ISO 37001 Anti-Bribery Management System Certification in Norway
itmad audits ISO 37001 anti-bribery systems in Norway: two-stage audit, three-year certificate, Norway-based and travelling auditors.
ISO 37001 is the international standard for anti-bribery management systems (ABMS), and itmad audits ISO 37001 anti-bribery management systems for organisations in all industries in Norway. itmad audits with both Norway-based auditors and a travelling team, and has worked in Norway for more than 10 years. ISO 37001 certification from itmad follows a two-stage audit and produces a certificate that runs for three years with annual surveillance audits.
What ISO 37001 is
ISO 37001 specifies requirements for an anti-bribery management system: the controls, due diligence, reporting channels and governance that an organisation puts in place to prevent, detect and respond to bribery. ISO 37001 certification is independent confirmation that those arrangements exist and operate. ISO 37001 certification does not confirm that bribery has never occurred, which no standard can establish.
Who ISO 37001 applies to
An organisation in Norway needs ISO 37001 certification when a customer or supplier programme asks for independent proof of its anti-bribery management system. ISO 37001 applies to any organisation, including:
- Contractors and suppliers bidding for government and semi-government work
- Oil and gas operators and their supply chain
- Construction and infrastructure companies
- Banking, insurance and financial services
- Logistics, shipping and customs-facing businesses
- Organisations using agents or intermediaries in higher-risk jurisdictions
- Subsidiaries of groups subject to the UK Bribery Act or the US Foreign Corrupt Practices Act (FCPA)
itmad audits ISO 37001 for organisations in all industries in Norway.
Why organisations certify to ISO 37001
Counterparties whose own compliance obligations extend to their supply chain can require anti-bribery arrangements of suppliers. ISO 37001 certification also matters to organisations exposed to extraterritorial legislation such as the UK Bribery Act or the US Foreign Corrupt Practices Act, where demonstrable procedures are relevant to how an enforcement authority treats the organisation.
What ISO 37001 requires
- Bribery risk assessmentIdentifying where the organisation is exposed (by country, sector, transaction type, business partner and interaction with public officials) and evaluating the significance of each exposure.
- Leadership and governanceTop management commitment, an anti-bribery policy, and oversight by the governing body where one exists.
- Compliance functionA person or function with defined authority and independence, with direct access to the governing body.
- Due diligenceProportionate checks on business associates, agents, intermediaries, joint venture partners and personnel in higher-risk positions.
- Financial and commercial controlsApproval limits, segregation of duties, payment verification and controls over procurement and contracting.
- Gifts and hospitalityDocumented rules covering gifts, hospitality, donations and sponsorship, with thresholds and a register.
- Business associate controlsAnti-bribery commitments in contracts, and the ability to terminate where a partner is implicated.
- Raising concernsReporting channels that permit anonymity where lawful, and protection from retaliation for those who use the channels.
- InvestigationProcedures for investigating suspected bribery and acting on findings, including disciplinary action.
- Training and awarenessRole-appropriate training for personnel and, where relevant, for business associates.
What ISO 37001 certification does and does not mean
ISO 37001 certification confirms that an organisation has implemented the required arrangements and that the arrangements were operating at the time of audit. ISO 37001 certification is not a warranty that no bribery has occurred or will occur, and the standard itself is explicit on that point. Stating the limits of certification clearly is not a weakness in the certificate: stating the limits clearly is what makes the certificate credible to a counterparty who understands what an audit can and cannot establish.
Certification in Norway
An ISO 37001 certificate states the certified scope, including the activities and locations covered, and a Norwegian buyer or supplier programme checks that scope wording. Each Norwegian buyer or supplier programme sets acceptance conditions for ISO 37001 certificates.
How itmad delivers ISO 37001 in Norway
itmad delivers ISO 37001 audits in Norway through Norway-based auditors and a travelling team, and certifies organisations in all industries. ISO/IEC 17021-1 prevents a certification body from designing, implementing or consulting on the management system that the body certifies, and itmad does not. On an anti-bribery standard, independence matters more than on any other, because a certificate issued by the body that built the system is not independent assurance. itmad provides the audit and the certification decision, and optional pre-assessment that identifies gaps against the standard without prescribing how an organisation closes those gaps.
The ISO 37001 certification process
Stage 1 of an itmad ISO 37001 audit reviews the documented system, the scope, and above all the bribery risk assessment, because every subsequent control is judged against whether the control is proportionate to the risks identified. Stage 2 of an itmad ISO 37001 audit tests implementation: due diligence files, gift and hospitality registers, training records, reports raised through the reporting channel and how the reports were handled, and interviews with personnel in exposed roles.
ISO 37001 timeline
An ISO 37001 certificate from itmad runs for three years, with annual surveillance audits in each intervening year and recertification before the certificate expires.
Scope and integration
The ISO 37001 certificate states the activities and locations covered, and counterparties read that wording. ISO 37001 uses the same high-level structure as ISO 9001 and ISO 37301, so where more than one is held, integrated auditing covers common clauses once rather than repeatedly.
What itmad provides
- Stage 1 report identifying readiness gaps before the main audit
- Stage 2 audit report with findings supported by objective evidence
- Nonconformities classified by severity with defined response timescales
- Certificate of registration stating the certified scope and locations
- Certification mark for use under the terms of itmad's mark and seal policy
- Annual surveillance audits and reports through the three-year cycle
Frequently asked questions
What is ISO 37001?
ISO 37001 specifies requirements for an anti-bribery management system: the controls, due diligence, reporting channels and governance that an organisation puts in place to prevent, detect and respond to bribery. ISO 37001 certification is independent confirmation that those arrangements exist and operate.
How does ISO 37001 certification work with itmad in Norway?
itmad audits ISO 37001 in two stages. Stage 1 reviews the documented system, the scope, and above all the bribery risk assessment. Stage 2 tests implementation, including due diligence files, gift and hospitality registers, training records and reports raised through the reporting channel. The ISO 37001 certificate runs for three years with annual surveillance audits.
Does itmad use auditors based in Norway?
itmad uses both Norway-based auditors and a travelling team for ISO 37001 audits in Norway. itmad has worked in Norway for more than 10 years.
Does ISO 37001 certification guarantee that no bribery occurs?
No. ISO 37001 certification confirms that an organisation has implemented the required arrangements and that the arrangements were operating at the time of audit. ISO 37001 is not a warranty that no bribery has occurred or will occur, and the standard is explicit on that point.
What does ISO 37001 require?
ISO 37001 requires bribery risk assessment, leadership and governance, a compliance function, due diligence, financial and commercial controls, rules on gifts and hospitality, business associate controls, channels for raising concerns, investigation procedures, and training and awareness. Every control is judged against whether the control is proportionate to the bribery risks identified.
Does ISO 37001 certification confirm compliance with national anti-bribery law?
No. An itmad ISO 37001 certificate confirms conformity with ISO 37001 and not with national anti-bribery law. The certificate does not replace the legal obligations of the organisation.