ISO 37001 bribery risk assessment: how to do one, step by step

What does ISO 37001 ask of a bribery risk assessment?

An ISO 37001 bribery risk assessment is a documented study of where bribery could realistically happen in or around your organisation, how serious each exposure is, and how well your current controls cover it. Clause 4.5 of ISO 37001:2025 requires you to identify the bribery risks you can reasonably anticipate, analyse and prioritise them, evaluate whether the existing controls are suitable and effective, and keep the result under review. Because measures must be proportionate, its output sets how strict your due diligence, financial and non-financial controls and training need to be.

Unlike a general enterprise risk register, it looks at bribery in both directions, bribes offered on your behalf and bribes offered to your people, and it is built on the facts gathered under clause 4.1, which in the 2025 edition include your locations and sectors, your controlled entities, your dealings with public officials and, now explicitly, whether climate change is a relevant issue for you.

The units of analysis: where bribery risk actually sits

Bribery risk does not live in an org chart; it lives where money, discretion and a counterparty meet. Sterling's recommended approach is to break the business into four units and assess the combinations that exist in practice.

• Countries and locations. Where you operate, sell, source or obtain permits, including places where you have no office but rely on an agent.
• Business lines and activities. Tendering, licensing and permits, customs clearance, sponsorships, recruitment, land acquisition, inspections, collections.
• Transaction types. Commissions, success fees, facilitation-style requests, cash payments, discounts and rebates, charitable donations, hospitality for officials.
• Categories of business associate. Sales agents, distributors, joint-venture partners, subcontractors, consultants, customs brokers, suppliers, and the controlled entities within your group.

Name the roles that approve payments, award contracts, deal with inspectors or carry sales targets too: clause 7.2.2 ties checks on higher-risk roles and the review of incentives back to what the assessment finds.

How to do a bribery risk assessment, step by step

The sequence below scales from one site to a group; each step leaves a record the auditor can sample.

Write scenarios as sentences an auditor can test: "A customs broker in country X pays an inspector to release delayed shipments and bills us as 'expediting fees'." A good scenario names who pays, who receives, the advantage sought and how the money is disguised.

Worked example: a mid-sized engineering contractor

This illustration is a composite, not a client. Picture a contractor with its head office in one country, project sites in two others, around a dozen sales agents, and a steady flow of public-sector tenders.

Notice what the table decides. Agents and permit-heavy site work land above low risk, so they receive due diligence under clause 8.2 and commitments under clause 8.6. Due diligence tiers are covered in the guide to due diligence on business associates, and the register in the guide to gifts, hospitality and donations.

What the certification body looks for

The certification body's auditors usually start from the assessment and then walk forwards into operations. Expect them to pick a high residual risk and ask to see the control that answers it working in a live file: an agent's due diligence pack, a commission with two approvals, a register entry that was refused.

They will check that the method was approved, that ratings carry reasons, that existing controls were evaluated rather than assumed, and that the assessment was reviewed when something changed, such as a new market, an acquisition, a new category of intermediary or a reported concern. The anti-bribery function's review under clause 9.4 is the natural place for that evidence. For the audit stages themselves, see the ISO 37001 certification process.

Mistakes that weaken the assessment

• A generic template. Rows copied from another company name no real country, partner or payment type, and the auditor spots it within minutes.
• Only outbound bribery. Procurement, recruitment and approvals where your people could be bribed are left out.
• Controls taken on trust. A policy is counted as a control even though nobody checks whether it is followed, so residual ratings are too low.
• Everything rated medium. Nobody wants to write "high", so nothing is prioritised and due diligence has no clear population.
• No link to the controls. The assessment sits in a folder while due diligence tiers, thresholds and training plans are set by habit.

Keeping the assessment current

Set a fixed review cycle, commonly annual, and write down the events that force an earlier review: entering a country, appointing a new type of intermediary, a merger or joint venture, a change in law, a speak-up case or an internal audit finding. Record each review, even when no rating moves. Lessons from investigations and corrective actions under clause 10 should feed straight back into the scenarios. The wider structure of the standard is explained in ISO 37001 requirements explained.

ISO 37001 bribery risk assessment: questions buyers ask