ISO 37001:2025
ISO 37001 Standard Implementation
ISO 37001 is a certifiable standard for an anti-bribery management system. It helps an organization put in place reasonable, proportionate controls to prevent, detect and respond to bribery — and to demonstrate this, with documentation, to partners, investors and clients.
What is ISO 37001?
ISO 37001 is an international standard that sets out requirements for an anti-bribery management system: a policy, bribery risk assessment, controls over financial and non-financial processes, due diligence on partners and third parties, staff training and protected channels for reporting suspicious behavior.
The standard does not claim, and cannot claim, to guarantee the total absence of bribery within an organization — its aim is to establish a reasonable, documented and verifiable system of controls, proportionate to the organization's size and risk, that reduces the likelihood of bribery occurring and allows for a fast response if a suspicion arises.
Who is it relevant for?
The standard is particularly sought after by organizations exposed to a heightened risk of bribery and corruption:
Organizations that handle public funds or deal with government bodies.
Firms that domestic and international contracting authorities ask for proof of internal anti-corruption controls.
Organizations working with partners from jurisdictions with strict anti-corruption laws (e.g. the UK Bribery Act, the US FCPA).
Finance, energy, construction and other sectors with a historically elevated corruption risk.
Main objectives and typical controls
An anti-bribery management system is built around several objectives: a clear policy and visible top-management commitment, bribery risk assessment by process and by partner, controls over gifts, hospitality, donations and sponsorships, due diligence on intermediaries, suppliers and business partners, financial controls that make it harder to conceal irregular payments, staff training tailored to their risk exposure, and an independent channel for reporting suspected bribery, together with protection for whistleblowers.
Implementation phases
The real phases we guide every ISO 37001 project through — from preparation to the certificate, which comes only at the end:
Connection with governance, compliance and risk management
ISO 37001 is rarely viewed in isolation — it delivers the most value as part of a broader system of corporate governance, regulatory compliance and risk management. The anti-bribery policy relies on the same risk-assessment framework as ISO 31000, shares its structure and reporting channels with ISO 37301 (compliance), and its internal controls naturally build on the process approach of ISO 9001. For organizations that already have one of these systems in place, adding ISO 37001 is usually faster and cheaper than starting from scratch.
The path to certification
Certification follows the standard two-stage model at an accredited body.
The system is implemented and applied in practice — controls established, the internal audit carried out and the management review completed.
The certification body checks the system's documentation and readiness for the main audit.
Checking application in practice: interviews, review of controls and records. The certificate is issued by an independent accredited certification body — we prepare you for it and support you during the audit.
Once findings are closed out, the certificate is issued, valid for 3 years. We recommend accredited certification bodies only.
Annual surveillance audits and recertification in the third year.
Benefits of adopting the standard
A documented system of controls reduces the exposure of the organization and its management.
More and more contracting authorities and international partners ask for proof of anti-corruption controls.
Employees know what is and isn't permitted, and have a safe way to report suspicions.
Fits naturally alongside ISO 9001, ISO 37301 and ISO 31000.
Related standards
ISO 37301 (compliance) is the most natural pairing — the two share structure and reporting channels. ISO 31000 provides the risk-assessment methodology, and ISO 9001 the organization's process framework.
We offer training on applying ISO 37001 controls and recognizing bribery risk.
FAQ about ISO 37001
Is a certificate against ISO 37001:2016 still valid?
Only until 28 February 2027. ISO 37001:2025 was published in February 2025, and under the transition rules (IAF MD 30:2025), from 31 August 2026 initial certification and recertification are carried out against the 2025 edition only. Organisations certified against the 2016 edition must transition by 28 February 2027 — at a regular surveillance audit or a separate transition audit. The changes are not extensive: compliance culture, climate change, conflicts of interest and a clarified role of the anti-bribery function.
Does an ISO 37001 certificate guarantee there is no bribery in an organization?
No. The certificate confirms that the organization has established a reasonable system of controls to prevent, detect and respond to bribery — it does not guarantee the absence of every individual violation, nor does it replace legal liability.
Who is ISO 37001 most relevant for?
For organizations exposed to bribery risk: state-owned enterprises, companies that take part in tenders, exporters, firms with foreign partners, and those operating in regulated industries.
How does ISO 37001 differ from ISO 37301?
ISO 37001 focuses exclusively on bribery and corruption; ISO 37301 covers compliance with all legal and regulatory obligations. The two standards complement each other well and can be implemented together.
How long does ISO 37001 implementation take?
Depending on size and risk exposure, usually 3 to 5 months — from the bribery risk assessment to readiness for the certification audit. For large systems — over 500 employees, multiple locations or an integrated system of several standards — a project realistically runs beyond a year; we handle those clients too.
How much does ISO 37001 implementation cost?
There is no fixed price that applies to everyone — the cost depends on the organization's field of activity, its size and the current state of its system. Send us a short description of your organization and we will prepare a free, indicative quote tailored to you.
📋 Check the exact price for your organization →Check your organization's readiness
Answer a few questions and receive an indicative assessment of your organization's current level of readiness for ISO 37001.
This self-assessment provides an indicative readiness result only. It does not constitute certification, an official audit, or formal confirmation of compliance.
ISO 37001:2025 — new edition and transition deadline
The second edition of the standard was published in February 2025, replacing ISO 37001:2016 together with its 2024 amendment. Under the transition rules (IAF MD 30:2025), from 31 August 2026 initial certification and recertification are carried out against the new edition only, and all certified organisations must transition by 28 February 2027. After that date, certificates against the 2016 edition are no longer valid.
What changes
- Compliance culture — the organisation develops and maintains an anti-bribery culture at all levels, not just a written policy.
- Climate change — considered in the context of the organisation and in the expectations of interested parties, as in other ISO management system standards.
- Conflicts of interest — how they are identified, reported and resolved is set out more clearly.
- Anti-bribery function — the term has been clarified, and its role, authority and independence are defined more precisely.
- Harmonised structure — terminology aligned with other standards makes integration with ISO 37301 and ISO 9001 easier.
The changes are not extensive: if you have a well-organised system under the 2016 edition, the transition comes down to updating the documentation and showing that the new requirements are applied.
Certified against the 2016 edition? The deadline is 28 February 2027
The transition is not a new project from scratch — your system stays, and only what the standard now requires is added. With us, it works like this:
- Gap analysis — we go through your existing documentation and tell you what already covers the new requirements and what is missing.
- Documentation update — compliance culture, conflicts of interest, climate change and the role of the anti-bribery function, without rewriting the whole system.
- Short team training on what is new, so people know what the auditor will ask.
- Transition at a regular surveillance audit or a separate transition audit — book the date with the certification body in good time, before 28 February 2027.
The EU, the US and other markets
ISO 37001 is the same standard wherever you certify it — what differs is the designation, the accreditation behind the certificate and what your customers ask for.
In the European Union the standard is adopted with an EN prefix, and what your buyer in the Netherlands, Germany or France looks at is not the prefix but the accreditation behind the certificate: a body accredited by a signatory of the international recognition arrangement (Global Accreditation Cooperation, formerly IAF) is recognised in other markets too. What EU partners and EU regulation expect is on the page about the EU market.
For companies with customers in the United States — supplier audits, security questionnaires and how ISO sits alongside SOC 2 — see the page about the US market.
Wherever your customer is, we run the project remotely in English — over Teams, WhatsApp or Viber, with documentation and records in English — and on site when that is easier.
Some of our references
More than 400 organisations in Montenegro and the region have gone through implementation with us — from banks and public bodies to manufacturing, IT, laboratories and hospitality.
These are only some of our clients. More about us →
Request a free consultation
We will assess the scope of work and propose a realistic plan and budget for your organization. Call us or send an inquiry — we reply within 24 hours.