Anti-bribery certificate for contractors
ISO 37001 for construction: prove your anti-bribery controls
Public clients, general contractors and project partners ask construction firms how they prevent bribery. ISO 37001 gives you a certificate to answer with. At Zertify you complete an online self-assessment of 38 yes/no questions and receive the certificate within 4 hours after passing and payment.
01: Demand
Why construction clients ask for ISO 37001
A tender for a public building, a framework agreement with a general contractor, a supplier questionnaire from an international group: any of them can contain a question about bribery. The wording is usually short. It asks whether you have an anti-bribery policy and whether you can prove it.
Construction is exposed in a particular way. Projects are large and run for years. Client, planner, subcontractors, suppliers and inspectors all take decisions that involve money. Clients know this, so they want evidence before they award, not after a problem appears.
ISO 37001 gives you a recognised structure for the answer. Instead of a one-page declaration, you hand the purchasing department a certificate with a number they can check online.
02: Risk areas
Where bribery risk sits in a construction project
The standard starts from a risk assessment of your own business. In construction, the same pressure points come up again and again.
- Permits and inspections
- Gifts or payments to speed up a building permit, a site inspection or a formal acceptance of completed work.
- Tender preparation
- Contact with client staff while the specification is written, inside information on competing bids, or price arrangements with other bidders.
- Subcontractors and agents
- A local agent or subcontractor who pays on your behalf, or whose invoices do not match the work performed.
- Site purchasing
- Cash purchases on site, supplier rebates that go to individuals, inflated delivery notes, material that never arrives.
- Hospitality and gifts
- Invitations to site visits, events or dinners for a client's project manager, especially shortly before a final account is signed.
- Variation orders
- Change orders approved without a documented reason, or approved by one person alone.
- Joint ventures and consortia
- A partner whose business practices you cannot see but whose conduct is attributed to the joint project.
03: Requirements
How a contractor meets the key requirements of ISO 37001
The standard follows the usual management system structure: context, leadership, planning, support, operation, evaluation, improvement. The table links six core requirements to what they look like in a building firm.
| Requirement | What it looks like in construction |
|---|---|
| Bribery risk assessment (Planning, clause 6) | A list of project phases and counterparties, each rated for bribery risk, reviewed when you enter a new market or client type. |
| Anti-bribery policy (Leadership, clause 5) | A signed policy from the owner or managing director, handed to every site manager and attached to subcontractor contracts. |
| Independent compliance function (Leadership, clause 5) | A named person who can go directly to the owner or board, for example the head of finance or legal, with time set aside for the task. |
| Due diligence (Operation, clause 8) | A check on new subcontractors, agents and joint venture partners before contract signature: ownership, references, payment details. |
| Financial and non-financial controls (Operation, clause 8) | Two signatures on variation orders and large payments, a gift and hospitality register, written approval for any contact with permit authorities beyond routine. |
| Reporting channel (Operation, clause 8) | A mailbox or hotline that a bricklayer, a site foreman or a supplier can use without fear of consequences. |
Evidence for each line is ordinary paperwork: the policy, the risk list, signed forms, the register. Most firms already hold part of it.
04: Small firms
What this looks like in a firm of 40 people
A mid-sized contractor rarely has a compliance department. The standard asks for the function, not for a department. In a small firm one person can carry it alongside other duties, as long as that person can reach the owner or the board without going through the line managers whose work they may need to question.
Take a civil engineering company with three active sites. The risk assessment fits on two pages. The gift register sits in the site manager's weekly checklist. New subcontractors fill in a one-page form with ownership, bank details and references before the first order. Variation orders above an agreed amount need a second signature from the office. A separate mailbox, read by the compliance person, serves as the reporting channel.
None of this needs software. It needs a decision by the owner, a few forms and the habit of using them. Clients who review your file during a customer audit look for exactly that: documents with dates and signatures that match what the site staff say.
05: With Zertify
How to get ISO 37001 certified quickly with Zertify
Zertify issues the certificate under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued. There is no on-site audit. The basis is an online self-assessment with 38 yes/no questions. Fourteen of them are must-meet questions that all need a yes. Of the other 24, at least 16 need a yes.
The assessment covers the core questions, not every requirement of the standard, so it works best once your policy, risk list and controls exist in writing.
Answer the questions
Sit down with the owner and the person who will act as compliance contact. Answer honestly; a no shows you where the gap is.
Close the gaps
Write the missing policy, set up the register or the reporting mailbox, then repeat the assessment.
Pass and pay
No account is needed to buy. The certificate follows within 4 hours after passing and payment.
Attach the PDF to your bid
Every certificate has a number and a QR code. A client's purchasing department checks it on the public verification page.
Some tenders prescribe an on-site audit by a certification body. Read the tender wording before you decide, and use the route guide if the requirement is unclear.
06: Cost
What the ISO 37001 certificate costs
The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.
Billing runs as an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year.
A contractor that also needs ISO 9001, ISO 14001 or ISO 45001 gets 20% off for two standards and 30% off for three or more, on the yearly fee as well.
07: FAQ
Questions about ISO 37001 for construction
That depends on the tender. Some ask for evidence of anti-bribery measures, and ISO 37001 is one recognised way to show it. Check the tender documents or the supplier questionnaire for the exact wording.
No. The standard describes what must be in place, not how big the company must be. A small firm can meet it with a short policy, a risk list, simple forms and a named compliance contact.
The certificate is issued within 4 hours after you pass the self-assessment and pay. Preparation time depends on what you already have in writing, such as a policy, a risk list and a gift register.
Every certificate carries a number and a QR code. The client enters the number or scans the code and sees the entry on the public verification page.
It covers your company's anti-bribery management system. Subcontractors come into it through the due diligence you carry out on them and the clauses in your contracts, not through a certificate of their own.
08: Guide
Related pages
Check where your firm stands on ISO 37001
Answer 38 yes/no questions and see which requirements your company already meets.
Free and without registration.