Effivity ISO 37001 guide: how the software runs your anti-bribery management system

Why anti-bribery compliance software matters for ISO 37001

An anti-bribery programme lives or dies on follow-through. A board-approved policy is easy to show; an auditor or tender committee wants to know whether the controls behind it were applied. Was the new distributor checked before the first order? Is the declined dinner with a customs official recorded?

On e-mail and spreadsheets those answers scatter: due diligence in one mailbox, the gifts log in a workbook one person keeps, training certificates in HR folders. When the certification body samples a business associate, the trail is rebuilt by hand, and gaps show.

Effivity, Sterling's ISO and GRC software used in 50+ countries, keeps these threads together, each record with an owner, a due date and a decision, while reminders and escalation flag what has slipped. ISO 37001 does not require software; it requires proportionate controls that operate and can be evidenced, and a single system makes the second half far easier to demonstrate.

Which Effivity module holds each ISO 37001 requirement

The table maps the requirement areas of ISO 37001:2025, by clause title, to where the work is recorded in Effivity. Named modules are the core modules used across Sterling's management-system engagements; entries marked "configured" are registers or workflows Sterling sets up for the anti-bribery system on those foundations.

Legal and contractual anti-bribery obligations that apply in each country of operation can be listed in Compliance Obligation, which keeps the legal context beside the risk assessment rather than in a separate memo.

What is configured at the start

Configuration follows the gap analysis, not a generic template.

• Risk criteria and tiers. The scales used to rate bribery risk and the thresholds for more than low risk are agreed with management and built into the forms.
• The business associate register. Agents, distributors, consultants and key suppliers are loaded by category, with each tier's due diligence depth and refresh interval.
• Gift and hospitality thresholds. Values, approvers and the stricter rules for public officials are set so an entry above a limit routes to the right person.
• Access to concerns and investigations. Case records are visible only to the anti-bribery function and the investigators it appoints, to protect confidentiality and the people who report.
• The implementation plan. Milestones and owners from the gap analysis are tracked in the system, so the governing body sees progress in the same place as the records.

The detail of tiering and evidence is covered in Due diligence on business associates: tiers and evidence, and thresholds in Gifts, hospitality and donations: thresholds and the register.

A worked trace: onboarding a sales agent

A company expanding into a new market proposes a local sales agent paid on commission. The commercial lead adds the agent to the business associate register; because the country and the commission model both rate high in the risk assessment, the record opens at the highest tier. The anti-bribery function receives the task with a due date.

The file collects ownership, references, links to public officials and the business need, then the function's analysis and decision: approve with conditions. The conditions become entries of their own, namely a signed anti-bribery commitment, a contract clause allowing audit, commission paid only against invoices with evidence of services, and training on the policy. Each has an owner and a date. Six months later a refresh reminder arrives; the review notes one unexplained expense claim, which is raised as a nonconformity, investigated and closed with a tightened payment check.

When the certification auditor samples that agent, the chain is complete: tier, analysis, decision, commitment, training, payments control and the follow-up, all dated and owned.

What the certification auditor sees in Effivity

At the Stage 1 readiness review the certification body checks that the system is designed and documented; at Stage 2 it tests whether it operates. With the records in Effivity, your people open what the auditor selects and explain it: due diligence files across tiers, gifts register entries including refusals, training against higher-risk roles, internal audit findings, review minutes and the function's report to the governing body.

Auditors also notice a system assembled rather than run: records dated in the fortnight before the visit, or one name on every entry. A system used from the first workshop has a genuine history. The certification route itself is set out in ISO 37001 certification process, step by step.

For organisations holding a 2016 certificate, the same records support the move to ISO 37001:2025 before 28 February 2027: the anti-bribery culture, conflicts of interest and climate-change relevance can be added to the existing modules rather than rebuilt. ISO 37001:2025: what changes and how to transition covers the changes themselves.

Keeping the system alive after certification

Certification starts a three-year cycle, with surveillance audits at least once a year and recertification before the certificate expires. Surveillance tests continuity: refreshed due diligence, renewed training, a register still in use, completed audits and reviews. These tasks fade when one person carries them from memory.

In Effivity the recurring work is scheduled, overdue items escalate and dashboards keep the open actions visible to the anti-bribery function and to management. Under Sustain™, Sterling continues with internal audits, due diligence cycles, system upkeep, refresher learning and future transitions in the same system.

What Effivity does not do

Effivity records judgements; it does not make them. Whether an agent's explanation is credible, whether hospitality is proportionate or whether a case needs external counsel remains a decision for the anti-bribery function and management, who must be able to explain it at interview. Nor does it replace your finance system: payment controls run in accounting and banking processes, and Effivity holds the evidence that they were checked and audited.

• Registers loaded but not used. A business associate list with no due diligence behind it proves the gap rather than closing it.
• Everything routed to one person. The function oversees; process owners in sales, procurement and finance must own their entries.
• Case records open too widely. Poor access settings on concerns undermine confidence in the channel.

Effivity for ISO 37001: questions buyers ask