ISO 37003 implementation and requirements: a fraud control system that prevents, detects and responds.

What it is

What is ISO 37003 and what is it used for?

ISO 37003 is the international guidance standard for fraud control management systems. It shows an organisation how to develop, implement and maintain a system that deals with fraud risk from end to end: stopping fraud before it happens, finding it when prevention fails, responding when it is found, and improving the system with each lesson.

Most organisations already have fraud controls; few have fraud control. Approval limits sit in finance, background checks sit in HR, a hotline sits with legal and investigations happen when someone insists. ISO 37003 connects those pieces under leadership, so that fraud risk is recognised, monitored and acted on as one discipline. It covers fraud by insiders and outsiders, fraud through collusion between them, and fraud committed by or on behalf of the organisation itself.

Current edition. ISO 37003:2025 is the first edition, published by ISO in May 2025. ISO describes it as a guidance document, not a set of requirements, so it cannot be certified in the way ISO 37001 can. It is designed to sit alongside ISO 37001 and ISO 37301, which address bribery and compliance obligations.

Who it is for

Who needs ISO 37003?

ISO intends it for any organisation, from corporations and government bodies to charities and educational institutions. In practice, organisations come to Sterling for fraud control from four directions:

• A customer or lender wants to see your fraud controls. Supplier and lender questionnaires can ask how fraud is prevented, detected and handled. A programme aligned to an ISO standard gives a structured answer.
• A tender or public contract asks for integrity measures. Bid teams need to describe controls, a reporting channel and an investigation process with evidence behind them, not a policy alone.
• A regulator, auditor or board has raised fraud risk. After a loss, an audit finding or a new obligation, the governing body wants to know the organisation has a system, and your legal advisers have views on what the law requires.
• Group companies manage fraud differently. Subsidiaries run their own controls and hotlines, so nobody can see the whole picture. A common framework gives each entity local ownership and the group one view.

Requirements

What are the main ISO 37003 requirements?

Strictly, ISO 37003 has no requirements: it is a management system standard that gives guidance, and an organisation decides how far to adopt it. What buyers call its requirements are the areas the guidance expects a fraud control system to cover. At title level, ISO sets them out as follows; your programme is mapped against the full standard during the gap assessment.

• A fraud control management system: establish, implement, evaluate, maintain and improve fraud control as a system, with leadership direction, rather than as isolated controls.
• An environment that recognises fraud risk: make fraud risk visible and monitored across the organisation, with controls that act before losses occur.
• Prevention: reduce the opportunity for internal and external fraud, including collusive fraud and fraud by or on behalf of the organisation.
• Detection: find fraud when preventive measures have not stopped it.
• Response: act on fraud once found, limiting reputational harm and recovering what was lost.
• Continual improvement: feed what each fraud event and each review shows back into the system.

Putting it into practice

How do you implement ISO 37003?

Because there is no certificate, the test of an ISO 37003 programme is whether it operates and whether your governing body, auditors and stakeholders can see that it does. We work to that test in five steps.

1. 01
   Agree the scope and who owns fraud control.Entities, business lines and processes in scope, the fraud types that matter, and the leader accountable to the governing body.
2. 02
   Gap analysis: compare current practice with the guidance.The gap analysis tests existing controls, detection, reporting and investigation against ISO 37003, keeps what works and agrees actions, owners and dates.
3. 03
   Assess fraud risk and design the controls.Schemes are identified process by process; prevention, detection and response are designed to match, with roles, training and a reporting channel.
4. 04
   Operate, test and review.Controls run long enough to produce records; internal audit and management review test them, and we raise findings first and see them closed.
5. 05
   Show the result, and certify where a certificate is needed.A conformity report for your board and stakeholders; where a customer requires a certificate, an accredited body can certify a related standard such as ISO 37001.

Check the route before you sign. ISO 37003 is guidance, so ask anyone offering an "ISO 37003 certificate" what exactly was audited, against which requirements and under which accreditation, and verify the answer with the accreditation body. For ISO 37001 certification, confirm the certification body's accreditation covers anti-bribery management systems. The certification buyer's checklist

Cost

How much does ISO 37003 implementation cost?

The cost depends on how much fraud exposure you carry and how much of a system already exists. A single-entity charity with sound finance controls needs far less than a multi-country group with many agents, high cash volumes and no central reporting. Our proposal sets out every component and states everything that is included.

Timeline

How long does ISO 37003 implementation take?

Pace depends on the number of entities and processes to assess, how quickly leadership agrees ownership and thresholds, and whether detection data is available. As an estimate, a working programme takes about three to six months: controls must run and a review must be held before anyone can say the system works. We plan around that, with milestones your team tracks in Effivity. If a tender or audit date is fixed, tell us at the start.

Your engagement

What your ISO 37003 engagement includes

Sterling does not certify, and no certificate exists for ISO 37003; our work is to help you build a fraud control system that operates and to show the evidence. Engagements follow the Sterling OS™ phases.

• Design™: guided

  Your team builds the system with our method, templates, reviews and workshops. Suited to organisations with a capable compliance or audit function.

• Drive™: managed

  We manage the programme and do the heavy lifting with your people. An alternative to Design™, for teams short of time or expertise.

• Sustain™

  After go-live: periodic risk reassessment, internal audits, control testing and preparation for any certification of a related standard.

• Automate™: Effivity

  The fraud risk register, controls, cases and reviews run in Effivity, included with the engagement at no additional cost.

Any certificate for a related standard is decided by an independent, accredited certification body.

Often combined with

Standards organisations pair with ISO 37003

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
• ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
• ISO 22313 · ISO/TS 22317 · ISO/TS 22318ISO 22313 and ISO 22317 / 22318 guidance explained: applying ISO 22301, business impact analysis and supplier continuity.