ISO 37001:2016
ISO 37001 certification online: Anti-Bribery Management by self-assessment
With the ISO 37001 certificate from Zertify you show your management system to customers and purchasing teams. ISO 37001 certification works by self-assessment, with no on-site audit. It costs CHF 749 in the first year, then CHF 499 per year with an online re-audit.
- Questions
- 34
- Mandatory requirements
- all 13
- Other questions
- min. 14 of 21
- Validity
- 3 years
- First-year price
- CHF 749
01: Overview
What is ISO 37001?
ISO 37001:2016 sets the requirements for an anti-bribery management system (ABMS). It calls for a bribery risk assessment, a clear anti-bribery policy, an independent compliance function, risk-based due diligence, financial and non-financial controls and a protected channel for raising concerns. A company uses it to show that it has taken reasonable organisational precautions against bribery.
02: Benefits
What it gives you
- Documented organisational precautions against bribery
- Evidence for public buyers and corporate customers
- Clear rules for gifts, hospitality and donations
- Structured checks on business associates and intermediaries
- Protected channel for reporting misconduct
- Lower reputational and liability risks in international business
03: Who it is for
Who is ISO 37001 for?
- Companies with public sector customers
- Exporters and internationally active SMEs
- Construction, engineering and infrastructure
- Healthcare and medical technology
- Commodity trading and logistics
- Suppliers to groups with a code of conduct
04: Requirements
Key requirements
Assess bribery risks and update them regularly
Establish and communicate an anti-bribery policy
Independent compliance function with direct access to leadership
Due diligence on transactions, business associates and personnel
Implement financial and non-financial controls
Operate a reporting channel with protection against retaliation
05: Demand
Who asks for ISO 37001?
Under art. 102 of the Swiss Criminal Code, a company can be liable for bribery under art. 322ter ff. if it has not taken all necessary and reasonable organisational precautions. ISO 37001 is not legally required, but it documents such precautions and is mainly asked for here.
- Public procurement and state-related customers
- Public buyers, state-owned enterprises and development finance institutions ask about anti-corruption measures in tenders and supplier checks.
- International groups and their supply chains
- Large companies bind suppliers to anti-bribery rules through codes of conduct and ask for evidence that those rules are applied.
- Exporters and sectors with public official contact
- Construction, engineering, healthcare and commodity trading often deal with public officials and intermediaries. That is where bribery risk is highest.
06: Cost
What does ISO 37001 cost? Audit, consulting or self-assessment
With ISO 37001, the number of countries, business associates and the risk profile drive the effort. For a company with 10 to 50 employees, these indicative ranges apply.
| Route | Indicative range | What is behind it |
|---|---|---|
| Accredited audit | Indicative CHF 6,000 to 14,000 initial audit, then 3,000 to 6,000 per year | The price follows the number of sites, international activities and the risk profile. A domestic business with few intermediaries is considerably cheaper to audit. |
| Consulting and implementation | Indicative CHF 10,000 to 35,000 one-off | Risk assessment, policy, due diligence procedures, gift rules and training. Checking many business associates is often the biggest item. |
| Zertify self-assessment | CHF 749 in year 1, then CHF 499 per year | You check whether risk assessment, policy, compliance function, due diligence, controls and reporting channel are demonstrably in place. It does not replace legal advice on individual cases. |
All amounts are non-binding indicative ranges for Swiss SMEs, not quotes. Only the providers' own quotes are binding.
07: Duration
How long does ISO 37001 take?
For ISO 37001 risks have to be assessed and business associates checked, so the accredited route usually takes six to twelve months.
| Phase | Accredited | Zertify |
|---|---|---|
| Risk assessment and set-up | 3 to 6 months for risk assessment, policy, controls and training | None. You answer the questions based on where you stand today |
| Assessment | Stage 1 and 2, plus interviews and samples of payments and contracts | About 25 to 35 minutes online, scored immediately |
| Certificate | Release after 2 to 6 weeks, then annual surveillance audits | PDF with QR verification within 4 hours |
08: Sample questions
Sample questions from the ISO 37001 assessment
Four of 34 questions from the catalogue, and why they count.
Do you carry out a documented bribery risk assessment that is prioritized against set criteria and updated regularly and whenever significant changes occur?
The risk assessment is the foundation. Only it shows which countries, deals and partners need specific controls.
Are business associates such as intermediaries, agents, joint venture partners and suppliers checked on a risk basis before and during the relationship?
Bribery often runs through intermediaries and agents. If you do not check your business associates, you miss the biggest risk.
Are there rules and approvals for gifts, hospitality, donations, sponsorships and similar benefits designed to prevent bribery?
Gifts and invitations are part of everyday business. Without clear limits and approvals, courtesy quickly turns into an improper benefit.
Can personnel and third parties report suspicions in confidence or anonymously, and are those who report protected against retaliation?
Many cases come to light through reports. A reporting channel only works if people can report in confidence and are protected.
09: Assessment
How the assessment works
The assessment has 34 yes/no questions, online and at your own pace. 13 of them are mandatory requirements of the standard and must all be answered yes. Of the other 21 questions you need at least 14 yes.
| The questions fall into these topics: | Questions | Mandatory |
|---|---|---|
| Context and bribery risks | 4 questions | 2 |
| Leadership | 5 questions | 2 |
| Planning and objectives | 2 questions | 0 |
| Support and personnel | 6 questions | 2 |
| Operational planning and due diligence | 3 questions | 1 |
| Controls and business associates | 6 questions | 1 |
| Raising concerns and investigations | 2 questions | 2 |
| Performance evaluation | 4 questions | 2 |
| Improvement | 2 questions | 1 |
10: Price
Price and validity
First-year price
CHF 749
- From year 2
- CHF 499 per year
- Validity
- 3 years
Your customer requires an audit or an accredited certification? Clarify requirements
Included in the price
- Online assessment with 34 questions
- Certificate as PDF, issued under licence from SICE
- QR code on the PDF and a public verification page
- 3 years of validity
- Yearly online re-audit
- Support by email
The verification page shows the status, standard and validity of every certificate. Read more in the FAQ
See the sample and assessment methodChecklist
ISO 37001:2016 checklist by email
All 34 questions of the ISO 37001 self-assessment as a PDF to tick off, ordered by topic. Free, by email.
11: More standards
More standards
Many companies combine several standards. Two or more earn a discount.
- ISO 9001:2015: View standard
Quality Management
Procurement, supplier evaluation and approvals are already defined in the QM system and can be extended with anti-bribery controls.
from CHF 599
- ISO 27001:2022: View standard
Information Security Management
A confidential reporting channel and protected investigation records depend on working information security.
from CHF 849
- ISO 22301:2019: View standard
Business Continuity Management
A bribery case can end contracts and supply relationships abruptly, and continuity planning then keeps operations running.
from CHF 749
13: Questions
Frequently asked questions about ISO 37001
ISO 37001 certificate within 4 hours.
The assessment is free. You pay only once you have passed.
The verification page shows the status, standard and validity of every certificate.