ISO 37001 renewal: how to keep your certificate valid

The certificate runs for 3 years. Within that period it does not stand on its own: each year the company confirms it in a short online re-audit. The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit.

Anyone who checks your certificate sees the same thing you do. Every certificate has a number and a QR code on the PDF, and both lead to a public verification page.

Validity period

3 years from issue.

Yearly confirmation

A short online re-audit, done in the customer account and covered by the yearly fee.

Evidence for third parties

The certificate number or QR code opens the public verification page, which a purchasing department or a customer audit can use directly.

• How the process works

The re-audit asks whether your anti-bribery management system still matches what you declared a year ago. Companies change faster than their documents, so a short internal review before the re-audit date is worth the hour it takes.

Go through these points and fix gaps before you answer.

1. 01

   Bribery risk assessment

   Check whether new countries, public sector customers, agents or large contracts have changed your risk picture. Update the assessment and note the date.

2. 02

   Anti-bribery policy

   Confirm that the current version is signed off by leadership and that staff and business associates have received it.

3. 03

   Compliance function

   Make sure the person responsible is still in place, still independent of sales targets and still has direct access to leadership.

4. 04

   Due diligence records

   Look at new suppliers, intermediaries and key hires since the last re-audit. Each should have a documented check proportionate to its risk.

5. 05

   Financial and non-financial controls

   Review approval limits, rules on gifts and hospitality, and the way payments to third parties are released.

6. 06

   Reporting channel

   Test that the channel works, that staff know it exists and that protection against retaliation is stated in writing. Record any report received and how it was handled.

Some events call for an immediate update of the risk assessment and the affected controls: entering a new export market, taking on a distributor or agent, winning a public tender, acquiring another company or a reported bribery concern.

Deal with these when they happen and file the result. At the re-audit you then answer from current records instead of reconstructing the year from memory.

The yearly re-audit is a condition of the certificate. If it is not completed on time, the certificate is no longer confirmed for that year. Do not plan on a grace period, and do not show the certificate to customers or in a tender as current until the re-audit is passed.

Cancelling is a separate matter. The subscription can be cancelled at any time in the customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year.

• General questions and answers

On the classic route with an on-site audit by a certification body, a certificate also runs for three years. In between, the body returns for surveillance audits, and at the end of the cycle a recertification audit decides whether a new cycle starts. Visits are scheduled with auditors and take staff time on site.

The Zertify routine follows the same yearly rhythm but is done online and is shorter. Which route a customer or tender expects is worth clarifying before you choose.

• Compare the certification routes
• Certification without an on-site audit

You start with the online self-assessment: 38 yes/no questions on the anti-bribery management system. 14 of them are must-meet questions and all need a yes. Of the other 24, at least 16 need a yes. After you pass and pay, the certificate arrives within 4 hours. It is issued by Zertify under licence from SICE, and SICE reviews every assessment before the certificate is issued.

From then on the yearly re-audit keeps it running. Multi-standard discounts of 20% for 2 standards and 30% for 3 or more also apply to the yearly fee. For customers in Switzerland and Liechtenstein, prices include 8.1% VAT.

• ISO 37001 at Zertify
• Pricing
• Start the free self-assessment