ISO 37001 certification process, step by step: from bribery risk assessment to certificate

Who does what in ISO 37001 certification?

Four parties take part. Your organisation owns the anti-bribery management system: the governing body oversees it, top management leads it and the anti-bribery function watches over it day to day. A consultancy such as Sterling helps you assess the risks, design the controls and prepare the evidence. It does not certify. The certification body audits the system and decides whether to certify it. Independent of whoever helped you build the system, it operates under ISO/IEC 17021-1 together with ISO/IEC TS 17021-9, the technical specification that sets competence requirements for auditing anti-bribery management systems. Above it sits an accreditation body, recognised through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA on 1 January 2026, and which checks that the certification body is fit to do the work.

Steps 1 to 4: the work your organisation completes first

Step 1: decide what the certificate must cover

Name the legal entities, sites and activities in scope, the categories of business associate the system reaches, and who acts as the governing body. Then write down why you are certifying. A tender deadline, a regulator's expectation or a group policy each changes the order of work and the target audit date.

Step 2: gap analysis

Sterling's gap analysis is the first stage of the engagement. It sets your current policy, due diligence practice, financial controls and speak-up arrangements against the standard, keeps what already works and turns the rest into actions with owners and dates. It is neither the free online readiness check nor the certification body's Stage 1.

Step 3: assess the bribery risks and put proportionate controls in place

The bribery risk assessment under clause 4.5 decides how much of everything else you need. From it follow the policy the governing body owns, an anti-bribery function with real authority, risk-tiered due diligence, financial and non-financial controls, rules and a register for gifts, hospitality and donations, commitments from higher-risk business associates, training by role and a channel for raising concerns. Our guides to bribery risk assessment and to due diligence on business associates cover those two steps in depth.

Step 4: operate, audit and review

An auditor has to see controls working, not only written. Due diligence must be completed on the higher-risk population, training delivered and the gifts register used in real decisions. Then three checks close the loop before any external audit: an internal audit by objective and impartial auditors under clause 9.2, the anti-bribery function's own review of adequacy and effectiveness under clause 9.4, and a management review under clause 9.3 with governing body oversight.

Step 5: appoint a certification body with the right accreditation

Ask each candidate body three things, and check the answers yourself. Is it accredited specifically for anti-bribery management systems, rather than for quality or environmental certification only? Is that accreditation granted by a body recognised through the Global ACI arrangement, as shown in the accreditation body's own directory? And what audit arrangements does its quotation assume: the entities and sites to be visited, the audit days for each stage and the surveillance pattern?

Apply while implementation is still under way. The application review fixes the audit programme and dates.

Steps 6 and 7: the Stage 1 readiness review and the Stage 2 audit

At Stage 1 the certification body confirms that the system is designed and ready to be audited. The auditor reads the scope, the bribery risk assessment and the policy, confirms how the anti-bribery function reports, and checks that the internal audit and reviews have taken place. Concerns raised at Stage 1 are a warning of what Stage 2 would find, so close them before the second visit.

Stage 2 tests whether the system works across the scope. Auditors sample live material: a due diligence file with its analysis, payments that passed approval thresholds, register entries including refusals, signed commitments, training records for higher-risk roles and the handling of any concern raised.

Step 8: findings, corrective action and the certification decision

Each nonconformity needs a correction, an analysis of its cause and a corrective action that removes the cause. A major nonconformity must be verified as closed before a certificate can be granted, sometimes through a follow-up visit; for a minor one the body normally accepts your plan and checks its effect at the next audit. The recommendation made at the closing meeting is not the decision. The decision is taken by the certification body on the audit report and the evidence of closure, and the certificate then records your organisation, the scope, the sites and the edition, ISO 37001:2025.

Step 9: surveillance, recertification and the 2016 transition

The body returns at least once a calendar year outside recertification years, with the first surveillance audit due within twelve months of the decision. Each visit samples the system, so due diligence refreshes, training, register entries, investigations, internal audits and reviews must keep producing records. Before the three years end, a recertification audit covers the whole system again. Report significant changes, such as a new entity or country, to the body when they happen.

Organisations still certified to ISO 37001:2016 have until 28 February 2027, after which those certificates are no longer valid. The transition is audited at a surveillance audit, at recertification or in a separate audit; our guide to ISO 37001:2025 and the transition sets out what changes.

How long does the ISO 37001 certification process take?

For most organisations, steps 1 to 8 take four to eight months. The pace is set by decisions and evidence: how quickly the governing body approves the policy, thresholds and delegated authority; how many countries, business lines and business associate categories must be assessed; how long due diligence on the higher-risk population takes; and when the certification body can schedule both stages. Groups with several entities or large agent networks should plan for the upper end.

What delays ISO 37001 certification?

• A policy without operating controls. Stage 2 samples transactions, and a signed policy with no due diligence files or register entries behind it produces major findings.
• A function in name only. One person without time, access to the governing body or authority to stop a transaction will not satisfy an auditor asking how the function reports and what it has changed.
• Booking Stage 2 before the reviews. Without an internal audit, the function's review and management review on record, the audit is postponed or the findings multiply.
• Choosing the body on price. A certificate from a body without anti-bribery accreditation, or with too few audit days, may fail the tender committee's or regulator's check it was bought to pass.

ISO 37001 certification process: questions buyers ask