ISO 37001:2025 Anti-Bribery Management
ISO 37001 requirements for business owners
ISO 37001 asks you to know your bribery risks, set a policy, appoint an independent compliance function, check your business partners, control payments and offer a protected way to raise concerns. The requirements sit in clauses 4 to 10. This page explains each clause and the documents that usually back it up.
01: Overview
What does ISO 37001 require of a company?
ISO 37001 describes an anti-bribery management system. It does not list forbidden acts, because the law does that. It asks how your company organises itself so that bribery is unlikely and gets noticed if it happens.
The standard cannot promise that no employee or agent will ever offer a bribe. What you can show with it is that you took reasonable organisational precautions: you assessed the risk, set rules, trained the people concerned and checked that the rules work.
The structure follows the same ten-clause layout as other ISO management standards. Clauses 1 to 3 cover scope, references and terms. The requirements you must meet are in clauses 4 to 10.
02: Clauses 4 to 6
ISO 37001 requirements in clauses 4 to 6: context, leadership, planning
These three clauses set the foundation. They decide what the system covers, who is responsible and what it aims to achieve.
- Clause 4, Context
- You describe your organisation, the parties with expectations of it (customers, authorities, agents, suppliers) and the scope of the system. This clause also contains the bribery risk assessment: where bribery could occur in your business, how likely it is and how serious the consequences would be. Usually documented: the scope statement and the risk assessment with date and owner.
- Clause 5, Leadership
- The governing body and top management approve the anti-bribery policy and show that they stand behind it. A compliance function gets authority, independence and direct access to leadership. Usually documented: the signed policy, role descriptions and the reporting line of the compliance function.
- Clause 6, Planning
- You turn the identified risks into actions and set anti-bribery objectives that can be measured. Each objective has an owner, a deadline and a way of checking it. Usually documented: the objectives, the action plan and how changes to the system are planned.
03: Clauses 7 to 10
ISO 37001 requirements in clauses 7 to 10: support, operation, evaluation, improvement
Here the policy meets daily work. Clause 8 is the longest and the one that auditors spend most time on.
- Clause 7, Support
- You provide resources and competent people. Staff in exposed roles such as sales, purchasing and finance receive training that matches their risk, and the policy is communicated inside and outside the company. Usually documented: training records, evidence of communication and controlled documents.
- Clause 8, Operation
- This clause covers the actual controls. Financial controls include payment approvals and separation of duties. Non-financial controls cover procurement, contracts and tenders. Due diligence applies to transactions, business associates and personnel. You also need rules for gifts, hospitality and donations, a reporting channel with protection against retaliation, and a process to investigate reports. Usually documented: due diligence files, approval records, a gifts and hospitality register, contract clauses for partners, and case files.
- Clause 9, Performance evaluation
- You monitor whether the system works. Internal audits run at planned intervals, top management reviews the results, and the compliance function reports to leadership. Usually documented: the audit programme, audit reports and management review minutes.
- Clause 10, Improvement
- When a rule is broken or a control fails, you correct the problem, find the cause and change the system so it does not recur. Usually documented: a log of nonconformities with corrective actions and their outcome.
04: Documentation
Which documents do you need to keep for ISO 37001?
The standard names some documents directly and leaves others to your judgement. The table lists the records that a customer audit or a purchasing department is most likely to ask for.
| Record | Clause | What it shows |
|---|---|---|
| Scope of the system | 4 | Which parts of the company and which activities the system covers |
| Bribery risk assessment | 4 | Where bribery could arise and how you rated the risk |
| Anti-bribery policy | 5 | Management commitment and the rules everyone must follow |
| Compliance function role description | 5 | Authority, independence and access to leadership |
| Objectives and action plan | 6 | What you want to achieve and who is responsible |
| Training records | 7 | Who was trained, when and on which topics |
| Due diligence files | 8 | How you checked partners, projects and key personnel |
| Gifts and hospitality register | 8 | What was given or received and who approved it |
| Internal audit report | 9 | Whether the system works in practice |
| Corrective action log | 10 | How problems were fixed and prevented |
A short, current record is worth more than a long one nobody reads. Auditors look for dates, names and evidence that the rule was applied.
05: Small companies
How do the requirements apply to a small company?
The standard asks for measures that fit your size and your risk. A 30-person engineering firm that bids on public tenders needs more than a small retailer that sells only to private customers. The clauses stay the same, but the depth of the controls differs.
In a small company the compliance function can be combined with other duties. What counts is that the person has authority, acts independently and can reach management directly. Due diligence also scales: a quick check for a local supplier, a documented review for an agent in a high-risk market.
06: Zertify
How does Zertify assess the ISO 37001 requirements?
Zertify turns the core of the standard into an online self-assessment with 38 yes/no questions. Fourteen of them are must-meet questions and all must be answered yes. They cover the core questions of the assessment, not every requirement of the standard. Of the other 24 questions, at least 16 need a yes to pass.
SICE reviews every assessment. After you pass and pay, Zertify issues the certificate under licence from SICE within 4 hours. There is no on-site audit. Each certificate carries a number and a QR code on the PDF that leads to a public verification page, so a customer can check it in seconds.
The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years. If you want to compare this with the classic route, an on-site audit by a certification body, the guide on certification routes sets them side by side.
07: FAQ
Questions about ISO 37001 requirements
The requirements are in clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. Clauses 1 to 3 only cover scope, references and terms. Most of the practical controls, such as due diligence and financial controls, are in clause 8.
No. The standard requires a compliance function with authority, independence and direct access to leadership. In a small company this can be combined with other duties, as long as the person is not under pressure from those whose conduct they review.
The standard requires documented information that it names itself and what the organisation finds necessary for the system to work. In practice customers ask for the policy, the scope, the risk assessment, objectives, training records, audit results and corrective actions.
No. It reduces the risk and shows that your company took reasonable precautions. It also gives employees a protected way to report concerns, so problems come to light early.
Yes. The self-assessment is free and needs no registration. You answer the 38 questions and see at once whether you pass. Payment is only due when you want the certificate.
08: Guide
Related pages
Check your ISO 37001 position today
Answer 38 yes/no questions and see whether your anti-bribery measures meet the requirements.
Free and without registration.