ISO 37001 vs ISO 37301: anti-bribery or compliance management, which one, or both?

ISO 37001 vs ISO 37301: the short answer

Choose ISO 37001 when the question you have to answer is about bribery: a public tender, an international client, a development lender or a parent company asking for proof that you prevent, detect and respond to it. Choose ISO 37301 when the question is wider: can you show a regulator or a board that every obligation that applies to you is known, owned and controlled? Choose both when you face the two questions at once, which is common for regulated businesses that also sell to government.

The two standards are not a basic and an advanced version of the same thing. ISO 37001 goes deep on a single risk and prescribes specific controls for it. ISO 37301 goes wide and leaves the choice of controls to your own obligations and risk assessment. Anti-bribery law is one of the obligations a compliance system has to manage, which is why the ISO 37301 hub describes ISO 37001 as the deeper treatment of one risk.

What each standard covers

ISO 37001: anti-bribery management systems

The current text is ISO 37001:2025, the second edition, published in February 2025. It deals with bribery in the public, private and not-for-profit sectors, whether offered or received, direct or through a third party, by your people or by business associates acting for you. Fraud, cartels and money-laundering sit outside it unless you choose to widen the system. Its operational clauses are unusually concrete about the controls expected.

ISO 37301: compliance management systems

ISO 37301:2021, amended in 2024 to add the climate-change text, covers compliance obligations of every kind: mandatory requirements such as laws, regulations and permits, and commitments the organisation takes on itself. It replaced ISO 19600, a guideline that could not be certified. Its core is an obligations register and a compliance risk assessment; the controls follow from whatever those two reveal, whether the obligation concerns data protection, sanctions, product safety, employment or bribery.

What they share

Both follow ISO's harmonised structure for management system standards, so context, leadership, planning, support, performance evaluation and improvement read almost the same in each. Both expect a governing body that oversees the system, a dedicated function with standing and independence, a culture subclause, an employment process that checks higher-risk roles, a channel for raising concerns and an investigation process.

Side by side: scope, assessor, output, cycle, cost drivers and buyers

Neither certificate proves that no breach will occur. What moves the price of each engagement is covered in the ISO 37001 cost guide.

Where the requirements differ in practice

The difference an auditor will notice first is how prescriptive clause 8 is. ISO 37001 tells you which controls must exist for bribery: tiered due diligence on transactions, projects, business associates and personnel; financial controls such as approval limits and payment checks; non-financial controls over procurement and sales; controls applied by controlled organisations and higher-risk business associates; signed commitments; and a register for gifts, hospitality, donations and similar benefits. The bribery risk assessment guide and the due diligence guide explain how those are built.

ISO 37301 requires a different first question: what are your obligations? The register has to be systematic and current, linked to the processes and owners it touches, and the risk assessment has to be repeated when obligations or activities change. Controls and procedures under 8.2 then follow the register. Its performance evaluation names feedback sources, indicators, compliance reporting and record-keeping.

ISO 37001 also adds a review by the anti-bribery function itself (9.4). The raising-concerns and investigation clauses sit at 8.9 and 8.10 in ISO 37001 and at 8.3 and 8.4 in ISO 37301,, and one channel can serve both.

Which one do you need?

Before committing, ask who is asking, which standard they named, and whether bribery or regulatory breach in general is the risk your governing body worries about. If nobody is asking yet and bribery is not a material risk, a compliance system without certification, or no formal system at all for now, may be the accurate answer.

When both make sense, and how to run them as one system

Separate projects would duplicate almost everything. Because both follow the harmonised structure, one set of context, leadership, planning, support and improvement processes can serve both certificates. In practice the integration looks like this:

• One obligations register, in which anti-bribery laws are entries with their own owners and controls.
• One risk method, with the bribery risk assessment as a deeper module that ISO 37001 auditors can read on its own.
• One function holding both remits, provided it has the standing, authority and independence each standard expects, and reporting to the governing body in one report.
• One speak-up channel and one investigation process, with ISO 37002 as guidance for the channel.
• One internal audit programme and one management review, with agenda items for each standard.

Where to start depends on the pressure. If a tender deadline is fixed, certify ISO 37001 first and extend the system to the full register afterwards. If the regulator is the driver, build the ISO 37301 register first and treat bribery as its highest-risk module. Ask the certification body whether its accreditation covers both standards and whether it will plan the audits together. ISO 9001 or ISO/IEC 27001 can join the same system later on the same shared clauses.

ISO 37001 vs ISO 37301: questions buyers ask