Bribery is both a legal catastrophe and a corrosive business risk, and "we have a policy" is no longer a defence. ISO 37001 is the international, certifiable standard for an anti-bribery management system (ABMS) — a structured, risk-based program to prevent, detect, and respond to bribery, and to demonstrate you took it seriously.
Start with a bribery risk assessment
The foundation is a bribery risk assessment: where, realistically, is your organization exposed? High-risk geographies, sectors, public-official interactions, and third-party intermediaries get the most scrutiny. Controls follow risk, not a generic template.
The controls that matter
- Due diligence on business associates, partners, and high-risk transactions — bribery often rides in through third parties.
- Controls on gifts, hospitality, donations and sponsorships — the grey areas where bribery hides.
- Financial and commercial controls — approvals, segregation of duties, transparency.
- Raising concerns — channels to report suspected bribery without fear (linking to ISO 37002).
The point of ISO 37001 isn't a thick policy nobody reads — it's controls proportionate to your actual risk, that you can show were operating.
Leadership and the compliance function
Like ISO 37301, ISO 37001 demands visible top-management commitment and an anti-bribery compliance function with appropriate authority and independence. Tone from the top is decisive: if leaders signal that results matter more than how they're achieved, no control set will hold.
Why certify
Certification demonstrates adequate procedures — increasingly a legal consideration when regulators assess whether an organization tried to prevent bribery. It reassures partners, supports tender eligibility, and — done genuinely — actually reduces the risk of a career- and company-ending scandal.
Build an anti-bribery program that holds
My ISO 37001 course covers the bribery risk assessment, third-party due diligence, gifts and hospitality controls, and the leadership and compliance function behind a credible ABMS.
View the ISO 37001 course →Questions
Is ISO 37001 certifiable?
Yes — unlike guidance standards, ISO 37001 is a requirements standard you can be independently certified against.
Does a policy alone protect us?
No — regulators look for proportionate, operating controls ('adequate procedures'), not a document. ISO 37001 is about controls that demonstrably work.