ISO 37001 cost: what you pay and where it comes from

The audit fee is only one of four items in the budget. Which of them dominates depends on how much of the anti-bribery system you already have in place.

ISO 37001 asks for a bribery risk assessment, due diligence and an independent compliance function. Those measures have to exist before you can claim them, so the organisational work is real on any route.

Certification body audit

The fee for the initial audit, usually calculated per audit day, with travel costs added.

Consulting

Optional external help to build the system and prepare for the audit.

Internal effort

Working hours of management, the compliance function, finance and HR.

Recurring costs

Surveillance audits between certificates and a recertification audit at the end of the cycle.

• Guide on certification cost

Certification bodies quote individually. The price depends on headcount, number of sites, countries of operation and your bribery risk profile. Business with public tenders, agents or customs exposure needs more audit time than a purely domestic service company.

As an indicative range only: for a small or medium company, the initial audit falls somewhere between several thousand francs and the low five figures, with travel costs on top. These are orientation values, not offers. Ask at least two bodies for a quote and check what each quote covers over the full three-year cycle.

• Certification without an on-site audit

Many companies hire a consultant to draft the policy, run the risk assessment and prepare for the audit. Project sizes and day rates vary too much for a reliable figure. Indicatively, support can cost about as much as the audit itself, or more if you outsource most of the work.

Internal effort never appears on an invoice, but it is real. These are the pieces your team has to deliver:

1. 01

   Risk assessment

   Map where bribery could occur, such as public tenders, agents, customs, gifts and hospitality, and repeat the exercise regularly.

2. 02

   Policy and communication

   Write the anti-bribery policy and make sure staff and business associates have received it.

3. 03

   Compliance function

   Name someone independent who has direct access to management.

4. 04

   Due diligence and controls

   Check transactions, business associates and personnel, and set approval rules in finance for payments to intermediaries.

5. 05

   Reporting channel

   Provide a way to raise concerns that protects the person reporting from retaliation.

A classic certificate runs for three years. In the years between, the certification body returns for surveillance audits. At the end of the cycle a recertification audit follows. Surveillance audits are shorter than the initial audit, recertification is closer to it in scope. Each visit is invoiced again, and travel costs recur.

Add the staff time around every visit, plus the effort of keeping the risk assessment and due diligence records current. Budget for the whole cycle, not for the first year alone.

The table sets the classic route against the Zertify route. Classic figures are indicative ranges and depend on the quote you receive.

• Compare the certification routes

You answer 38 yes/no questions online. 14 of them are must-meet questions and all need a yes. They cover the core of the assessment, not every requirement of ISO 37001. Of the other 24 questions, at least 16 need a yes. SICE reviews every assessment, and Zertify issues the certificate under licence from SICE within 4 hours after you pass and pay.

The certificate is valid for 3 years and confirmed each year by a short online re-audit. Your customers can check it on the public verification page with the certificate number or the QR code on the PDF. Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year. You do not need an account to buy.

If you certify more than one standard, you get 20% off for two standards and 30% off for three or more, also on the yearly fee. For customers in Switzerland and Liechtenstein, prices include 8.1% VAT.

• ISO 37001 at Zertify
• Pricing
• Start the free self-assessment