ISO 37001:2025 Anti-Bribery Management
ISO 37001 consulting: when you need it and when you do not
A consultant builds your anti-bribery management system with you and prepares an on-site audit. If your goal is a certificate that a customer, a tender or a purchasing department can verify, there is a shorter route. With Zertify you complete an online self-assessment and receive the certificate within 4 hours after passing and payment.
01: Consultant role
What does an ISO 37001 consultant do?
ISO 37001 asks for a working anti-bribery management system, not a folder of documents. A consultant helps you build that system and gets it into a state where an auditor can examine it. Most of the work happens in your company, with your managers and your finance team.
The usual work packages follow the structure of the standard.
- Gap analysis
- The consultant compares what you do today with the requirements of the standard and lists what is missing.
- Bribery risk assessment
- Together you look at countries, business associates, public sector contacts, gifts and hospitality, and rate the risks. This belongs to clause 6, Planning.
- Policy and procedures
- The consultant drafts the anti-bribery policy, rules on gifts and donations, and the process for raising concerns.
- Due diligence and controls
- Checks on agents, suppliers and key personnel, plus financial controls such as dual approval of payments. These sit in clause 8, Operation.
- Training and internal audit
- Staff in exposed roles are trained, and an internal audit and a management review are run before the external audit, in line with clause 9.
02: Scope and rates
Typical scope and indicative day rates
The effort depends on company size, number of countries and how much is already documented. The figures below are indicative ranges for a small or medium business and vary from one consultant to the next.
| Work package | Indicative effort | Result |
|---|---|---|
| Gap analysis | 1 to 2 days | List of missing elements |
| Bribery risk assessment | 2 to 5 days | Documented risk register |
| Policy and procedures | 3 to 8 days | Policy, rules, reporting process |
| Training | 1 to 3 days | Trained managers and exposed staff |
| Internal audit and review preparation | 1 to 3 days | Audit report, management review |
Day rates for senior compliance consultants in Switzerland are indicatively between CHF 1'200 and CHF 2'200. At 8 to 21 days, consulting fees alone come to roughly CHF 10'000 to CHF 45'000. On the classic route with an on-site audit by a certification body, the audit fee comes on top.
03: Decision
Do you need a consultant for ISO 37001?
Not always. A consultant is worth the money when you have to build something that does not exist yet. If your company already has a policy, a compliance contact and basic controls, most of the consulting days would go to writing down what you do anyway.
Four questions help you decide.
Does a bribery risk assessment exist?
If not, an outside view helps, especially when you work with agents or in markets with a high corruption risk.
Who would act as compliance function?
The standard calls for independence and direct access to leadership. If nobody can take that role, a consultant can help you define it.
What does your customer actually ask for?
A supplier questionnaire or a code of conduct often asks only for proof of an anti-bribery system. A tender may demand an on-site audit. Read the wording before you commission anything.
How much internal time can you spend?
A managing director who can free up a few hours a week can often do without a consultant. Without that time, outside help makes sense.
04: Zertify
How Zertify certifies you without a consulting project
Zertify issues the ISO 37001 certificate under licence from SICE (Swiss Institute of Certification and Education). The basis is an online self-assessment. There is no on-site audit. SICE reviews every assessment before the certificate is issued.
The self-assessment has 38 yes/no questions. 14 of them are must-meet questions and all must be answered yes. They are the core questions of the assessment, not every requirement of the standard. Of the other 24 questions, at least 16 need a yes. Once you have passed and paid, the certificate arrives within 4 hours as a PDF with a number and a QR code. Anyone can check it on the public verification page.
The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years. The subscription renews automatically and can be cancelled at any time to the end of the current year in your customer account. If you cancel, the certificate ends with the paid year. You do not need an account to buy.
05: Preparation
What to have in place before you start the assessment
The questions revolve around the core elements of ISO 37001. If you can answer them honestly with yes, you pass. If not, you see where you stand and can close the gap yourself, or bring in a consultant for that one topic only.
- Risk assessment
- A written assessment of where bribery could occur in your business, reviewed on a regular basis.
- Anti-bribery policy
- A policy approved by management and communicated to staff and business associates.
- Compliance function
- A named person with direct access to leadership.
- Due diligence
- Checks on transactions, business associates and personnel in proportion to the risk.
- Controls
- Financial controls such as payment approvals, and non-financial controls such as rules on gifts.
- Reporting channel
- A way to raise concerns that protects the person reporting from retaliation.
Many companies hire a consultant for one or two of these points, typically the risk assessment, and complete the rest themselves.
06: FAQ
Questions about ISO 37001 consulting
No. A consultant helps if you have to build the system from scratch. With Zertify you answer 38 questions online and receive the certificate within 4 hours after passing and payment. You can use outside help for single topics if the assessment shows gaps.
Indicatively, senior consultants in Switzerland charge CHF 1'200 to CHF 2'200 per day, and an SME project runs for roughly 8 to 21 days. Actual quotes differ widely. Zertify costs CHF 749 in the first year, then CHF 499 per year including the online re-audit.
The answers must describe your company as it is. A consultant can help you prepare and check your answers. The responsibility for them stays with you, and SICE reviews every assessment before the certificate is issued.
You see which questions stand in the way. Close the gaps in your organisation, for example by writing the missing policy or naming a compliance contact, and take the assessment again. The assessment itself is free.
That depends on the customer. Many supplier questionnaires ask for proof of an anti-bribery system, and the QR code and the public verification page let the purchasing department check your certificate. If a tender expressly requires an on-site audit, you need the classic route.
07: Guide
Related pages
Find out where your anti-bribery system stands
The self-assessment takes a short session and shows at once whether you meet the requirements for the ISO 37001 certificate.
Free and without registration.