ISO 37001 Anti-Bribery Management Consulting

ISO 37001 specifies requirements and guidance for an anti-bribery management system. It helps organisations identify bribery risks, set clear responsibilities, apply proportionate controls, encourage reporting and respond to concerns.

Certivanta supports management-system design and certification readiness. The system must be tailored to the organisation’s risks and obligations, and an independent certification body conducts the certification audit and decision.

The standard can support private companies, public entities, non-profit organisations, contractors and supply-chain participants. It is particularly useful where organisations operate through intermediaries, bid for work, manage donations or sponsorships, or engage with higher-risk markets and transactions.

• Anti-bribery policy, scope, oversight and responsibilities
• Bribery risk assessment and treatment planning
• Proportionate due diligence on projects and business associates
• Financial and non-financial controls, gifts and conflict processes
• Speak-up, investigation, corrective action, internal audit and management review

Not every relationship presents the same risk. We help establish criteria for assessing business associates, transactions and projects, then link the results to appropriate approval, contracting, monitoring and record-keeping controls. The process should be practical enough to operate consistently.

ISO 37001 can sit within a wider governance, risk and compliance framework. Shared processes for risk, competence, reporting, investigations and assurance can support consistency, while anti-bribery responsibilities and controls remain clearly defined.

No. Certification cannot guarantee the absence of bribery. The standard provides a framework for reasonable and proportionate prevention, detection, response and improvement measures.

No. Organisations remain responsible for applicable law and may need qualified legal advice for specific jurisdictions, investigations, reporting duties and contractual issues. Management-system support does not replace that advice.

No. Certivanta provides consulting and certification-readiness support. An independent certification body performs the certification audit and decides whether certification is granted.

An organisation bidding for work or operating through agents and subcontractors may face different bribery risks across tenders, gifts, sponsorships, approvals and supplier selection. ISO 37001 can establish risk-based due diligence, declarations, approval limits, contractual controls, speak-up routes and investigation responsibilities. The depth of review should follow risk rather than apply the same checklist to every party. Legal advice remains necessary where allegations, reporting obligations or jurisdiction-specific questions arise.

Effort is influenced by operating countries, transaction types, business associates, public-sector exposure, procurement processes and the maturity of ethics and investigation controls. Group structures and high-risk projects may require more interviews and due-diligence design. Legal services, forensic investigations, screening platforms, travel, the ISO standard and certification-body fees are excluded unless agreed. Review the consultation package and define the risk profile before comparing fees.

• Where do bids, intermediaries, gifts, donations or approvals create exposure?
• Who has independent authority for anti-bribery oversight?
• How is due diligence scaled to business-associate and project risk?
• Can people raise concerns safely and can investigations be protected?
• Which legal questions require qualified counsel?

Place anti-bribery controls within broader governance, risk and compliance, or discuss a proportionate implementation scope.