ISO 37001 Certification for Anti-Bribery Management Systems

ISO 37001 is the international standard for anti-bribery management systems (ABMS), and itmad audits anti-bribery management systems for organisations in all industries. itmad operates across the Middle East, Asia and Europe, using local auditors and a travelling team. Certification follows a two-stage audit and results in a certificate valid for three years, kept current by annual surveillance audits. Last reviewed: October 2026.

ISO 37001 in brief

The standard specifies the controls, due diligence, reporting channels and governance that an organisation puts in place to prevent, detect and respond to bribery. A certificate is independent confirmation that those arrangements exist and operate. It cannot show that bribery has never happened, because no standard is able to establish that.

Who the standard is for

ISO 37001 applies to any organisation, including:

• Contractors and suppliers competing for government and semi-government contracts
• Oil and gas operators and their supply chain
• Construction and infrastructure companies
• Banking, insurance and financial services
• Logistics, shipping and customs-facing businesses
• Organisations using agents or intermediaries in higher-risk jurisdictions
• Subsidiaries of groups that fall under the UK Bribery Act or the US Foreign Corrupt Practices Act (FCPA)

Why organisations certify

Counterparties whose own compliance obligations extend to their supply chain can require anti-bribery arrangements of their suppliers. Organisations that fall under extraterritorial legislation, such as the UK Bribery Act or the US Foreign Corrupt Practices Act, have a further reason: procedures that can be demonstrated bear on how an enforcement authority treats them.

What auditors examine

• Bribery risk assessmentWhere the organisation is exposed (by country, sector, transaction type, business partner and contact with public officials) and how significant each exposure is.
• Leadership and governanceTop management commitment, an anti-bribery policy, and oversight by the governing body where one exists.
• Compliance functionA person or function with defined authority and independence, and direct access to the governing body.
• Due diligenceProportionate checks on business associates, agents, intermediaries, joint venture partners and personnel in higher-risk positions.
• Financial and commercial controlsApproval limits, segregation of duties, payment verification and controls over procurement and contracting.
• Gifts and hospitalityDocumented rules on gifts, hospitality, donations and sponsorship, with thresholds and a register.
• Business associate controlsAnti-bribery commitments in contracts, and the ability to terminate where a partner is implicated.
• Raising concernsReporting channels that allow anonymity where lawful, and protection from retaliation for those who use them.
• InvestigationProcedures for investigating suspected bribery and acting on the findings, including disciplinary action.
• Training and awarenessRole-appropriate training for personnel and, where relevant, for business associates.

What certification does and does not mean

What certification establishes is that the required arrangements had been implemented and were running when the audit took place. It gives no warranty about bribery in the past or the future, and ISO 37001 says so itself. Being plain about those limits does not weaken the certificate: a counterparty that understands what an audit can prove is more likely to trust it for that reason.

How an itmad audit runs

Stage 1 reviews the documented system, the scope and, above all, the bribery risk assessment, because every later control is judged on whether it is proportionate to the risks identified. Stage 2 tests implementation: due diligence files, gift and hospitality registers, training records, reports raised through the reporting channel and how they were handled, and interviews with people in exposed roles.

The certificate cycle

An ISO 37001 certificate from itmad runs for three years, with surveillance audits in each of the two intervening years and recertification before it expires.

Scope and integration

Counterparties read the scope wording on the certificate, which names the activities and locations covered. ISO 37001 uses the same high-level structure as ISO 9001 and ISO 37301, so where more than one is held, an integrated audit covers the common clauses once.

Independence

ISO/IEC 17021-1 does not allow a certification body to design, implement or consult on the management system that it certifies, and itmad does not. itmad provides the audit and the certification decision and, if wanted, a pre-assessment that identifies gaps against ISO 37001 without telling the organisation how to close them.

What itmad delivers

• A Stage 1 report setting out readiness gaps ahead of the main audit
• A Stage 2 report with findings tied to objective evidence
• Nonconformities classified by severity, with defined response timescales
• A certificate of registration stating the certified scope and locations
• The certification mark, under the terms of itmad's mark and seal policy
• Annual surveillance audits and reports for the full three-year cycle

Frequently asked questions

What is ISO 37001?

ISO 37001 specifies the controls, due diligence, reporting channels and governance that an organisation puts in place to prevent, detect and respond to bribery. A certificate confirms that those arrangements exist and operate.

Does ISO 37001 certification guarantee that no bribery occurs?

No. It confirms that the required arrangements were in place and working when the audit took place, and nothing more. The standard itself states that certification is no warranty against past or future bribery.

Does ISO 37001 certification confirm compliance with national anti-bribery law?

No. What the itmad certificate shows is conformity with ISO 37001, not compliance with any country's anti-bribery law. The legal obligations of the organisation stay exactly where they were.

What does ISO 37001 require?

It requires bribery risk assessment, leadership and governance, a compliance function, due diligence, financial and commercial controls, rules on gifts and hospitality, business associate controls, channels for raising concerns, investigation procedures, and training. Each control is judged on whether it is proportionate to the bribery risks identified.

How does an ISO 37001 audit work?

The audit has two stages. The first examines the documented system, the scope and, most of all, the bribery risk assessment. The second tests what happens in practice, through due diligence files, gift and hospitality registers, training records and the reports raised through the reporting channel.

Why would an organisation exposed to the UK Bribery Act or the FCPA certify?

Demonstrable procedures are relevant to how an enforcement authority treats an organisation under extraterritorial legislation. Counterparties whose own obligations extend to their supply chain can also require anti-bribery arrangements of suppliers.