ISO 37001:2025 Anti-Bribery Management
ISO 37001 for service companies
Service companies sell people, advice and access to decision makers. That is where bribery risk sits: gifts to client staff, commissions to intermediaries, favours around a tender. ISO 37001 shows your customers that you control these risks, and with Zertify you can complete the assessment online, without an on-site audit.
01: Demand
Why customers ask service companies for ISO 37001
A service company has no product that a buyer can inspect. The buyer relies on the people who deliver, and on how the contract was won and is run. This is why purchasing departments add anti-bribery questions to the supplier questionnaire, usually right below the code of conduct.
The request tends to arrive in one of three ways. A public body asks for evidence of anti-bribery precautions in a tender. A group customer passes its code of conduct down to all suppliers. Or a customer audit finds that your gift policy is one paragraph in the staff handbook. An ISO 37001 certificate answers all three with a single document and a verification page that the buyer can open himself.
The requests come most often to consultancies, facility management and security providers, staffing agencies, IT service providers and logistics firms that work across borders.
02: Risks
Where bribery risk sits in a service business
The risks follow the way services are sold: through relationships, through intermediaries and through people placed inside the customer's premises.
- Gifts and hospitality
- A consultancy invites the client's project lead to a weekend event while a contract extension is pending. The invitation itself is ordinary. The timing makes it a risk.
- Intermediaries and agents
- A staffing agency pays a finder's fee to a person who introduces a new client. Nobody checks who that person is or what he does for the fee.
- Subcontractors abroad
- A facility manager hires a local cleaning firm for a foreign site. The firm settles a dispute with an inspector in cash, and the invoice to you contains an unexplained item.
- Tender information
- An IT provider receives non-public details of a tender from a contact inside the buyer and adjusts its quote accordingly.
- Hiring and favours
- A firm offers an internship to the daughter of a purchasing manager shortly before the framework agreement is renewed.
03: Requirements
What ISO 37001 asks a service company to do
The standard sets out the elements of an anti-bribery management system. For a service company, each element translates into a concrete task.
| Requirement | In a service company |
|---|---|
| Bribery risk assessment, updated regularly | A review of client relationships, countries, intermediaries and subcontractors, repeated when you enter a new market or sign a large contract |
| Anti-bribery policy, communicated | A short policy that every employee receives, with a clear limit for gifts and invitations |
| Independent compliance function | A named person with direct access to the managing director, not reporting to sales |
| Due diligence | Checks on agents, subcontractors and new hires in sensitive roles before the contract is signed |
| Financial and non-financial controls | Two signatures on payments to third parties, a gift register, a rule on who may speak to the buyer during a tender |
| Reporting channel with protection | An external mailbox or trustee where staff can raise concerns without fear of retaliation |
04: In practice
How a small consultancy or agency meets the requirements
Size does not remove a requirement, but it changes how you meet it. A firm of forty people does not need a compliance department. It needs these steps done and written down.
Assess your own contracts
Go through the client list and mark which clients are public bodies, which projects run abroad and where an intermediary was involved. That list is your risk assessment.
Set a gift limit and keep a register
Fix an amount above which a gift or invitation needs approval. Record every approval, given or refused.
Name the compliance owner
Give one person the task, with the right to go straight to the managing director.
Check third parties before signing
Ask agents and subcontractors about ownership and references, and add an anti-bribery clause to the contract.
Split the approval of payments
Commissions, fees and donations to third parties need a second signature from someone outside the sales team.
Open a reporting channel
Tell staff where to report a concern and state in writing that nobody suffers for doing so.
05: Zertify
Getting the ISO 37001 certificate with Zertify
The Zertify certificate is based on an online self-assessment. There is no on-site audit. Zertify issues the certificate under licence from SICE, the Swiss Institute of Certification and Education, and SICE reviews every assessment before the certificate is issued.
The assessment has 38 yes/no questions. Of these, 14 are must-meet questions that must all be answered yes. They are the core questions of the assessment, not every requirement of the standard. Among the other 24 questions you need at least 16 yes answers. After you pass and pay, the certificate arrives within 4 hours.
Every certificate can be verified publicly by its number and by the QR code on the PDF, so a buyer in a purchasing department can check it in a minute. The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years. If you hold several Zertify standards, a discount of 20% applies for two standards and 30% for three or more, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. You do not need an account to buy.
06: Routes
Online certificate or the classic audit route?
Some tenders and customers name the route they accept. Read the tender documents or ask the purchasing department before you decide. If the requirement is an on-site audit by a certification body, the classic route is the one to take. Indicatively, it needs several weeks from first contact to certificate.
If the customer asks for proof of an anti-bribery system and does not prescribe how it is certified, the online route is shorter. The certificate is confirmed every year by a short online re-audit. A certificate does not replace the daily work: the policy only counts if your staff follow it when a client offers a favour.
07: FAQ
Questions about ISO 37001 for service companies
Yes. The standard applies to organisations of any size. A ten-person agency documents less than a group, but it needs the same elements: risk assessment, policy, compliance owner, due diligence, controls and a reporting channel.
That depends on the tender documents. If they ask for evidence of an anti-bribery management system, a certificate with a public verification page is a clear answer. If they prescribe an on-site audit by a certification body, ask the contracting authority before you buy.
The standard asks for independence and direct access to leadership, not for a job title. In a small firm the role is often given to one person alongside other duties. What matters is that this person can raise issues with the managing director without going through sales.
They are the core questions of the assessment. All 14 must be answered yes, otherwise you do not pass. They do not cover every requirement of the standard, so keep working on the rest in your company.
Yes. The subscription renews automatically each year and you can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the year you have paid.
08: Guide
Related pages
Find out whether your company passes
Answer the 38 questions of the ISO 37001 self-assessment and see your result straight away.
Free and without registration.