ISO 37001 for retail and trade

A supplier questionnaire from a retail group usually contains a block on integrity. Do you have an anti-bribery policy? Who is responsible for it? How do you check agents and distributors? Answering in free text takes time, and the purchasing department still has to judge the answer. A certificate with a verifiable number shortens that step.

Trade companies sit in the middle of the chain. They buy from producers, sell to chains or public bodies and move goods through forwarders, customs agents and local intermediaries. Every hand-over is a point where money, goods or favours can change hands. Customers know this, and so they ask.

Tenders add a second reason. Public sector buyers and large corporate customers may want evidence that a bidder has organisational precautions against bribery. ISO 37001 is the recognised standard for exactly that.

• ISO 37001 at a glance

The standard does not care about shop floors or warehouses as such. It looks at the points where someone can be influenced to decide in your favour, or where you could influence someone else. In trade, these points are fairly predictable.

The standard uses a few terms that read abstractly. In a trading company they translate into concrete things.

Business associate

Any party you work with commercially. In trade this means suppliers, forwarders, customs agents, sales agents, franchise partners and distributors.

Bribery risk assessment

A written review of where bribery could occur in your business. For an importer it covers the countries you source from, the border crossings you use and the customers you serve.

Due diligence

The check you run before engaging a business associate or approving a transaction. Example: asking a new agent in a high-risk market for ownership details and references before signing.

Gift and hospitality register

A simple log of offers made and received, with value, date and approver. A buyer who receives a case of wine from a supplier enters it and the line manager decides.

Compliance function

The person or team who owns the system and can speak directly to management. In a small trading company this can be a defined part-time role.

Reporting channel

A way for staff and partners to raise concerns, with protection against retaliation. A warehouse employee who sees a forwarder invoice that looks wrong needs somewhere to take it.

A company of 20 or 200 people does not need a large compliance department. It needs clear decisions, written down and applied.

1. 01

   Assess the risks per process

   Go through buying, selling, logistics and tenders. Note where money or favours could move and how likely that is. Repeat the review when you enter a new market or add a major supplier.

2. 02

   Publish an anti-bribery policy

   Management signs it. Staff receive it, and the key points go into supplier contracts and agent agreements.

3. 03

   Name the compliance owner

   Give one person the task and a direct line to the owner or managing director. Write down what that person may decide and what they must escalate.

4. 04

   Check business associates before you sign

   Apply a short due diligence form to new agents, distributors and forwarders. Higher-risk markets get a deeper check.

5. 05

   Set controls where money leaves the company

   Two signatures above a threshold, rebates matched to contracts, commissions paid only against documented services, no cash payments to intermediaries.

6. 06

   Open a reporting channel

   A dedicated mailbox or an external contact is enough to start. State clearly that reporting in good faith is protected.

You begin with an online self-assessment of 38 yes/no questions. Fourteen of them are must-meet questions, and all must be answered yes. They cover the core of the assessment, not every requirement of the standard. Of the other 24 questions, at least 16 must be answered yes. There is no on-site audit.

The assessment is reviewed by SICE, the Swiss Institute of Certification and Education. After you pass and pay, Zertify issues the certificate under licence from SICE within 4 hours. Every certificate can be checked publicly by number and QR code.

The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription that you can cancel at any time to the end of the current year in your customer account. The certificate then ends with the paid year. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein, and you do not need an account to buy. If you also hold or want other standards, 20% discount applies for 2 standards and 30% for 3 or more.

• Start the free self-assessment
• See pricing
• ISO 37001 on Zertify

The certificate is a PDF with a QR code. Attach it to a supplier questionnaire, add it to a tender file or link it in your quote. The buyer scans the code and lands on the verification page, where the certificate number and its status are shown. No emails back and forth.

Some tenders and customers name the certification route they expect. If yours does, read the requirement before you apply. The guides below explain how the online route differs from the classic route with an on-site audit by a certification body.

• Certification without an on-site audit
• Compare certification routes