ISO 37001:2025 Anti-Bribery Management
ISO 37001 for healthcare: prove your anti-bribery system to hospital buyers
Hospitals, tender offices and corporate customers want to see that your dealings with physicians, purchasers and distributors are controlled. ISO 37001 is the standard that documents this. With Zertify you complete an online self-assessment and receive a verifiable certificate within 4 hours after passing and payment.
01: Demand
Why do hospitals and medtech buyers ask for ISO 37001?
Healthcare runs on relationships between suppliers and the people who decide what gets bought. A surgeon chooses an implant. A purchasing department awards a framework contract. A laboratory head picks a reagent supplier. Every one of these decisions involves money, and every one is a point where an improper advantage could change the outcome.
This is why supplier questionnaires and tender documents contain questions about anti-bribery measures. A sentence such as "we do not tolerate corruption" answers nothing. A certificate against ISO 37001 shows a documented system: a risk assessment, a policy, a compliance function, controls and a reporting channel.
The questions reach medical technology manufacturers, distributors of devices and consumables, laboratories, service providers to hospitals and suppliers to groups with a code of conduct. If you sell to an institution that buys through public tenders, expect the question sooner or later.
02: Risks
Which bribery risks in healthcare does the standard address?
ISO 37001 does not prescribe a list of risks. It asks you to find the ones in your own business, rate them and control the serious ones. In healthcare the same situations come up again and again.
- Consulting and speaker fees
- A physician is paid for a lecture or an advisory role. The fee must match a real service at a fair rate. Otherwise it is a payment for influence.
- Congress sponsorship and travel
- Paying for a hospital employee to attend a congress abroad. The line between training and reward is thin, especially when the trip includes extras.
- Demo units and free samples
- Devices placed on loan without a return date, or samples that end up in a private practice. A register of every unit shows where it went.
- Distributors and agents
- A foreign agent wins hospital contracts on commission. You answer for what that agent does in your name.
- Contact before the tender
- Informal talks with the people who write the specification, before the tender is published.
- Donations and research grants
- Money paid to a clinic or a foundation shortly before a purchasing decision.
Not every item applies to every company. A laboratory supplier with a few domestic customers has a shorter list than a device manufacturer selling through agents in several countries.
03: In practice
How a healthcare company meets the key requirements
The requirements sit in the clauses on context, leadership, planning, operation and evaluation. The table shows what they look like in a company that sells to hospitals.
| Requirement | Example in a healthcare company |
|---|---|
| Bribery risk assessment | A list of every contact point with hospital staff, purchasers and agents, rated by likelihood and impact, reviewed once a year and when a new market is entered. |
| Anti-bribery policy | A short document on gifts, hospitality, fees and sponsoring, handed to every sales employee and every distributor. |
| Independent compliance function | One person outside the sales team with direct access to the managing director. |
| Due diligence | A questionnaire for every new agent or consultant before the contract: ownership, references, any link to hospital decision makers. |
| Financial and non-financial controls | Two signatures on payments to consultants, fees checked against the work delivered, a register of demo units. |
| Reporting channel | An external mailbox or ombudsperson, with a written rule that reporting staff are protected from retaliation. |
04: Preparation
What should be in place before you start the self-assessment?
Most of the answers come from documents a company with a working compliance habit already has, or can write in a few days.
Write down your bribery risks
Go through sales, purchasing, marketing and event budgets. Note where money or benefits reach someone who influences a purchase.
Name the compliance person
In a small company this can be a manager with other duties, as long as the role is separate from sales targets.
Put the policy in writing
One or two pages, signed by management, available to staff and business partners.
Prepare the due diligence form
Use it for new distributors, agents and consultants. Keep the completed forms.
Open a reporting channel
Staff and third parties need a way to raise concerns without fear of consequences.
05: With Zertify
How to get ISO 37001 certified with Zertify
You answer 38 yes/no questions online. Fourteen of them are must-meet questions and all must be answered yes. They cover the core of the assessment, not every requirement of the standard. Of the other 24 questions, at least 16 must be yes. Once you have passed and paid, the certificate arrives within 4 hours.
The certificate is issued by Zertify under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued. There is no on-site audit. Each year a short online re-audit confirms the certificate, and the certificate is valid for 3 years.
A purchaser can check the certificate on the public verification page, using the number or the QR code on the PDF. That saves your sales team the back and forth when a hospital's purchasing department asks for proof.
The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. Billing is an automatic yearly subscription that you can cancel at any time to the end of the current year; the certificate then ends with the paid year. If you certify two standards, 20% off applies, and 30% from three. You do not need an account to buy.
Some tenders explicitly require an on-site audit by a certification body. Read the tender text before you decide, and compare the routes in our guide.
06: FAQ
Questions about ISO 37001 in healthcare
The standard is voluntary. Whether you need it depends on your customers. Hospitals, public tenders and groups with a code of conduct increasingly ask for proof of anti-bribery measures, and the certificate is a compact way to give it.
Yes. The standard scales with the size and risk of the business. A small company can run it with a short risk list, a one-page policy and a part-time compliance person, as long as the controls work in daily business.
Someone who is not under pressure from sales targets and who can speak directly to the managing director. This can be a finance or quality manager with extra responsibility. A pure sales manager is not suitable.
The assessment is based on ISO 37001:2025. The 38 questions cover the core of the anti-bribery management system. Fourteen are must-meet questions that must all be answered yes.
That is the buyer's decision. Check the tender or the supplier questionnaire for the wording. Buyers can verify your Zertify certificate online by number or QR code, which usually settles questions about authenticity.
07: Guide
Related pages
Check where your anti-bribery system stands
Answer the 38 questions of the ISO 37001 self-assessment and see at once whether you pass.
Free and without registration.