Regulatory defence
Evidence of adequate procedures where anti-bribery laws recognise them.
Certification support
ISO 37001 Anti-Bribery Management
Current edition: ISO 37001:2025
The anti-bribery management standard for organisations that need to prevent, detect and respond to bribery, and show regulators, partners and lenders that they do. It applies to public, private and not-for-profit organisations of any size.
2027Transition deadline
ISO 37001:2016 certificates expire on 28 February 2027
ISO 37001:2025 was published in February 2025. Initial certification audits are now carried out against the 2025 edition, and all 2016 certificates must transition by 28 February 2027. Changes include an anti-bribery culture, stronger conflict of interest management, planning of changes and climate considerations.
What the standard covers
Requirements, clause by clause
ISO 37001 sets out a management system with specific anti-bribery controls that are proportionate to the bribery risks you face.
4
Context
Bribery risk assessment, interested parties, scope.
5
Leadership
Governing body and top management, anti-bribery culture, policy, anti-bribery function.
6
Planning
Actions to address risk, objectives, planning of changes.
7
Support
Competence, employment process, awareness and training, documented information.
8
Operation
Due diligence, financial and non-financial controls, gifts and hospitality, conflicts of interest, raising concerns, investigations.
9
Performance evaluation
Monitoring, internal audit, management and governing body review, anti-bribery function review.
10
Improvement
Nonconformity, corrective action and continual improvement.
Clauses 4 to 10 follow the harmonized structure shared with ISO 9001 and ISO/IEC 27001, so the systems integrate cleanly.
Why organisations implement it
What a working anti-bribery system delivers
Partner confidence
A recognised answer to due diligence from customers, lenders and joint venture partners.
Controlled third parties
Agents, intermediaries and suppliers screened and monitored.
Clear decisions
Gifts, hospitality, donations and conflicts of interest handled consistently.
Speak-up channel
Concerns raised and investigated without retaliation.
Integrates with compliance
Runs alongside ISO 37301 in one compliance system.
How we work
Path to certification
One AEC methodology from first assessment to certificate, delivered by registered lead auditors.
- AssessGap assessment against ISO 37001:2025, scope and roadmap
- DesignProcesses, risk register, policy and documented information
- ImplementProcesses embedded with coaching for process owners
- TrainAwareness for all staff and internal auditor development
- VerifyInternal audit, management review and mock certification audit
- Certify & sustainStage 1 and Stage 2 support, then surveillance readiness
Full implementation
No existing system. We design and implement from the ground up.
Typically 6 to 9 monthsGap remediation
Some documentation in place. We close the gaps and prove effectiveness.
Typically 4 to 6 monthsUpgrade & integration
Transition from the 2016 edition, or integration with ISO 37301.
Typically 2 to 4 months
Who certifies
Independent certification, chosen to fit your market
Your ISO 37001 certificate is issued by an independent certification body accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares you for that audit; the certification decision is theirs.
CB-neutral
We are not tied to one certification body and help you select one to suit your stakeholders and markets.
Audit-ready
Mock certification audit and closed corrective actions before Stage 1 and Stage 2.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO 37001 by industry
Government · public bodies and state-owned enterprises
Construction · public contracts and subcontracting
Oil & gas · licences, agents and joint ventures
Finance · banks, insurers and investment firms
Healthcare · procurement and interactions with professionals
Shipping & ports · port calls, customs and agents
Related standards
Training Academy
View ISO 37001 Implementer course
ISO 37001 training
Delivered by practising, registered lead auditors. In-house, public, virtual or hybrid.
- Awareness (half day) for staff, managers and board members
- Implementer (2 to 3 days) for compliance and system owners
- Internal Auditor (2 to 3 days) in line with ISO 19011
Questions
ISO 37001 FAQ
Does AEC issue the ISO 37001 certificate?
No. Certificates are issued by independent certification bodies accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares your organisation for that audit.
Does ISO 37001 certification mean no bribery can occur?
No. It shows that you have implemented reasonable and proportionate measures to prevent, detect and respond to bribery. No system can guarantee that bribery will never occur.
We hold ISO 37001:2016. What do we need to do?
Transition to ISO 37001:2025 before 28 February 2027. Start with our ISO 37001:2025 transition checklist (PDF and Excel). We run a gap review focused on anti-bribery culture, conflicts of interest and planning of changes, update your documents and support the transition audit.
How does ISO 37001 relate to ISO 37301?
ISO 37001 focuses on bribery. ISO 37301 covers all compliance obligations. Many organisations run both as one integrated compliance management system.
Start your ISO 37001 programme
Tell us your operations, markets and third parties. We reply with a proposal covering risk assessment, implementation, training and certification support.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.