied in proportion to the bribery risk. The certificate's scope should name the activities, locations and entities you want covered, including controlled organisations. Organisations come to Sterling for ISO 37001 from four starting points:
- A tender, a prequalification questionnaire or a customer's supplier code asks about your anti-bribery programme. Public procurement, development-bank projects and corporate supplier programmes want more than a signed code of conduct. A certificate with the right scope answers in one line.
- You win or deliver work through intermediaries, or you deal with public officials. Agents, distributors, joint-venture partners and the permits, inspections and approvals your operation depends on are where bribery risk concentrates. The standard's due diligence, commitments and controls are built for them.
- A law, a regulator, a parent company or an investor expects procedures you can evidence. Several jurisdictions hold organisations liable for bribery by people acting on their behalf and treat adequate, proportionate procedures as the defence; group functions and lenders ask for the same. ISO 37001 gives the programme a recognised shape and an independent check.
- You hold a 2016 certificate, or a policy nobody follows. The transition to ISO 37001:2025 closes on 28 February 2027. Or the code of conduct is on the intranet while the gifts register is empty and due diligence is a signature on a form. The system needs rebuilding around the risks and decisions that occur.
Results depend on the tone the governing body sets and on controls used in real transactions, not on the certificate alone.
Business benefits
How ISO 37001 protects the business and the people who run it
An anti-bribery system should make the right decision the easy one for the people who face the risk: the sales lead negotiating through an agent, the site manager waiting for a permit. We start with the transactions where a bribe could plausibly change an outcome and build the controls around them.
- A defence you can evidenceRisk assessment, due diligence files, approvals, training records and a working speak-up channel: the file that shows adequate, proportionate procedures when a regulator, prosecutor or customer asks.
- Tenders you are eligible forPrequalification questions about anti-bribery answered with a certificate whose scope covers the entities and activities being assessed, not with assurances.
- Fewer surprises from third partiesAgents, distributors and partners screened in proportion to their risk, bound by anti-bribery commitments and monitored, so an intermediary's conduct does not become your liability.
- Decisions that are documentedDelegated authority, approval thresholds for gifts, hospitality, donations and sponsorships, and financial controls that make an unusual payment visible before it is made.
- Concerns raised earlyA confidential channel people trust, protection from retaliation and investigations that reach conclusions, so problems surface internally rather than in the press.
- Oversight the board can rely onAn anti-bribery function with the authority and access to report, reviews by top management and the governing body, and measures that show whether the programme works.
Choose a few measures that reflect these priorities, such as higher-risk business associates with current due diligence, concerns raised and time to close them, and review whether the system changes behaviour. A thicker policy manual is not a business result.
Requirements
What are the main ISO 37001 requirements?
ISO 37001:2025 follows the harmonised structure shared by the ISO management system standards, clauses 4 to 10, and adds the anti-bribery specifics inside it: the bribery risk assessment in clause 4, the governing body, culture and anti-bribery function in clause 5, and a clause 8 that runs from due diligence to investigation. The table is a plain-language map; your implementation is checked against the standard, clause by clause, during the programme.
| Clause | What it requires of you | What it looks like in practice |
|---|---|---|
| 4 Context of the organisation, with 4.5 bribery risk assessment | Understand the issues that shape your exposure, including whether climate change is relevant, the interested parties and the scope; identify, analyse, prioritise and review the bribery risks you can reasonably anticipate | A scope statement naming entities, sites and activities; a documented risk assessment by country, business line, transaction type and business associate category, with existing controls rated against each risk |
| 5 Leadership, with 5.1.3 anti-bribery culture and 5.3.2 the anti-bribery function | The governing body oversees, top management leads and both promote an anti-bribery culture; a communicated policy that prohibits bribery; an anti-bribery function with the competence, status, authority and independence to oversee and report; controlled delegation of decisions | Board minutes, a policy acknowledged by personnel and business associates, a function with direct access to the governing body and top management, an authority matrix |
| 6 Planning | Act on the risks and opportunities the assessment reveals, set measurable anti-bribery objectives and plan changes to the system deliberately | Objectives with owners, measures and dates; a record of how changes to structure, markets or partners were assessed before being made |
| 7 Support, with 7.2.2 the employment process and 7.3 awareness and training | Competent people; an employment process that checks personnel in higher-risk roles, keeps incentives from encouraging bribery and makes conflicts of interest reportable; awareness and training for personnel and, where the risk warrants, business associates; controlled documented information | Screening and conflict-of-interest declarations for roles that carry risk, training by role with records, business associates briefed on your policy, controlled documents |
| 8.1 to 8.2 Operational planning and control, due diligence | Plan and control the processes that carry bribery risk, and carry out due diligence on the transactions, projects, business associates and personnel in the categories your assessment rates above low risk | Risk-tiered due diligence on agents, distributors, suppliers and partners, refreshed on a schedule, with the analysis on file, not only the conclusion |
| 8.3 to 8.4 Financial and non-financial controls | Financial controls that make improper payments hard to make and easy to see; non-financial controls over procurement, operations, sales and commercial activity that close the routes bribery takes | Segregation of duties, approval thresholds, payment verification, competitive procurement, contract terms and cash controls, each traceable to a risk |
| 8.5 to 8.6 Controls by controlled organisations and business associates, anti-bribery commitments | Ensure controlled entities apply the system or equivalent controls, require higher-risk business associates to apply reasonable controls, and obtain anti-bribery commitments from them where the risk justifies it | Group entities in scope with local evidence, contract clauses and signed commitments, and a record of what was done when one could not be obtained |
| 8.7 to 8.8 Gifts, hospitality, donations and similar benefits; managing inadequacy of controls | Procedures that stop gifts, hospitality, donations, sponsorships and similar benefits being offered or accepted as bribes, and a route for acting when due diligence or monitoring shows a control is inadequate | A register with thresholds, approvals and refusals, rules for public officials, and documented decisions to exit, suspend or add controls to a relationship that fails the test |
| 8.9 to 8.10 Raising concerns, investigating and dealing with bribery | Channels for reporting suspected bribery in good faith, with confidentiality, protection from retaliation and awareness that they exist; investigation and appropriate action where bribery is suspected or found | A speak-up channel personnel and business associates know about, case records with an independent investigator, outcomes reported to the anti-bribery function and management |
| 9 Performance evaluation, with 9.4 review by the anti-bribery function | Monitor and measure the system, audit it internally with objective and impartial auditors, review it at top management and governing body level, and have the anti-bribery function assess its adequacy and effectiveness and report | Dashboards, an audit programme weighted to risk, management review minutes with decisions, and the function's periodic report to the governing body |
| 10 Improvement | Improve the system continually and act on nonconformities, including those that surface through concerns and investigations, with corrective action that removes the cause | Corrective actions closed with evidence, and lessons from cases fed back into the risk assessment, the training and the controls |
What does useful ISO 37001 evidence look like?
A bribery risk assessment that names real countries, partners and transaction types; due diligence files with the analysis and the decision; a gifts and hospitality register with approvals and refusals; signed commitments from higher-risk business associates; training records by role; speak-up cases with outcomes; and the anti-bribery function's report to the governing body. We help identify the records your risks require, without creating documents to fill folders, and they live in Effivity from the first workshop so the auditor sees a system that runs.
ISO 37001 requirements explained, clause by clauseCertification process
How do you get ISO 37001 certified?
Implement a working system first. Then an independent certification body audits it. Sterling supports your organisation through the risk assessment, preparation and implementation; the certification decision belongs to the certification body, and that separation is what makes an anti-bribery certificate worth having.
- 01Define what the certificate must cover.Confirm entities, sites, activities, the categories of business associate in scope, who the governing body is and what the tender or regulator expects.
- 02Gap analysis: review the current programme against the requirements.The gap analysis tests the existing policy, due diligence, financial controls and reporting channel against the standard, keeps what works and agrees actions, owners, dates and resources.
- 03Assess the bribery risks and implement proportionate controls.The risk assessment drives what follows: the policy, the anti-bribery function, due diligence, gifts and hospitality rules, commitments from business associates, training and the speak-up channel.
- 04Operate, audit, review and address the findings.Controls run in live transactions long enough to produce records; internal audit, the function's review and management review test them; findings are raised by us first and closed with evidence.
- 05Go through the independent assessment.The certification body's Stage 1 readiness review and Stage 2 audit; findings answered, then its decision.
- 06Keep the system running after certification.Due diligence refreshes, training, monitoring, internal audits and reviews continue, alongside the body's surveillance audits and three-yearly recertification.
Judge the credibility of the route, not only the quoted price. Ask for the certification body's identity, whether its accreditation covers anti-bribery management systems, the proposed scope and the audit arrangements, and verify them with the bodies concerned. Be cautious of "no implementation, no audit" offers: an anti-bribery certificate that fails a tender committee's or a regulator's check leaves the exposure unresolved. How to choose a credible ISO 37001 provider · The certification buyer's checklist
Cost
How much does ISO 37001 certification cost?
There is no useful universal price for ISO 37001 implementation. A domestic service firm with a dozen suppliers needs a different programme from a contractor bidding through agents in six countries; the number and risk profile of your business associates moves the effort more than headcount does. What we can promise is a proposal that shows every component and states everything that is included.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Maturity of the existing programme, number of entities and countries, the volume and risk of business associates, the deliverables and how much of the work your team takes on (Design™ or Drive™) |
| Independent certification | The certification body's audit days, locations, travel and the annual surveillance arrangements |
| Internal resources | Time of the anti-bribery function and of process owners, due diligence effort, training, corrective work and any operational changes |
| Software and learning | Included in a Sterling engagement: Effivity for the system and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, due diligence cycles, system upkeep, refresher learning and future transitions under Sustain™ |
What moves the price
- How many business associates you have, and how many are higher risk
- Countries, public-sector exposure and controlled entities in scope
- Whether a compliance programme exists today, and how much of it is evidenced
- The deadline, and how much of the work your team can carry
- Languages, group reporting lines and customer or lender requirements
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Certification-body fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does ISO 37001 certification take?
The realistic timeline depends on your starting point, the size of your business associate base, how quickly the governing body can decide, and the certification body's schedule. It is measured in months, not days, typically four to eight: due diligence has to be performed, training delivered, and an internal audit and a management review held before an auditor can see a system that operates. The plan is built around that evidence, with milestones your team tracks in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to the governing body, management, legal, finance and sales, and to existing policies, contracts and records |
| Bribery risk assessment and build | The number of countries, business lines and business associate categories to assess, decisions on thresholds and delegated authority, and approval times |
| Operation and evidence | Due diligence completed on the higher-risk population, training delivered, the register in use, then internal audit, the function's review and management review |
| Certification assessment | The certification body's availability, Stage 1 and Stage 2 scheduling, and the time needed to address any findings |
If you have a tender or a regulator's deadline, share it at the start. We will say what is achievable and which decisions cannot wait. A promised certificate date given before anyone has looked at your business associates is not a project plan; it is a sales tactic.
Challenges
Common ISO 37001 implementation challenges
Most ISO 37001 programmes stall for the same five reasons. Each has a practical answer.
The policy exists; the controls do not.
A code of conduct and a training slide are not a management system. We start from the risk assessment and build only the controls those risks justify: due diligence tiers, approval thresholds, commitments and a reporting channel, each owned by the function that runs the transaction.
Due diligence on hundreds of business associates looks impossible.
It is not meant to be done on all of them equally. The risk assessment sets the categories that warrant due diligence and the depth is proportionate to the risk; Effivity holds the register, questionnaires and refresh dates, so the work is spread across the year.
The anti-bribery function is one person with no time and no authority.
Agree the role, its reporting line to the governing body and top management, and its resources. Design™ gives that person the structure and coaching to run the system; Drive™ has Sterling carry the agreed consulting and documentation work.
Sales incentives and local gifting customs pull the other way.
Review bonuses and targets for the pressure they create, set gift and hospitality thresholds that reflect local practice without excusing it, and give people a fast approval route. A control people can use beats a prohibition they route around.
You need to transition a 2016 certificate before February 2027.
Review the 2025 changes against your system, close the differences and coordinate the transition audit with your certification body. The effective parts of your system are kept.
Your engagement
What your ISO 37001 engagement includes
Your agreed scope brings together everything a functioning anti-bribery system and a prepared organisation need: the whole journey, from one team, under one all-inclusive proposal, rather than a policy set you assemble the rest around.
Scope, gap analysis, bribery risk assessment and implementation plan
With responsibilities, dates and decision owners, agreed with the governing body and top management before work starts.
Policies, procedures and controls
Anti-bribery policy, due diligence, financial and non-financial controls, gifts and hospitality, commitments, raising concerns and investigations, on Sterling's own template sets, built with your process owners.
Effivity ISO & GRC software
Your ABMS runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit, function review and management review
Conducted or facilitated as agreed, with findings closed with evidence before the certification body arrives.
Certification readiness and support
Stage 1 and Stage 2 preparation, and support until the certificate is in your hands.
Certification decisions remain with the independent certification body.
How we deliver
How Sterling supports your ISO 37001 implementation
Every ISO 37001 engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. Pick the level of support your internal capacity allows; the method, the software and the accountability do not change.
- 01Design™Guided implementation: your anti-bribery function and process owners implement with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants take on the agreed consulting and documentation work with your process owners.
- 03Sustain™Post-certification operation: due diligence refreshes, surveillance readiness, internal audits, refreshers and new-hire training, year after year.
- 04Automate™The ABMS running in Effivity: risk assessment, business associate register, gifts and hospitality, concerns, audits, actions and management review in one workspace.
- 05Revise™Transitions to revised editions, such as ISO 37001:2025, and changes in entities, markets, business associates or regulation.
At the start we agree the engagement team, the weekly working session, the deliverables and the decision owners. During delivery, progress is reviewed against those commitments so gaps are visible early, not at Stage 1.
How Sterling OS™ worksOften combined with
Standards organisations pair with ISO 37001
- ISO 37301ISO 37301 certification consulting: one compliance management system for your obligations and commitments, with evidence ready for an accredited audit.
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
- COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
- FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
Effivity · ISO 37001 ABMS software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO 37001:2025.
Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries, is part of every Sterling ISO 37001 engagement. Your consultant configures the ABMS workspace within the agreed scope, so the risk assessment, the business associate register and due diligence files, the gifts and hospitality register, training records, concerns, investigations, internal audits and management review live in one place, the system runs in daily work and the certification auditor reviews a live system rather than a binder. For Sterling consulting clients the Effivity subscription is included with the engagement, at no additional cost.
Context, scope and the bribery risk assessment
The scope statement, the issues and interested parties, and the risk assessment by country, business line and business associate category, with existing controls rated against each risk and a review date, so it stays current between audits.
Policy, governing body oversight and the anti-bribery function
The anti-bribery policy with its distribution and acknowledgements, the delegated-authority matrix, and the anti-bribery function's reports to top management and the governing body.
Objectives, actions and planned changes
Anti-bribery objectives with measures, owners and dates; actions from the risk assessment tracked to closure; changes to entities, markets or partners assessed and recorded before they happen.
Competence, training and documented information
Screening and conflict-of-interest declarations for roles that carry risk, training by role for personnel and business associates in scope, linked to Sterling Academy; documents with versions, approvals and distribution.
Due diligence, business associates, gifts and hospitality
The business associate register with risk tier, questionnaires, findings, decisions, commitments and refresh dates; the gifts, hospitality and donations register with thresholds, approvals and refusals.
Raising concerns and investigations
Concerns logged with confidentiality controls, case files with the investigator, the evidence, the outcome and the actions taken, reported to the anti-bribery function and management without a separate spreadsheet.
Monitoring, internal audit and management review
Audit programmes weighted to risk, findings and follow-up; KPIs on live dashboards; the function's periodic review and a management review that records its inputs, decisions and actions.
Nonconformity and corrective action
Raised, investigated and closed with root cause and the evidence that the action worked; recurring issues visible to management before they become a finding.
What this means at the audit
The certification auditor asks for the bribery risk assessment, the due diligence files for higher-risk business associates, the gifts and hospitality register, the training records, the concerns log, the internal audit programme and the last management review. In Effivity each is a screen, with dates, owners and evidence attached, not a folder somebody assembles the week before Stage 1. After certification, Sustain™ continues in the same workspace, so each surveillance audit finds a system that kept running.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your registers, due diligence files and policies migrated, not retyped
- Admin and user training for your team
- Modules for compliance, information security, quality and more when you integrate other standards
ISO 37001 client experience
Client letters on file, available on request.
Signed client letters for ISO 37001 are available on request. The client feedback wall lists every letter by standard.
Programmes with ISO 37001 in scope
How an integrated compliance programme runs.
- 01Read the case study
Multinational group: one anti-bribery system across every business unit
A group operating globally through business units and subsidiaries needed to manage bribery risk consistently. Its ISO 37001 anti-bribery management system set a firm basis to prevent bribery, detect it and respond to it, reducing exposure to costly violations, and applied the same controls and due diligence in every unit, lowering operational and reputational exposure. Its chief compliance officer said managing bribery risk is now part of everyday business, protecting the group's reputation and long-term growth.
Sterling Academy · ISO 37001 e-learning
Train every employee on ISO 37001, not just the compliance team.
Sterling Academy trains the whole workforce and the people who run the anti-bribery system online: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion per learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- ISO 37001 awareness for every employee, with the awareness evidence the standard requires
- Practitioner courses for the anti-bribery function, process owners and the people who approve gifts and business associates
- Internal auditor training for the people who will audit the system, as applicable to your standard, as part of the engagement
- Learner progress by department and a training status report for the certification auditor
- New hires and new business associates trained as they arrive, so evidence stays current
- A Sterling consultant reachable when a learner needs one
Sterling Academy courses for an ISO 37001 programme
The courses your people take, and who takes them.
ISO 37001 Awareness
What bribery is in the standard's terms, what the policy asks of each person, how gifts, hospitality, conflicts of interest and third parties are handled, and how to raise a concern. The awareness evidence for the whole workforce.
View the courseDocumented Information Management
Creating, controlling and retaining the policies, registers and due diligence records an anti-bribery system depends on, so evidence stays usable and audit-ready.
View the courseNonconformity Management
Raising, investigating and closing nonconformities, including those that surface through concerns and audits, root cause and corrective action, and the evidence that shows a fix worked.
View the courseRisk Management
Identifying, analysing, prioritising and treating bribery risks by country, business line, transaction and business associate, with the documented assessment, ownership and review that clauses 4.5 and 6.1 expect.
View the courseInternal auditor training
Delivered by your Sterling consultant for the people who will audit the anti-bribery system, with practical exercises on your own due diligence files, registers and approvals, and a Certificate of Competence.
Integrating other standards?
Awareness courses for ISO 9001, ISO/IEC 27001, ISO 14001, ISO 45001, ISO 22000 and HACCP, ISO 13485 and more, so an integrated system trains one workforce on one platform.
See all coursesConsulting clients arrange access through their Sterling consultant. Academy certificates evidence training; certification of your anti-bribery management system stays with the independent certification body.
Where we work
Where Sterling delivers ISO 37001
- ISO 37001 in Australia
- ISO 37001 in Austria
- ISO 37001 in Bahrain
- ISO 37001 in Bangladesh
- ISO 37001 in Belgium
- ISO 37001 in Brazil
- ISO 37001 in Canada
- ISO 37001 in China
- ISO 37001 in Czechia
- ISO 37001 in Denmark
- ISO 37001 in Egypt
- ISO 37001 in France
- ISO 37001 in Germany
- ISO 37001 in Ghana
- ISO 37001 in Hong Kong
- ISO 37001 in India
- ISO 37001 in Indonesia
- ISO 37001 in Ireland
- ISO 37001 in Italy
- ISO 37001 in Japan
- ISO 37001 in Jordan
- ISO 37001 in Kenya
- ISO 37001 in Kuwait
- ISO 37001 in Malaysia
- ISO 37001 in Maldives
- ISO 37001 in Mauritius
- ISO 37001 in Mexico
- ISO 37001 in Nepal
- ISO 37001 in the Netherlands
- ISO 37001 in New Zealand
- ISO 37001 in Nigeria
- ISO 37001 in Norway
- ISO 37001 in Oman
- ISO 37001 in Pakistan
- ISO 37001 in the Philippines
- ISO 37001 in Poland
- ISO 37001 in Portugal
- ISO 37001 in Qatar
- ISO 37001 in Saudi Arabia
- ISO 37001 in Singapore
- ISO 37001 in South Africa
- ISO 37001 in South Korea
- ISO 37001 in Spain
- ISO 37001 in Sri Lanka
- ISO 37001 in Sweden
- ISO 37001 in Switzerland
- ISO 37001 in Taiwan
- ISO 37001 in Tanzania
- ISO 37001 in Thailand
- ISO 37001 in Türkiye
- ISO 37001 in Uganda
- ISO 37001 in the United Arab Emirates
- ISO 37001 in the United Kingdom
- ISO 37001 in the United States
- ISO 37001 in Vietnam
Keep exploring
Explore more about ISO 37001
Watch a video on how to implement ISO 37001 here.
Watch a video on ISO 37001 requirements here.
ISO 37001 resources
Why Sterling
Want successful ISO 37001 certification? Come to Sterling.
Whether you are protecting one operating company or aligning entities across countries with different laws, customs and public-sector exposure, Sterling helps you build one anti-bribery system with clear local ownership, so the programme holds up where the risk is highest.
Management systems in 60+ countries since 2003
Governance, risk and compliance systems implemented for contractors, public-sector suppliers, energy, logistics, healthcare and financial services, with one engagement team accountable wherever you operate.
All-inclusive proposal
One proposal covers consulting, Effivity, training and Academy access, with the certification body's fees shown separately. No surprises, ever.
A system your people can use
Controls scaled to the risk and built into the transactions where bribery could occur, with paperwork kept to what a due diligence file, a register and an approval need, so your people adopt the system rather than route around it.
Expert and experienced consultants
Consultants who have advised on management systems across sectors and countries since 2003, understand how bribery risk presents in tenders, permits and third-party relationships, and build your ABMS properly the first time, so the certification audit confirms what already works.
The Sterling Promise
What our ISO 37001 certification success guarantee means
We stay with you until your agreed ISO 37001 certification outcome is achieved, supporting the risk assessment, implementation, preparation and the resolution of assessment findings. Clear explanations, practical delivery, included software and employee learning turn the investment into a programme that protects the business rather than a certificate on a wall.
The engagement defines the standard, the scope, the outcome and who does what. Your organisation provides accurate information, takes the decisions the standard reserves for its governing body and top management, and puts the agreed controls into use. Conformity is assessed by the independent certification body, whose decision remains its own. Our commitment covers the agreed certification support; it is not a warranty that bribery can never occur.
After certification
What happens after ISO 37001 certification?
Your ABMS should keep working as markets, partners, personnel and laws change. Due diligence is refreshed, new business associates are screened, concerns are handled and the risk assessment is reviewed when the business changes. The certification body comes back for surveillance audits, normally yearly, and for recertification in year three.
As your business enters new countries or takes on new intermediaries, the system should evolve with it. Under Sterling OS™ Sustain™ we review the risk assessment, the higher-risk business associates, the concerns raised and control performance with you alongside the planned internal audits, management reviews and surveillance preparation, so the system stays alive between audits.
FAQs
Frequently asked questions about ISO 37001
Can a small business implement ISO 37001?
Yes. The standard expects measures that are reasonable and proportionate to the bribery risk, so a small organisation with few higher-risk relationships needs a short risk assessment, a clear policy, a few well-placed controls and a way to raise concerns, not a compliance department.
Does ISO 37001 certification guarantee that bribery cannot happen?
No. The standard itself says that conformity cannot provide assurance that bribery has not occurred or will not occur, and no certificate decides a legal case. What a properly implemented system gives you is documented, proportionate procedures and evidence that they operate, which is what procedures-based legal defences, regulators and customers look for.
Is ISO 37001 certification mandatory?
No law requires it in general, although public procurement rules, development-bank projects, group policies and supplier codes increasingly make an anti-bribery programme a condition of doing business. Many organisations implement ISO 37001 with no external demand at all, because the governing body wants evidence rather than assurances.
Does Sterling issue the ISO 37001 certificate?
No. Sterling's role is consulting. The certification audit and the decision are the work of an independent, accredited certification body. Anyone offering to do both is selling paper.
What is the difference between ISO 37001 and ISO 37301?
ISO 37001 is the requirements standard for an anti-bribery management system; ISO 37301 is the requirements standard for a compliance management system covering all of an organisation's compliance obligations. Both are certifiable and use the harmonised structure, so organisations with a wider compliance agenda often implement them together.
Do we need ISO 37002 as well?
ISO 37002 gives guidelines for whistleblowing management systems; it is guidance, not a certifiable requirements standard. It is a good design reference for the raising-concerns channel ISO 37001 requires: how reports are received, assessed, addressed and concluded.
Who should be our anti-bribery function?
The standard requires a function with the competence, status, authority and independence to oversee the system, advise and report, and for it to be adequately resourced. It can be a compliance officer, a senior manager with defined authority or a small committee; what matters is the reporting line to the governing body and top management, freedom from conflicting duties and the time to do the work.
We are certified to ISO 37001:2016. What do we need to do about ISO 37001:2025?
Plan a transition and complete it before 28 February 2027, when 2016 certificates cease to be valid. Review what changes for your system, close the differences and have the transition assessed by your certification body at a surveillance audit, at recertification or in a separate audit. Revise™, Sterling's transition service, runs the review and the plan.
What do you need to prepare an ISO 37001 proposal?
The entities, countries and activities to be covered, approximate headcount, how you win work, roughly how many business associates you have and of what kind, whether a programme or certificate exists today, any tender or regulator requirement, and your deadline. That is enough for a scoped, all-inclusive proposal; there is no need to prepare a risk assessment first.
Before the first call
Prepare a useful ISO 37001 readiness brief
You do not need a risk assessment or a policy before the first discussion. Bring a short account of how the business wins and delivers work and where the certificate should help. Seven questions are enough:
- What does the tender, questionnaire, regulator or group policy require, including the entities and countries to be covered? Or, if nobody has asked, what does the governing body want to be able to show?
- How do you win work: direct sales, tenders, agents, distributors or partners, and how often do you deal with public officials for permits, licences or approvals?
- Roughly how many business associates do you have, and which categories would you consider higher risk?
- What do past incidents, audit findings, declined gifts or awkward requests tell you about where the pressure sits?
- Which existing policies, approvals, financial controls and reporting channels already work well?
- Who can make decisions and contribute time: the governing body, top management, the likely anti-bribery function, legal, finance and procurement?
- Is there an existing certificate, an assessment date or a tender deadline to plan around?
These answers let us scope the work and prepare a realistic proposal. They prepare a conversation; they are not a scored assessment or a certification decision.
Don’t be fooled by certification scams
If it takes ten days, it is not ISO 37001 certification.
An anti-bribery certificate is useful when its scope covers the entities a tender committee or a regulator is looking at and the system behind it can stand up to review. The market is full of paper: certificates from bodies nobody accredits, consultants who promise to manage everything while your people do nothing, and audits that never open an agent contract or a gifts register. They cost less, until a customer, a prosecutor or a lender checks; a hollow anti-bribery certificate is worse than none.
How to choose a credible ISO 37001 provider
- Ask who will issue the certificate and how you can check its status and scope on the certification body's public register.
- Confirm the accreditation covers anti-bribery management systems, under a body recognised through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA, and check it with the accreditation body itself, not a logo in a quotation.
- Ask how the programme will examine real tenders, agents, payments, gifts and concerns. Documents should reflect your risks, not a template with another company's name still in it.
- Identify who carries each task, especially the due diligence work, which assessment costs are separate, and what support exists when findings need corrective action.
- Ask what your people will be taught and where the system will live. Without training and without software, nothing outlasts the consultant.
- Walk away from "certified in 7 to 10 days", "we handle everything" and a single invoice for consulting and certificate. An anti-bribery system has to operate in real transactions before anyone can audit it.
Keep exploring
More on ISO 37001 and related standards
Every ISO 37001 guide
- ISO 37001:2025 changes
- ISO 37001 bribery risk assessment
- ISO 37001 case study
- ISO 37001 certification process, step by step
- ISO 37001 certification cost
- ISO 37001 due diligence on business associates
- Effivity ISO 37001 guide
- ISO 37001 gifts and hospitality
- ISO 37001 requirements explained
- ISO 37001 vs ISO 37301
Talk to a consultant
Plan your ISO 37001 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice