ISO 37001 certification time
ISO 37001 duration: from months to hours
On the classic route with an on-site audit, ISO 37001 certification takes several months, mostly because of preparation and audit scheduling. With Zertify the assessment takes about an hour, and the certificate follows within 4 hours after passing and payment. Your anti-bribery system has to be in place before you start, whichever route you choose.
01: Short answer
How long does ISO 37001 certification take?
On the classic route, a small or medium company that starts without a working anti-bribery system should plan for roughly four to ten months from the first gap analysis to the certificate. These are indicative ranges. A company that already has a bribery risk assessment, a policy and a compliance function can be considerably faster.
The table puts the classic phases next to the Zertify route. The classic figures depend on company size, number of sites and the calendar of the certification body.
| Phase | Classic route (indicative) | Zertify route |
|---|---|---|
| Preparation and documentation | 2 to 6 months | Same work if your system is not yet in place |
| Internal audit and management review | 2 to 4 weeks | No separate step |
| Stage 1 audit | 1 to 2 days on site | No equivalent |
| Waiting time before stage 2 | 2 to 8 weeks | None |
| Stage 2 audit | 2 to 4 days on site | Online self-assessment, about 1 hour |
| Report, corrective actions, decision | 2 to 6 weeks | SICE review, certificate within 4 hours after passing and payment |
| Total | Roughly 4 to 10 months | Your preparation, then about 1 hour plus up to 4 hours |
02: Classic route
What happens in each phase of the classic route
A certification body audits an anti-bribery management system in two steps. Before the first auditor arrives, you have to build and run the system.
Preparation
You compare your current practice with the standard and close the gaps. The bribery risk assessment belongs here (clause 6, Planning), as does the decision who takes the compliance role and how that person reaches the management directly.
Documentation and implementation
The policy is written and communicated, due diligence procedures are defined for transactions, business associates and personnel, and financial and non-financial controls are put into operation (clauses 5 and 8). The reporting channel is set up and staff are told about it.
Internal audit and management review
Clause 9 requires you to check your own system before an outside body does. The findings and the management review go into the file the auditor will ask for.
Stage 1 audit
The auditor reviews your documentation and judges whether you are ready for stage 2. Open points are written down, and you correct them before the second visit.
Stage 2 audit and decision
The auditor interviews staff and looks at records to see whether the controls actually run. Findings need corrective actions before the certification body decides.
03: Delays
What makes the classic route take longer
The audit days are the shortest part of the timeline. Most of the waiting happens around them.
- Records of operation
- Stage 2 looks for evidence that the system has been running: due diligence files, training attendance, reports received through the channel. A system written last month has little to show.
- Several sites or countries
- Each additional site adds audit days and interviews. Companies with agents or distributors abroad need due diligence files for those relationships too.
- Auditor availability
- Certification bodies plan their audit calendar ahead. A gap of several weeks between stage 1 and stage 2 is common for that reason.
- Corrective actions
- A finding in stage 2 has to be fixed and accepted before the certificate is issued. A missing due diligence record can add weeks.
04: Zertify route
How long the Zertify route takes
The self-assessment has 38 yes/no questions and takes about an hour. 14 of them are must-meet questions that must all be answered yes. They are the core questions of the assessment, not every requirement of the standard. Of the other 24 questions, at least 16 need a yes answer. You do not need an account to start.
After you pass and pay, SICE reviews the assessment and Zertify issues the certificate within 4 hours under licence from SICE. The PDF carries a certificate number and a QR code that lead to a public verification page. A purchasing department can check the certificate there without contacting you.
The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years and is confirmed each year by a short online re-audit. There is no on-site audit.
05: Before you start
What you need in place before the one-hour assessment
The hour covers answering the questions, not building the system. If you would answer no to a core question, the time goes into the work behind it first. These are the areas the questions touch:
Bribery risk assessment
A written assessment of where your business is exposed, with a date for the next update.
Anti-bribery policy
A policy that management has approved and that staff and business partners have received.
Compliance function
A named person or team that operates independently and has direct access to the leadership.
Due diligence
Checks on transactions, business associates and personnel that match the risk.
Controls and reporting channel
Financial and non-financial controls in operation, and a channel through which staff can raise concerns without fear of retaliation.
06: Choosing
Which route fits your deadline?
A tender with a submission date in a few weeks rules out the classic route unless an audit is already booked. The same applies to a supplier questionnaire from a group customer that asks for an ISO 37001 certificate by the end of the month. In those cases the online route is the one that can meet the date.
Some customers or authorities specify in writing how the certificate has to be obtained. Read the requirement in the tender documents or the supplier code before you decide. If it asks for an on-site audit by a certification body, only the classic route will do.
Cost is the other half of the decision, and the classic route is usually priced by audit days.
07: FAQ
Questions about the duration of ISO 37001
Plan for roughly four to ten months as an indicative range. Preparation and documentation take the most time, and the waiting period between stage 1 and stage 2 adds weeks. Companies with a working system in place can be faster.
The self-assessment with 38 yes/no questions takes about an hour. You can start without an account. The certificate follows within 4 hours after you pass and pay.
Yes, if your anti-bribery system is already in place. The assessment takes about an hour and the certificate arrives within 4 hours after passing and payment. If you still have to write the policy or set up the reporting channel, that work comes first.
You need a yes on all 14 must-meet questions and at least 16 yes answers among the other 24. If you fall short, the questions you answered no show you what is missing. Close those gaps and run the assessment again.
The Zertify certificate is valid for 3 years. It is confirmed every year by a short online re-audit, which is included in the yearly fee. You can cancel in your customer account to the end of the current year, and the certificate then ends with the paid year.
08: Guide
Related pages
Find out in an hour whether you pass
Answer the 38 questions and see which core requirements you already meet.
Free and without registration.