Anti-bribery readiness
ISO 37001 checklist: are you ready for certification?
This checklist follows the clauses of ISO 37001 and names the evidence a company usually has on file for each point. Work through it in an afternoon and you will see where your anti-bribery system is complete and where it has gaps. The online self-assessment is the next step.
01: Overview
What an ISO 37001 checklist should cover
ISO 37001 uses the same clause structure as ISO 9001 and ISO 14001. Clauses 4 to 10 run from context to improvement. The checklist below keeps that order, so you can hand each part to the person who owns it: management for leadership, finance for controls, HR for training.
Each point has two parts: what to check and what evidence a company typically holds. In a company with 40 employees the evidence is modest. A signed policy, a risk register in a spreadsheet, a training attendance list and a payment approval rule are enough to answer most points.
02: Clauses 4 and 5
Context and leadership: the first five checklist points
These points decide how the rest of the system is built. If the bribery risk assessment is thin, every later control rests on guesswork.
Scope of the system
Write down which sites, business units and countries the system covers. Evidence: a one-page scope statement and the organisation chart.
Bribery risk assessment
Rate risk by country, sector, type of transaction and business partner, and set a review date. Evidence: a risk register with ratings and the date of the last update.
Interested parties
List who expects anti-bribery controls from you: customers, authorities, banks, group headquarters. Evidence: a short table of parties and their requirements.
Anti-bribery policy
The policy is approved by top management, forbids bribery in plain words and is communicated to staff and business partners. Evidence: the signed policy and proof of distribution.
Compliance function
One person holds responsibility for the system, independent of sales, with direct access to top management. In a small company this can be a part-time role. Evidence: appointment letter, job description, minutes of a meeting with management.
03: Clauses 6 and 7
Planning and support: objectives, training and records
Auditors and customers ask for the same thing here: proof that the policy reaches the people who could be offered or asked for a bribe.
Anti-bribery objectives
Set objectives you can measure, for example that every employee in sales and purchasing completes training each year. Evidence: an objectives list with owner and deadline.
Actions from the risk assessment
Each high risk has a control or action assigned to a named person. Evidence: an action plan linked to the risk register.
Resources
The compliance function has time and budget to do its work. Evidence: a time allocation or budget line.
Competence and training
Staff in exposed roles such as sales, purchasing, finance and project management receive training that fits their risks. Evidence: slides, attendance lists, short test results.
Employment process
Contracts refer to the policy, hiring for exposed roles includes background checks, and bonus schemes do not reward results at any price. Evidence: contract template, hiring checklist, bonus rules.
Documented information
Policy, procedures and records are approved, versioned and easy to find. Evidence: a document register with approval dates.
04: Clause 8
Operation: due diligence, controls and the reporting channel
Clause 8 carries the most weight. This is where the standard asks what you actually do on a Tuesday when an agent invoices a success fee or a customer offers tickets to a match.
Due diligence on business partners
Agents, distributors, intermediaries and joint venture partners are screened before the contract, in proportion to their risk. Evidence: completed questionnaires, screening results, a recorded approval decision.
Financial controls
Payments go only to the contracting party's account, large amounts need a second signature, and cash payments are restricted. Evidence: the payment authorisation rule and a sample of approved invoices.
Non-financial controls
Tenders and purchasing decisions involve more than one person, and conflicts of interest are declared. Evidence: tender files, signed declarations.
Gifts, hospitality and donations
Thresholds and an approval step are defined, and offers given or received are logged. Evidence: the rule with limits and the register.
Commitments from business partners
Contracts with higher-risk partners contain an anti-bribery clause and a right to end the relationship if it is breached. Evidence: contract templates and signed copies.
Reporting channel
Staff and third parties can raise concerns confidentially and are protected from retaliation. Evidence: a description of the channel, a notice to staff, an anonymised case log.
Handling suspicions
A written procedure says who investigates, who is informed and how the outcome is recorded. Evidence: the procedure and any case files, including closed ones.
05: Clauses 9 and 10
Performance evaluation and improvement: proof that the system is checked
A system that was set up once and never reviewed does not hold up in a customer audit. The last four points cover the review cycle.
| Clause | What to check | Typical evidence |
|---|---|---|
| 9 Monitoring | The compliance function reports to management on cases, training and control results. | Half-yearly or yearly report |
| 9 Internal audit | Someone independent of the audited area checks the system on a planned basis. | Audit plan and findings report |
| 9 Management review | Top management reviews the system at planned intervals and decides on changes. | Minutes with recorded decisions |
| 10 Improvement | Incidents and audit findings lead to corrective actions that are closed. | Action log with owner, date and closure |
If you can show a first internal review and one management decision, that is already more than many companies have when they begin.
06: With Zertify
From checklist to certificate with Zertify
Once most points on this list have evidence behind them, you can take the Zertify self-assessment. It has 38 yes/no questions for ISO 37001. Fourteen are must-meet questions that all need a yes, and at least 16 of the other 24 must also be answered yes. These are the core questions of the assessment, not every requirement of the standard, so keep using the checklist for your internal work.
SICE reviews every assessment before the certificate is issued. After you pass and pay, Zertify issues the certificate under licence from SICE within 4 hours. There is no on-site audit. The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit, and the certificate is valid for 3 years.
Every certificate has a number and a QR code on the PDF that leads to a public verification page. A purchasing department or a group compliance team can check it without contacting you. If a customer insists on the classic route with an on-site audit by a certification body, the guide on certification routes explains the differences.
07: FAQ
Questions about the ISO 37001 checklist
It should follow clauses 4 to 10: scope and risk assessment, policy and compliance function, training, due diligence, financial and non-financial controls, a reporting channel, internal audit and management review. For each point, note the document or record that proves it.
The standard asks for a compliance function with authority, independence and direct access to top management. In a small company this can be a part-time role. What matters is that the person is not under pressure from the sales line.
Questionnaires differ, but the usual requests are the signed anti-bribery policy, proof of training, a description of the reporting channel and a statement on how you screen agents and intermediaries. The checklist above produces most of these.
No. The checklist is your own readiness check. Certification requires passing the Zertify self-assessment, which SICE reviews before the certificate is issued.
Treat it as an action item with an owner and a date. Many gaps are closed with a short written rule or a signed form, for example a gift register or a conflict of interest declaration.
08: Guide
Related pages
Test your anti-bribery system against the assessment
The self-assessment shows in a few minutes whether your answers meet the ISO 37001 requirements.
Free and without registration.