Is ISO 37001 mandatory?

No. ISO 37001 is an international standard published by ISO, not a statute. No authority obliges a company to hold the certificate, and holding it does not replace any legal duty.

Bribery is a criminal matter wherever you do business, and the standard does not change that. It describes a management system: a bribery risk assessment, an anti-bribery policy, an independent compliance function, due diligence, financial and non-financial controls and a protected channel for raising concerns. What your national law expects of your organisation is a question for your legal adviser.

The certificate is therefore voluntary. The pressure to obtain it comes from somewhere else.

The certificate turns from optional to necessary when someone with purchasing power writes it down. This happens in five places.

Supplier questionnaire

The purchasing department adds a line asking whether you hold ISO 37001 or run an equivalent anti-bribery system. A blank answer can stop the onboarding.

Tender

Public sector customers and large buyers can list the certificate as a selection criterion or award points for it. The exact wording is in the tender documents.

Group code of conduct

Suppliers to groups with a code of conduct are asked to prove that they have controls in place. A certificate is the shortest proof.

Customer audit

Instead of sending an auditor to your site, a customer may accept a certificate with a verification page.

Industry expectation

In construction, engineering, medical technology, commodity trading and logistics, business partners ask about bribery controls before they sign.

The request determines the evidence. Read it closely before you reply, because the wording tells you what the buyer will accept.

• Compare the certification routes

A customer deadline is measured in days. The classic route with an on-site audit by a certification body needs planning and an appointment. An online self-assessment does not.

1. 01

   Read the exact request

   Note whether the buyer asks for the certificate itself, for equivalent evidence, or for a named type of issuer.

2. 02

   Gather the basics

   Have your anti-bribery policy, your bribery risk assessment, the name of your compliance contact and a description of your reporting channel at hand.

3. 03

   Take the self-assessment

   It has 38 yes/no questions. 14 are must-meet questions and all must be answered yes. Of the other 24, at least 16 must be yes.

4. 04

   Pay and receive the certificate

   The certificate arrives within 4 hours after you have passed and paid.

5. 05

   Send it with the QR code

   The buyer scans the code on the PDF and lands on the public verification page.

Zertify issues the ISO 37001 certificate under licence from SICE, the Swiss Institute of Certification and Education. The basis is an online self-assessment, with no on-site audit. SICE reviews every assessment before the certificate is issued. Every certificate can be checked publicly by number and QR code.

The price is CHF 749 (€749) in the first year, then CHF 499 (€499) per year including the yearly online re-audit. The certificate is valid for 3 years and confirmed every year by that short re-audit. Billing is an automatic yearly subscription. You cancel in your customer account, at any time, to the end of the current year, and the certificate then ends with the paid year. You do not need an account to buy.

• ISO 37001 at Zertify
• Pricing
• Start the free self-assessment

A certificate shows that your anti-bribery management system meets the assessed requirements. It does not replace staff training or a sound decision on a single transaction. The 14 must-meet questions are the core questions of the assessment, not every requirement of the standard.

If a tender explicitly demands an on-site audit by a certification body, ask the buyer whether an online certificate is accepted. Do this before you apply, not after.

• Certification without an on-site audit
• ISO for small and medium businesses