ISO 37001 guide
ISO 37001 due diligence on business associates: risk tiers, evidence and refresh cycles
How ISO 37001 due diligence works under clause 8.2: which business associates need it, how to tier them by bribery risk, what each file must show, a worked example and the weaknesses auditors find most often.
Key points
- ISO 37001 due diligence sits in clause 8.2 and applies to the categories of business associates, personnel, transactions and projects that your bribery risk assessment rates above low risk. It is proportionate by design, not a check on everyone.
- Tiering is how the proportion is decided: each category of associate gets a depth of checking, a refresh interval and an approver that match its risk.
- The record auditors want is the analysis and the decision, dated and signed off, not a screening printout on its own.
- Due diligence connects to three other clauses: controls required of associates (8.5), anti-bribery commitments (8.6) and what you do when a relationship fails the test (8.8).
What does ISO 37001 due diligence require?
Clause 8.2 of ISO 37001:2025, titled "Due diligence", asks you to assess the nature and extent of bribery risk before you commit to certain relationships and decisions, and to keep that assessment current. The trigger is your own risk assessment under clause 4.5: where it shows more than a low bribery risk for a category of transaction, project, activity, business associate or personnel, due diligence is expected for that category. Where the risk is low, the standard does not demand it.
The standard does not ask for the same file on a stationery vendor and on a customs agent who meets officials on your behalf.
Business associates are the external parties you deal with: agents, distributors, resellers, suppliers, contractors, consultants and joint-venture partners, among others. Personnel in higher-risk roles are checked through the employment process in clause 7.2.2, which is a separate requirement with the same logic. This guide focuses on business associates; how to rate the risks in the first place belongs to the bribery risk assessment guide.
Where due diligence sits in the anti-bribery system
Due diligence is rarely audited in isolation. A certification auditor usually follows one associate through several clauses to see whether the chain holds. The main links, at clause-title level in ISO 37001:2025:
| Clause | Role in the due diligence chain | What an auditor traces |
|---|---|---|
| 4.5 Bribery risk assessment | Sets which associate categories are above low risk and therefore need due diligence | A category in the risk assessment that matches the tier applied to the associate |
| 8.2 Due diligence | Assesses the associate before engagement and at intervals afterwards | The questionnaire, checks, red flags found, analysis and approval, all dated |
| 8.5 Controls by controlled organisations and business associates | Requires higher-risk associates to apply reasonable controls of their own | Evidence of the associate's controls, or a recorded reason why they were not required |
| 8.6 Anti-bribery commitments | Obtains commitments from associates above low risk where practicable | Signed clauses or declarations, and what was done when one was refused |
| 8.8 Managing inadequacy of anti-bribery controls | Acts when due diligence shows the risk cannot be managed with existing controls | A documented decision to add controls, suspend, exit or decline the relationship |
| 9.4 Review by anti-bribery function | Checks that the process works across the population | Overdue refreshes, exceptions and approvals reported to the governing body |
How to tier business associates
ISO 37001 leaves the tiering method to you. Sterling's recommended approach uses three tiers, built from factors your risk assessment already scores: country, dealings with officials for you, payment size and structure, and how much discretion the associate has in your name.
Tier 1: low risk, no enhanced checks
Suppliers of standard goods at market prices, with no interaction with officials on your behalf. They pass through normal procurement and receive your policy with the purchase terms.
Tier 2: medium risk, standard due diligence
Distributors, subcontractors and consultants with some discretion or some public-sector touchpoints. A questionnaire, ownership and registration checks, screening against sanctions and adverse media, reference checks, a signed commitment and a refresh at a fixed interval.
Tier 3: high risk, enhanced due diligence
Agents, customs brokers, licensing intermediaries, joint-venture partners and anyone paid on success in a higher-risk market. Everything in tier 2, plus beneficial ownership traced to individuals, links to public officials, a check that the fee reflects real services, an interview, audit rights in the contract and approval by the anti-bribery function or a senior manager independent of the sponsoring business unit.
The labels tier 1, 2 and 3 are Sterling's recommended classification, not terms defined by ISO 37001. What the standard cares about is that the depth matches the risk and that you can show why.
What evidence each tier needs
A good file lets a reviewer who was not in the room follow the reasoning from facts to conclusion.
| Tier | Minimum record on file | Approver | Refresh trigger |
|---|---|---|---|
| 1 Low | Category assignment and the reason; policy shared with the terms | Procurement | A change in role, for example it starts dealing with officials |
| 2 Medium | Questionnaire, registration and ownership check, screening results, red flags and how each was resolved, signed commitment, conclusion | Business owner with a compliance check | Fixed interval set in your procedure, contract renewal or a red flag |
| 3 High | All of tier 2, beneficial owners, official connections, fee justification against services, interview notes, contract audit rights, conditions attached to approval | Anti-bribery function or an independent senior manager | A shorter interval, any change in ownership or scope, unusual payment requests |
Red flags deserve a line each: requests for payment to a third party or offshore account, success fees out of line with the work, a refusal to sign a commitment, a family link to the official who awards the contract, or a firm with no staff and no track record.
A worked example: an engineering contractor entering a new market
A mid-sized engineering firm wins pre-qualification for public works in a country where it has no presence. It plans to use a local agent for permits and customs, two subcontractors for civil works and a joint-venture partner for the tender itself.
The risk assessment already rates public-works tendering in that market as high risk. The agent handles permits and meets customs officers, so it lands in tier 3. The due diligence shows the agent's director is a former official in the permitting ministry and the fee requested is a percentage of contract value. The file records both facts, the questions put to the agent, the answers and the conclusion: engagement approved only on a fixed monthly fee tied to itemised services, with audit rights and quarterly reporting of every meeting with officials.
The joint-venture partner is also tier 3; its own anti-bribery programme is reviewed under clause 8.5, and the joint-venture agreement carries mutual anti-bribery commitments under 8.6. The subcontractors are tier 2: questionnaires, screening, signed commitments and a refresh when the contract is renewed.
When one subcontractor declines the commitment clause, the firm records the refusal, weighs alternatives and replaces it. That record, made under clause 8.8, is often the most convincing evidence an auditor sees, because it shows the process can say no.
Common weaknesses in ISO 37001 due diligence
- Screening mistaken for due diligence. A clear sanctions check says nothing about whether an agent's fee is reasonable or who ultimately owns it.
- No link to the risk assessment. Tiers are assigned by procurement habit, so the auditor cannot see why a distributor in a high-risk market is treated as low risk.
- Backlog of legacy associates. New relationships are checked but existing ones never were. Plan a risk-ordered catch-up, starting with tier 3.
- The sponsor approves their own associate. For high-risk tiers the approval should sit with someone who does not benefit from the deal.
- Silent exits. Relationships ended over bribery concerns with no record of the decision, which leaves nothing to show under clause 8.8.
Gifts and hospitality offered to or by associates are handled through their own controls and register, covered in the gifts, hospitality and donations guide.
How Sterling builds due diligence
A tiered process your commercial teams will actually use
Sterling's expert and experienced consultants derive the tiers from your bribery risk assessment, write the questionnaire and approval rules with your anti-bribery function, and run a risk-ordered pass through your existing associates. Files, red flags, commitments and refresh dates sit in Effivity, so overdue reviews surface on their own. We ensure successful certification for our clients.
Book a free discovery callISO 37001 due diligence: questions buyers ask
Do we have to perform due diligence on every supplier for ISO 37001?
No. Clause 8.2 applies to the categories your bribery risk assessment rates above low risk. Low-risk suppliers still need to be assigned to a category, so the decision not to check them is recorded and can be defended.
How often should business associate due diligence be refreshed?
ISO 37001 does not set a fixed interval; you set it in proportion to risk and must keep the assessment current. Many organisations refresh high-risk associates more often than medium-risk ones and also on triggers such as a change of ownership or scope.
Can we rely on a third-party screening database?
It can supply part of the evidence, such as sanctions and adverse-media results, but it does not replace the analysis. The file still needs the red flags you considered, how each was resolved and who approved the relationship.
What if a business associate refuses to sign an anti-bribery commitment?
Record the refusal and decide what it means for the risk. Options include added controls, a different contract structure, suspension or declining the relationship; the decision and its reasons belong in the record under clause 8.8.
Does due diligence on our own employees count?
Checks on personnel in higher-risk roles are required through the employment process in clause 7.2.2, separately from business associate due diligence. Both follow the same principle of proportion to the bribery risk.
How do we deal with hundreds of existing business associates?
Assign every associate a tier first, which is quick, then work through tier 3 and tier 2 in risk order with a dated plan. Auditors accept a catch-up that is under way and tracked; they do not accept one that has no plan.
More ISO 37001 guides
Every guide in the ISO 37001 series is written for one question and links back to the hub for the whole picture.
- ISO 37001:2025: what changes and how to transition
- Bribery risk assessment: how to do one
- ISO 37001 case study
- ISO 37001 certification process, step by step
- ISO 37001 certification cost: what moves the price
- Due diligence on business associates: tiers and evidence
- Effivity for ISO 37001: the guide
- Gifts, hospitality and donations: thresholds and the register
- ISO 37001 requirements explained, clause by clause
- ISO 37001 vs ISO 37301: which one, or both?
Keep exploring
Explore more about ISO 37001
Watch a video on how to implement ISO 37001 here.
Watch a video on ISO 37001 requirements here.
ISO 37001 resources
Talk to a consultant
Build ISO 37001 due diligence that is proportionate, recorded and able to say no.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice