ISO 37001 Certification for Anti-Bribery Management Systems
ISO 37001 is the international standard for preventing, detecting, and responding to bribery. Certification shows public buyers, partners, and regulators that bribery risk is controlled in how you bid, hire, and pay. Accredify Global audits against the 2025 edition, including transition audits from 2016, with senior-led audits and a fixed fee. Most organizations certify in 6–12 weeks.
What Is ISO 37001 Certification?
ISO 37001 certification is independent confirmation that an organization runs an anti-bribery management system that meets the 2025 edition of the standard. The auditor checks how you assess bribery risk, vet business associates, and control payments, gifts, and hospitality. They also check how concerns are raised and investigated. A successful audit leads to a certificate valid for three years.
The standard covers bribery in both directions: bribes offered by your people and agents, and bribes offered to them. It applies to public officials and private-sector dealings alike, in any country where you operate.
Accredify Global audits real transactions. We sample tenders, agent agreements, expense claims, and gift registers, and we interview people in roles where bribery risk is highest.
The 2025 Edition and the February 2027 Transition Deadline
The second edition is now current. ISO published it in February 2025, replacing the 2016 edition. The transition guidance describes the overall impact as minimal, but several changes need real evidence at audit.
New certificates already use the 2025 edition. Under IAF MD 30, initial certifications and recertifications have used the 2025 edition only since 31 August 2026. Organizations certified to 2016 must transition by 28 February 2027, after which 2016 certificates lapse.
Most transitions happen at a planned visit. If your next surveillance or recertification audit falls before the deadline, the transition can be combined with it. Otherwise, a short special audit may be needed.
Sources: IAF MD 30:2025 transition requirements (IAF) · ISO 37001:2025 overview (ANSI) · Transition bulletin (SCC)
Who Needs ISO 37001 Certification?
Organizations where one bribe could cost a contract, a license, or a reputation.
Public tenders, permits, and inspections. See ISO for construction.
Government procurement and offset deals. See ISO for defense.
Licenses, customs, and local partners. See ISO for oil and gas.
Relationships with prescribers and buyers. See ISO for healthcare.
Third parties and high-risk markets. See ISO for banking.
Agencies and state-owned companies. See ISO for the public sector.
What the 2025 Edition Changes
These are the points transition audits focus on.
| Area | What is new or changed | Evidence the auditor reviews |
|---|---|---|
| Climate change | Considered as part of context and interested parties | A recorded decision on whether it is relevant |
| Compliance culture | Stronger emphasis on culture, not just policy | Leadership messages, training, and staff awareness |
| Conflicts of interest | Addressed directly in the standard | Declarations and how conflicts are managed |
| Compliance function | Role of the anti-bribery function clarified | Authority, independence, and access to leaders |
| Harmonized structure | Latest common structure, including planning of changes | Changes to the system planned and controlled |
ISO 37001 Certification Requirements, Clause by Clause
The common structure, with the anti-bribery controls in clause 8.
| Clause | What it requires | What the auditor checks |
|---|---|---|
| 4. Context | Context, interested parties, scope, and bribery risk assessment | A risk assessment that names real exposures |
| 5. Leadership | Governing body oversight, policy, roles, and the compliance function | Board reports and an independent function |
| 6. Planning | Actions on risks, objectives, and planning of changes | Objectives tied to the risk assessment |
| 7. Support | Resources, competence, employment controls, awareness, and training | Vetting for sensitive roles and training records |
| 8. Operation | Due diligence, financial and non-financial controls, gifts, and reporting concerns | Payments, agents, and investigations sampled |
| 9. Performance | Monitoring, internal audit, and management review | Audit results and governing body reviews |
| 10. Improvement | Nonconformity, corrective action, and improvement | Lessons from incidents acted on |
How It Fits With Anti-Bribery Laws and Other Standards
Certification supports legal compliance. It does not replace legal advice or guarantee an outcome.
| Law or standard | What it expects | How the standard helps |
|---|---|---|
| UK Bribery Act 2010 | A defense for companies with adequate procedures | Gives a structured record of those procedures |
| US FCPA | Effective compliance programs and accurate books | Financial controls and due diligence evidence |
| ISO 37301 | Compliance management across all obligations | Same structure; can be audited together |
| ISO 9001 | Quality management | Shared document and audit processes |
| ISO 27001 | Information security | Protects speak-up and investigation records |
How Anti-Bribery Certification Works
For new certificates and 2016-to-2025 transitions alike. The ISO certification process guide explains each step.
Still on the 2016 edition? Book a scoping review now to transition before 28 February 2027.
Book a free scoping reviewCommon Anti-Bribery Audit Findings
The gaps that most often delay a certificate or a transition.
Program findings
- Risk assessment generic, not tied to real markets
- Compliance function without direct access to the board
- No conflict of interest declarations
- Training given once, never refreshed
- Climate change not considered in context
Transaction findings
- Agents paid before due diligence was finished
- Success fees with no clear service behind them
- Gift and hospitality register incomplete
- Facilitation payments recorded as other costs
- Concerns closed without investigation
Before Stage 2, pick five higher-risk payments, such as an agent commission, a consulting fee, and a large hospitality bill. Check that each one had due diligence, approval, and a clear business reason. If the trail is complete, your controls are working. If it is not, fix the process before the auditor finds the gap.
ISO 37001 Certification Cost and Timeline
There is no price list. The audit man-days your scope needs set one fixed fee.
What sets the audit man-days
- People: total headcount and staff in sensitive roles
- Sites: offices, project sites, and branches
- Countries: each legal and risk setting in scope
- Partners: agents, distributors, and joint ventures
- Integration: combined with ISO 9001 or ISO 37301
How long it takes
| Proposal | Days after scoping |
|---|---|
| To certificate | Usually 6–12 weeks |
| Transition | By 28 February 2027 |
| Recertification | Before the end of year three |
How to Choose an ISO 37001 Certification Body
What compliance teams usually ask us before signing.
| Question to ask | Accredify Global's answer |
|---|---|
| Is your certificate accredited? | Yes. ISO 37001 is in our UAF scope, which you can check in the UAF directory. |
| Can you handle our transition? | Yes. We audit the 2025 changes, ideally at a planned visit. |
| Will you test real transactions? | Yes. We sample payments, agents, and gifts. |
| Can buyers check the certificate? | Yes. Certificates appear on our verification page. |
| Will you write our policy? | No. We audit and certify; we do not consult. |
| How is it priced? | A fixed fee, set by audit man-days, in a tailored proposal. |
Frequently Asked Questions About ISO 37001 Certification
Straight answers on the 2025 edition, the transition, the law, cost, and timeline.
What is ISO 37001 certification?
ISO 37001 certification is independent confirmation that an organization runs an anti-bribery management system that meets the standard. It shows clients, regulators and partners that bribery risk is assessed, controlled and monitored.
What is the current version of ISO 37001?
ISO 37001:2025, published in February 2025, is the second and current edition. It replaced the 2016 edition.
When must ISO 37001:2016 certificates transition?
Under the IAF transition rules, certificates to the 2016 edition must transition by 28 February 2027. Since 31 August 2026, new certifications and recertifications use the 2025 edition only.
What changed in ISO 37001:2025?
The 2025 edition adds climate change to the context clauses, stresses compliance culture, and addresses conflicts of interest directly. It also clarifies the anti-bribery compliance function and adopts the latest harmonized structure.
Who needs ISO 37001 certification?
Organizations exposed to bribery risk, especially those bidding for public contracts or working through agents. Typical users are construction and engineering firms, defense suppliers, oil and gas, healthcare, and companies trading in high-risk markets.
Does ISO 37001 certification prove we will never face bribery?
No. No system can prevent all bribery. Certification shows you have reasonable and proportionate controls, which can support an adequate procedures defense in some jurisdictions.
How does the standard relate to the UK Bribery Act and the FCPA?
Section 7 of the UK Bribery Act gives companies a defense if they had adequate procedures to prevent bribery. The US FCPA expects effective compliance programs. The standard gives a structured way to show both, but it does not guarantee a legal outcome.
What is the anti-bribery compliance function?
It is the person or team responsible for overseeing the system. They need the authority, independence and access to top management to do the job. The 2025 edition clarifies this role.
Does the standard cover gifts and hospitality?
Yes. You must set controls on gifts, hospitality, donations and similar benefits, so they cannot be used to disguise bribes.
What does anti-bribery due diligence involve?
Before working with a business associate or appointing staff to sensitive roles, you assess the bribery risk they bring. The depth of checks should match the level of risk.
Is ISO 37001 the same as ISO 37301?
No. ISO 37301 covers compliance management in general. ISO 37001 focuses on bribery. Both use the same structure and can be audited together.
How long does ISO 37001 certification take?
Most organizations with a working anti-bribery program certify in 6 to 12 weeks from Stage 1 to the certificate. Several countries, many agents or a new system take longer.
How much does ISO 37001 certification cost?
The cost follows the audit man-days your scope needs. Headcount, sites, countries, the number of business associates and the bribery risk of your activities set the man-days. A free scoping review gives you a tailored, fixed-fee proposal.
Is accredited ISO 37001 certification available?
Yes, from certification bodies accredited for the standard. ISO 37001 is within Accredify Global's UAF accreditation scope.
Does Accredify Global write our anti-bribery policy?
No. As a certification body we must stay impartial, so we audit and certify but do not write your policy or procedures.
Show Every Bid Is Won Fairly
Tell us about your markets, partners, and deadlines. We'll confirm your certification scope and send a fixed-fee proposal.
Book your free scoping review →Last reviewed by the Accredify Global certification team.