ISO 37001 certification, explained
ISO 37001 is the standard for anti-bribery management systems. It sets out measures an organization can put in place to prevent, detect and respond to bribery, such as risk assessment, due diligence, controls on gifts and hospitality, and a reporting channel. It is relevant to organizations working with public bodies, intermediaries or in higher-risk transactions. Independent certification bodies audit it.
Updated 5 November 2026
Info. Showing a standard does not mean a partner holds scope for it. How matching works.
Who it may be relevant for
- Contractors, suppliers and consultants that work with public bodies or large buyers
- Companies using agents, distributors or other intermediaries
- Organizations whose customers or financiers require anti-bribery controls
- Boards and compliance teams wanting a structured approach to bribery risk
What it covers
- Assessing bribery risks in the organization's activities, locations and relationships
- An anti-bribery policy, a person or function to oversee compliance, and top-level commitment
- Due diligence on projects, business partners and personnel in higher-risk situations
- Financial and commercial controls, and rules for gifts, hospitality and donations
- Reporting concerns, investigating issues and reviewing the system
What it can help with
- A documented, risk-based approach to bribery that managers and staff can follow
- Clearer rules for gifts, hospitality, agents and sensitive transactions
- A route for staff and partners to raise concerns, with handling that is recorded
- Evidence of reasonable measures that some buyers ask to see during due diligence
What the pathway means
ISO 37001 is a certifiable management-system standard. An independent certification body audits the anti-bribery management system through Stage 1, Stage 2, a decision, surveillance audits and recertification. A certificate shows reasonable measures are in place and audited. It does not prove that no bribery has occurred, and it is not a legal defence. MIYAAR CONNECT does not audit or certify. We connect your inquiry with independent certification bodies.
Edition. ISO 37001:2025 is the second edition, published in February 2025, replacing ISO 37001:2016. Ask the certification body how transition arrangements apply to a new or existing certificate. We do not state transition deadlines, because sources give different dates.
The typical process
Steps and timing vary by body and scope. This is the usual shape, not a promise.
- You and us
Your inquiry
You describe your needs and share the basics.
- Certification body
Application and contract review
The body reviews your scope, sites and size, then quotes.
- Certification body
Stage 1 audit
A readiness review of your management system documentation.
- Certification body
Stage 2 audit
An evaluation of how the system works in practice.
- This part is theirs
Certification decision
Made by the certification body, never by MIYAAR CONNECT.
- Certification body
Surveillance and recertification
Periodic surveillance audits, then recertification at the end of the cycle.
Where it is typically used
- A contractor adding checks on agents and subcontractors before bidding for public projects
- An exporter setting rules for gifts and hospitality offered to customers' staff
- A group reviewing high-risk transactions, such as licences and customs, with defined controls
What affects cost
- Number of employees
- Number of sites
- Complexity of what you do and its risks
- Number of employees, locations and countries of operation within the scope
- The level of bribery risk in your activities, for example use of agents or dealings with public bodies
- The volume and complexity of higher-risk transactions that auditors may need to sample
- Whether scheme availability for your scope and activities is limited, which may affect options
What affects timing
- Time to complete bribery risk assessment and put due diligence procedures into practice
- Evidence that controls have been used, such as gift registers and due diligence records
- Management time for training and communication across the organization
- How your certification body handles the 2025 edition and any transition
What to have ready
- A summary of where you operate and the main types of dealings with public bodies or intermediaries
- A list of the existing policies on ethics, gifts and conflicts of interest, described not uploaded
- Any buyer, funder or tender requirements that mention anti-bribery measures
- Who in the organization would own compliance
- Do not send sensitive investigation material at the inquiry stage
Accreditation and recognition
The weight of a certificate depends on the certification body and the scope audited. Accreditation bodies assess certification bodies for defined scopes, and availability of accredited certification for a particular standard and scope can vary, so verify it for your case. Ask for the certificate number and scope, and confirm accreditation with the accreditation body or through the Global Accreditation Cooperation Incorporated (Global ACI) arrangement, which took over from the IAF and ILAC on 1 January 2026. Certification is not a legal defence and does not ensure acceptance by any authority.
Common questions
Does ISO 37001 guarantee that we will never have a bribery incident?
Is ISO 37001 required for tenders?
How is it different from ISO 37301?
What changed in the 2025 edition?
Related standards
Relevant industries
Useful reading
Sources
- ISO: ISO 37001:2025 anti-bribery management systems (checked 5 November 2026)
Ask about availability for ISO 37001
We review availability for each inquiry. If no verified certification body fits your request, we will tell you plainly.