ISO 37001 case study: a multinational group

The organisation and what it needed

This ISO 37001 case study concerns a multinational group that operates around the world through a mix of business units and subsidiaries.

Its problem was consistency. When a group trades through many units, each can end up with its own habits for checking partners, approving payments and handling gifts or hospitality. The group needed bribery risk to be managed the same way everywhere it did business, so that the standard of control did not depend on which unit or subsidiary happened to be involved in a transaction.

What was implemented

The group put in place an anti-bribery management system built on ISO 37001. The system was designed around the three things the standard requires an organisation to do about bribery: prevent it, detect it and respond to it.

Two features defined the implementation:

• One set of controls across the group. The same anti-bribery controls were applied in every business unit, instead of each unit working to its own rules.
• One approach to due diligence. Due diligence was carried out on the same basis in every unit, so that the checks a partner or transaction received did not vary from one part of the group to another.

What changed

The group reported three outcomes. First, the system set a firm basis for preventing, detecting and responding to bribery, which reduced its exposure to costly violations. Second, applying identical controls and due diligence in every unit lowered its operational exposure. Third, the same consistency lowered its reputational exposure.

Its chief compliance officer said that managing bribery risk has become part of everyday business across the group rather than a separate compliance exercise, and that this protects both the group's reputation and its long-term growth.

About ISO 37001

ISO 37001 sets requirements, with guidance, for an anti-bribery management system that an organisation establishes, runs, reviews and improves. It covers bribery in the public, private and not-for-profit sectors, whether committed by the organisation, its personnel or business associates acting for it, or aimed at them, and whether direct or indirect. It deals with bribery alone; fraud, cartel conduct and money-laundering sit outside it unless an organisation decides to widen its system.

The current edition is ISO 37001:2025, published in February 2025. Certificates to the 2016 edition stop being valid after 28 February 2027, and since 31 August 2026 initial and recertification audits are carried out only against the 2025 edition. For a group, the clauses that matter most include the bribery risk assessment, the anti-bribery function, risk-tiered due diligence, and the requirement that controlled organisations apply the system or equivalent controls.

The standard is candid about its limits: conforming to it cannot guarantee that bribery will never occur. What it demonstrates is that proportionate, verifiable measures are in place. Where an organisation chooses certification, an independent, accredited certification body audits the system and makes the decision; Sterling does not certify.

How Sterling runs a programme like this

The points below describe how Sterling generally approaches an ISO 37001 engagement for a group with several entities. They are not a description of this particular client's project.

Work usually begins by defining which entities, sites, activities and categories of business associate the system must cover, followed by a gap analysis of the existing programme against the standard. The bribery risk assessment then drives the design of the policy, the anti-bribery function, due diligence tiers, gifts and hospitality rules, commitments from business associates, training and the channel for raising concerns.

Clients choose between two alternative levels of support. Under Design™, we develop the system and your team implements it under our expert advice and supervision. Under Drive™, we design and build it with your approval, as a fully managed service. Either way, Effivity, used in 50+ countries, is included at no additional cost, so due diligence records, registers, training and audit evidence sit in one place for every unit. Engagements also include internal auditor training for your audit team, as applicable to your standard.

ISO 37001 for multinational groups: questions buyers ask