ISO 37001 guide
ISO 37001 requirements explained: clauses 4 to 10 of the 2025 edition
What each clause of ISO 37001:2025 requires of an anti-bribery management system, from the bribery risk assessment and leadership to due diligence, gifts, speak-up and investigations, with the evidence a certification auditor samples and what the 2025 edition changed.
Key points
- ISO 37001:2025 places its auditable requirements in clauses 4 to 10. The bribery risk assessment in clause 4.5 decides how far every later control has to go.
- Clause 8 carries the controls that make the system specific to bribery: due diligence, financial and non-financial controls, commitments from business associates, gifts and hospitality, raising concerns and investigations.
- The standard requires measures that are reasonable and proportionate to your own risks. It does not prescribe one policy wording, one threshold or one set of forms.
- The 2025 edition keeps the 2016 structure and core requirements, and adds anti-bribery culture, conflicts of interest and a clarified anti-bribery function.
How are the ISO 37001 requirements organised?
ISO 37001 uses the harmonised structure of ISO management system standards, so ISO 9001 or ISO/IEC 27001 users will recognise its headings. Clause 1 defines what the document covers: bribery in the public, private and not-for-profit sectors, committed by or against the organisation, its personnel or its business associates, directly or through others. The requirements an auditor can raise a nonconformity against sit in clauses 4 to 10. Annex A is informative guidance, not auditable in itself.
The requirements describe results. How you document and name each control is your choice, provided each measure traces back to an identified risk:
| Clause | What the certification auditor tests |
|---|---|
| 4 Context of the organisation | A scope that matches the entities and activities you run, and a risk assessment that names real exposures |
| 5 Leadership | A governing body that oversees, a policy people have acknowledged, and a function with standing to act |
| 6 Planning | Objectives with owners and measures, and changes assessed before they happen |
| 7 Support | Screening for risky roles, training matched to the role, and controlled documents |
| 8 Operation | Due diligence files, payment and procurement controls, the gifts register, speak-up cases |
| 9 Performance evaluation | Monitoring results, impartial internal audits, management review and the function's own review |
| 10 Improvement | Corrective actions that remove causes, and lessons from cases fed back into the system |
Clauses 4 and 5: context, bribery risk and leadership
Clause 4 starts with the facts of the business: its structure, locations and sectors, its business model, the entities it controls, its dealings with public officials and its legal and contractual obligations (4.1). You also decide whether climate change is a relevant issue. Interested parties (4.2), the scope (4.3) and the system itself (4.4) follow.
Clause 4.5, the bribery risk assessment, is where the standard parts company with generic management systems. You identify the bribery risks you can reasonably anticipate, analyse and prioritise them, judge how well existing controls cope, and review the assessment on a schedule and whenever the business changes significantly. A register reading "medium risk, sales", with no country, transaction type or intermediary category, will not survive Stage 2.
Clause 5 splits responsibility between the governing body (5.1.1), which oversees, and top management (5.1.2), which leads. Subclause 5.1.3 asks both to promote an anti-bribery culture. The anti-bribery policy (5.2) must prohibit bribery and be communicated. Under 5.3 the anti-bribery function (5.3.2) needs competence, status, authority and independence, and decisions delegated to others are controlled (5.3.3).
Clauses 6 and 7: planning and support
Clause 6 converts the risk assessment into action. Actions on risks and opportunities (6.1) respond to what 4.5 found; anti-bribery objectives (6.2) are measurable, owned and dated; and planning of changes (6.3) means a new market, acquisition or distributor model is assessed for bribery exposure before it goes live rather than after.
Clause 7 covers people and paper. Resources (7.1) and competence (7.2.1) are familiar. The employment process (7.2.2) is not: it asks for checks on personnel in roles that carry more than a low bribery risk, a review of whether bonuses, targets and incentives push people towards bribery, and awareness that actual or potential conflicts of interest must be reported. Clause 7.3 separates awareness of personnel, training for personnel and training for business associates, the last applied where your risk assessment says it is warranted. Communication (7.4) and documented information (7.5) close the chapter.
Clause 8: the operational anti-bribery controls
Clause 8 takes most audit time: it holds the controls that stop, reveal or respond to a bribe. After operational planning and control (8.1), subclauses 8.2 to 8.10 carry the substance:
| Subclause | What it requires | Evidence an auditor samples |
|---|---|---|
| 8.2 Due diligence | Due diligence on the categories of transaction, project, business associate and personnel your assessment rates above low risk | Files showing the analysis and the decision, refreshed on schedule |
| 8.3 Financial controls | Controls that make improper payments difficult and visible | Approval limits, segregation of duties, payment checks |
| 8.4 Non-financial controls | Controls over procurement, operations, sales and commercial dealings | Tender records, contract terms, sales approvals |
| 8.5 Controlled organisations and business associates | Controlled entities run the system or equivalent controls; higher-risk associates apply reasonable controls | Local evidence from subsidiaries, associate control confirmations |
| 8.6 Anti-bribery commitments | Commitments from business associates posing more than a low risk | Signed clauses, and a record where one was refused |
| 8.7 Gifts, hospitality, donations and similar benefits | Procedures preventing these from acting as bribes | Register entries with approvals and refusals |
| 8.8 Managing inadequacy of controls | Action when a relationship or transaction cannot be controlled adequately | Decisions to exit, suspend or add safeguards |
| 8.9 Raising concerns | Channels for good-faith reports, with confidentiality and protection from retaliation | Awareness evidence and a case log |
| 8.10 Investigating and dealing with bribery | Investigation and appropriate action where bribery is suspected or found | Case files with outcomes reported upwards |
Due diligence on business associates: tiers and evidence · Gifts, hospitality and donations: thresholds and the register
Clauses 9 and 10: evaluation and improvement
Clause 9 asks you to prove the system works. Monitoring and measurement (9.1) defines what is tracked and how results are used. Internal audit (9.2) runs to a programme, examines procedures, controls and systems, and depends on auditors who are objective and impartial (9.2.4). Management review (9.3) has defined inputs and results. Then 9.4, specific to this standard, has the anti-bribery function assess whether the system is adequate and effective and report to the governing body and top management.
Clause 10 has two parts in the 2025 edition: continual improvement (10.1) and nonconformity and corrective action (10.2). A substantiated concern raised through 8.9 shows exactly where a control failed, so its corrective action should reach back into the risk assessment, the training and the control.
Documented information and evidence
Clause 7.5 governs how documented information is created, updated and controlled. Several requirements expect a record by their nature: the scope, the policy, the risk assessment, objectives, due diligence outcomes, commitments, the gifts and hospitality record, training, investigations, audits, reviews and corrective actions. Which of these the 2025 text names explicitly as documented information should be confirmed against the licensed copy during the gap analysis rather than assumed from the 2016 edition.
Volume is not the aim: an auditor samples a live payment to an agent and asks for the due diligence, contract clause, approval and invoice check behind it.
How Sterling builds the evidence trail
Controls sized to your bribery risks, with records produced by the work itself.
Sterling's gap analysis tests your existing policy, due diligence, financial controls and reporting channel against each requirement, keeps what already works and agrees actions with owners and dates. Our expert and experienced consultants then build the risk assessment with your leadership and set up the system in Effivity, included with the engagement at no additional cost, so approvals, registers and cases are recorded as they happen. We ensure successful certification for our clients. An independent, accredited certification body audits and decides; Sterling does not certify.
Book a free discovery callWhat the 2025 edition changed in the requirements
ISO 37001:2025, the second edition, was published in February 2025 and replaced both the 2016 edition and its 2024 climate amendment. The clause numbering above is the 2025 numbering. Its foreword lists five changes:
- Climate change and culture. New subclauses on whether climate change is relevant and on anti-bribery culture (5.1.3).
- Conflicts of interest addressed within the employment process.
- The anti-bribery function clarified. The 2016 "anti-bribery compliance function" is now the anti-bribery function in 5.3.2 and 9.4.
- Harmonised wording with other standards where reasonable.
- The latest harmonised structure adopted.
Certificates to the 2016 edition lose validity after 28 February 2027.
ISO 37001 requirements: questions buyers ask
What are the main requirements of ISO 37001?
The main requirements are a documented bribery risk assessment, a policy prohibiting bribery, an anti-bribery function with real authority, and proportionate operational controls. Those controls include due diligence, financial and non-financial controls, gifts and hospitality procedures, a speak-up channel and investigations, plus internal audit, management review and corrective action.
Does ISO 37001 require due diligence on every supplier?
No. Due diligence applies to the categories your risk assessment rates above low bribery risk. A stationery supplier and a customs agent dealing with officials rarely share a tier, and the auditor checks that tiers follow from the assessment.
Does ISO 37001 ban gifts and hospitality?
No. It requires procedures that stop gifts, hospitality, donations and similar benefits from working as bribes. Most organisations set value thresholds, approval steps, specific rules for public officials and a register that records refusals as well as acceptances.
Is a whistleblowing channel a requirement of ISO 37001?
Yes. Clause 8.9 requires procedures for raising concerns in good faith, with confidentiality and protection against retaliation, and personnel must know the channel exists. ISO 37002 gives optional guidance on designing such a channel.
Does ISO 37001 cover fraud and money laundering?
Not by default. The standard addresses bribery only. You may extend your system to fraud, cartel conduct or money laundering if you choose.
What does ISO 37001 require of the board or governing body?
The governing body must oversee the anti-bribery management system, while top management leads it day to day, and both promote an anti-bribery culture. The anti-bribery function reports to them, including its periodic assessment under 9.4, so board minutes that show oversight and decisions are evidence an auditor expects.
More ISO 37001 guides
Every guide in the ISO 37001 series is written for one question and links back to the hub for the whole picture.
- ISO 37001:2025: what changes and how to transition
- Bribery risk assessment: how to do one
- ISO 37001 certification process, step by step
- ISO 37001 certification cost: what moves the price
- Due diligence on business associates: tiers and evidence
- Effivity for ISO 37001: the guide
- Gifts, hospitality and donations: thresholds and the register
- ISO 37001 requirements explained, clause by clause
- ISO 37001 vs ISO 37301: which one, or both?
Keep exploring
Explore more about ISO 37001
Watch a video on how to implement ISO 37001 here.
Watch a video on ISO 37001 requirements here.
ISO 37001 resources
Talk to a consultant
Turn the ISO 37001 requirements into controls that match your bribery risks.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice