ISO 37001:2016

Overview

ISO 37001:2016 - Anti-bribery management systems specifies requirements and provides guidance for establishing, implementing, maintaining, reviewing and improving an anti-bribery management system. The standard applies to bribery risks across public, private and not‑for‑profit sectors and covers bribery by or of the organization, its personnel and its business associates, including direct and indirect bribery. ISO 37001:2016 is focused exclusively on bribery (not fraud, money‑laundering or antitrust offences) and can be implemented as a stand‑alone system or integrated into existing management systems.

Key topics and technical requirements

ISO 37001 follows the common high‑level structure for management system standards and includes requirements and guidance across clauses 4–10. Major technical topics include:

• Context, scope and risk assessment

  • Understanding organizational context and stakeholders
  • Bribery risk assessment to determine reasonable and proportionate controls

• Leadership and governance

  • Top management and governing‑body commitment
  • Anti‑bribery policy and defined roles, responsibilities and authorities
  • Establishment of an anti‑bribery compliance function

• Planning and objectives

  • Actions to address risks and opportunities
  • Anti‑bribery objectives and implementation plans

• Support and competence

  • Allocation of resources, competence requirements, awareness and training
  • Communication and documented information controls

• Operational controls

  • Due diligence on business associates and transactions
  • Financial controls (e.g. approvals, recordkeeping) and non‑financial controls
  • Management of gifts, hospitality, donations and similar benefits
  • Mechanisms for raising concerns, investigation and corrective action

• Performance evaluation and improvement

  • Monitoring, measurement, internal audit and management review
  • Nonconformity handling, corrective actions and continual improvement
  • Annex A gives practical guidance on implementation

Note: conformity with ISO 37001 reduces risk but does not guarantee bribery will never occur.

Practical applications - who uses this standard

ISO 37001 is used by organizations of all sizes and sectors to:

• Build or strengthen an anti‑bribery compliance program
• Demonstrate commitment to integrity to regulators, customers and partners
• Standardize due diligence and third‑party risk management Typical users include boards and executives, compliance officers, legal teams, internal auditors, procurement, HR and risk managers.

Related standards

ISO 37001 is compatible with and can be integrated into other management system standards such as:

• ISO 9001 (quality management)
• ISO 14001 (environmental management)
• ISO/IEC 27001 (information security)
• ISO 19600 (compliance management), ISO 26000 and ISO 31000 for broader governance and risk guidance

Keywords: ISO 37001, anti‑bribery management systems, anti‑corruption, bribery risk assessment, due diligence, compliance, governance, anti‑bribery policy.