An anti-bribery policy is not proof that a company can prevent, detect and respond to bribery. A manufacturer may have signed supplier declarations, compliance training records and a zero-tolerance statement while lacking evidence that intermediaries were screened, payments reviewed, conflicts assessed or concerns investigated. The practical test of ISO 37001:2025 anti-bribery audit readiness is whether decision-making controls can be explained and traced to credible evidence.
This guide is for compliance managers, procurement leaders, manufacturer management, quality-system teams and internal auditors. It explains the published 2025 edition, covers risk-based relationships and operational safeguards, provides a twenty-point evidence checklist, and answers common questions. Examples are illustrative—not universal compliance requirements or legal advice. Always use the applicable full standard and relevant laws when making formal conformity or legal decisions.
1. Confirm the correct ISO 37001 edition before preparing
ISO 37001:2025 is the published second edition of the anti-bribery management systems standard, issued in February 2025. It replaces ISO 37001:2016 and incorporates the climate-action considerations previously added through the 2024 amendment. Compared with the earlier edition, the revision strengthens attention to anti-bribery culture, conflict-of-interest management, the anti-bribery function and alignment with the harmonized management-system structure.
For transition planning, use current requirements and guidance rather than copying an old clause checklist. The UKAS technical bulletin describes the revised edition and related assessment considerations. Confirm the actual certification route and any applicable deadlines with the chosen accredited certification body rather than announcing a universal timetable without evidence.
Transition deadline: The IAF MD 30:2025 transition requirements, issued 10 October 2025, identify 28 February 2027 as the end of the transition period from ISO 37001:2016. Organizations holding accredited certificates should confirm their certification body’s applicable transition arrangements and whether a planned audit can accommodate the revised edition. A certificate’s printed expiry date does not, by itself, establish that an old-edition certificate remains valid beyond the transition deadline.
2. Understand what an anti-bribery management system actually does
ISO 37001 supports systems intended to help prevent, detect and respond to bribery. It covers direct or indirect bribery involving the organization, its personnel and business associates in relevant public, private and not-for-profit settings. It is not a certificate promising that misconduct will never occur. Controls must reflect the risks of the organization’s own activities and contractual relationships.
The evidence an auditor seeks should show more than attractive policy language. Risk assessments should lead to meaningful due diligence, approvals and financial or operational safeguards. Concerns should have safe routes for escalation and follow-up. The organization must be able to explain who makes decisions, who challenges them and how management learns from exceptions.
3. Define scope, business context and interested parties
Begin with an approved scope specifying entities, facilities, products, services and functions included in the anti-bribery management system. A manufacturer may have sales agents, public-sector tenders, customs intermediaries, logistics contractors, distributors and specialist consultants whose risk profiles differ from ordinary domestic purchasing. The scope and boundaries should not conceal these material relationships.
Document relevant legal and other obligations, markets, customer expectations and interested parties. Climate change is considered where relevant to management-system context; it does not create one standard emissions target for every anti-bribery programme. When a new market, acquisition or major commercial channel appears, reassess the implications for the scope and existing safeguards.
4. Identify bribery risks in transactions, not only departments
A useful risk assessment examines actual activities, third parties, jurisdictions and transactions instead of ranking entire departments with vague labels. Consider contract size, public-official interaction, payment practices, commissions, intermediary involvement, prior adverse indications, cash handling and the extent of independent oversight. An unfamiliar high-commission consultant deserves different scrutiny from a routine supplier of low-value consumables.
Record the assumptions, scoring rationale, reviewer, approval and triggers for renewed assessment. Risk ratings are decision aids, not guarantees that bribery is absent or present. Where the method highlights elevated exposure, show how it changes the due diligence depth, approvals, training or monitoring—not merely the colour of a risk register cell.
5. Carry out risk-based third-party due diligence
A signed supplier declaration and registration certificate can be useful starting information, but they do not automatically resolve risks. Proportionate due diligence may examine the legal identity, beneficial ownership, legitimate capacity to provide services, reputation, business purpose, payment structure and previous warning signs of an agent or business associate. The depth of verification depends on the relationship and operating context.
A strong audit sample traces an actual third-party relationship from the request and screening through approvals, agreements, invoicing, work delivered and ongoing monitoring. If information is missing, the record should explain whether a decision was deferred, reviewed at higher authority or declined. Shark’s related article on supplier declarations versus verified evidence explores this challenge.
6. Demonstrate leadership commitment through operating decisions
Leadership must do more than circulate an annual statement of integrity. Senior management should communicate credible expectations, provide appropriate resources and avoid incentives that reward obtaining a contract regardless of how it is obtained. Approval exceptions, disputed commercial opportunities and reported concerns reveal whether leadership genuinely supports the controls it established.
An internal audit can examine decisions involving material risk: who authorized them, which information reached leadership, whether escalation was possible and whether concerns affected the outcome. The system’s culture becomes visible when a manager can decline an unsuitable relationship without facing pressure to bypass approved safeguards.
7. Clarify the role and independence of the anti-bribery function
The 2025 revision clarifies the concept of the anti-bribery function. Depending on size and circumstances, one person or an appropriately staffed function may perform the role. The essential question is whether responsibilities, authority, access and escalation arrangements are suitable for the organization’s risk exposure.
A chart showing a reporting line is insufficient if the function cannot raise concerns about influential executives or commercial decisions. Check examples of advice, reviews and escalations, and identify arrangements for resolving conflicts. The programme should provide competent, reasonably independent challenge without assuming a small company must adopt the same organizational chart as a large multinational.
8. Manage conflicts of interest before decisions are made
Conflicts of interest receive clearer attention in ISO 37001:2025. A purchasing officer might have a personal or financial relationship with a bidder, or a consultant could receive incentives from competing parties. A disclosed interest is not automatic proof of misconduct, but undisclosed relationships can compromise decision-making and erode confidence in procurement.
The evidence trail should show a declaration, proportionate assessment, decision on recusal or independent review where appropriate, and a record of the outcome. Timing is essential: a conflict disclosed only after a contract is awarded may not protect the original choice. Assess whether the process worked before approval rather than relying on annual declarations alone.
9. Apply clear controls to gifts and hospitality
Hospitality, travel, sponsorships and gifts can have legitimate business purposes, yet they may also be used to influence sensitive decisions. Policies should define appropriate review routes, documentation, escalation and restrictions, informed by the organization’s risks and applicable law. This guide does not invent a single gift-value threshold as an ISO requirement.
Inspect a sample near a tender, contract renewal or regulatory interaction. Can finance or compliance trace the purpose, beneficiary, value, timing and approval? Look for expenses fragmented into smaller transactions or described so vaguely that their business justification cannot be evaluated. Auditors should distinguish credible red flags from conclusions of wrongdoing.
10. Link financial controls to legitimate commercial purpose
A payment control is stronger when it links authorization to a real contract, actual work delivered and accurate accounting. Relevant safeguards may include segregation of duties, beneficiary validation, approved bank details, invoice verification and documented exceptions. An accurately recorded consultancy expense can still present significant risk if the underlying service was never substantiated.
Test the complete transaction path, not simply whether two signatories approved a transfer. A payment to an intermediary should align with the risk assessment, signed terms, delivered services, invoiced amount and a defensible recipient. Unusual commissions or requests to pay unrelated entities deserve documented investigation appropriate to the facts.
11. Build non-financial controls into procurement and sales
Business-associate selection, bidding, contracting, service acceptance and changes of scope are commercial controls as well as financial processes. A company may have strict spending limits but still allow a manager to appoint a consultant without review or award a supplier contract with no transparent evaluation criteria.
Audit the practical approval sequence. Was supplier selection impartial? Were material deviations from tender rules explained? Do authorized employees understand when additional due diligence is needed? Documenting why an exception is acceptable is different from automatically approving it after the transaction has occurred.
12. Control donations, sponsorships and similar benefits
Charitable giving, sponsorship and community investment may be appropriate, but controls should evaluate beneficiaries, timing, underlying purpose and links to business decisions. Assess whether a donation is being requested by a person who can influence a pending contract or other sensitive outcome. Use reasonable due diligence and clear approval responsibilities.
Avoid treating all donations as inherently suspicious. The goal is a structured decision that separates a legitimate benefit from possible inducement. Keep records showing who proposed the expense, reviewed the relevant risks, approved it and checked that the funds or benefits were used for the stated purpose where appropriate.
13. Make third-party agreements and monitoring useful
Contract terms may clarify prohibited conduct, reporting expectations, documentation, access to information and potential consequences of violations, subject to applicable law. However, a boilerplate anti-bribery clause is not sufficient if the organization never checks whether its business associate understands it or whether its commercial conduct changes.
Monitor material developments such as ownership changes, new markets, amended commission structures, new subcontractors and unusual payment requests. Higher-risk associates may need more frequent review than routine low-risk providers. Frequency should follow an established risk-sensitive method, not a universal interval invented for every company.
14. Train for real decisions rather than attendance
Attendance logs and e-learning completion reports demonstrate delivery of training, not necessarily comprehension. Tailor training to procurement, sales, operations, finance and leadership so personnel can recognize the situations they face. A logistics coordinator and a procurement negotiator may need different examples of gifts, intermediaries and requests to circumvent controls.
Scenario-based questions can test whether people know how to seek advice, record concerns and refuse improper pressure. Keep evidence of follow-up where knowledge gaps appear. A reported completion rate of 100 percent is useful administrative data, but should not be presented as proof that every employee would make the correct decision under pressure.
15. Make reporting channels credible and protected
Personnel and relevant third parties need accessible ways to seek advice and raise concerns in good faith without inappropriate retaliation. The right channel may differ by company size, workforce distribution and legal obligations, but credibility requires clear handling responsibilities, suitable confidentiality, protection of sensitive information and escalation arrangements.
Check the process without exposing whistleblower identities. Can a concern be submitted when the alleged issue involves a powerful manager? Are reviewers appropriately independent? Is there a secure record of triage and outcomes? A low complaint count does not automatically prove good compliance culture; it may reflect confidence, fear, lack of awareness or simply the period observed.
16. Assess and investigate concerns fairly
A credible allegation should trigger proportionate assessment rather than an immediate presumption of guilt. Investigation arrangements should consider objectivity, conflicts of interest, evidence preservation, privacy and legal obligations. The individuals who assess allegations need appropriate competence, authority and safeguards against improper influence.
For a redacted sample, trace intake, preliminary assessment, responsibility, evidence reviewed, conclusions and any corrective action. See whether decisions were made against consistent criteria. Where allegations were not substantiated, the record should distinguish this conclusion from situations where information was insufficient to determine what happened.
17. Review anti-bribery culture and performance indicators
The revised edition puts clearer focus on compliance culture. Management can examine examples of commercial pressure, appropriate challenge, reward structures, survey results where relevant, follow-up on concerns and treatment of approval exceptions. A company that praises integrity publicly but punishes staff for raising a legitimate issue undermines its own safeguards.
Indicators might include overdue higher-risk due diligence, repeated approval overrides, unresolved concerns or late corrective actions. Interpret them carefully rather than presenting a single composite score as definitive proof. Shark’s separate analysis of ethical behaviour and leadership offers related management-system perspective.
18. Internal audits must sample objective evidence
Internal audit findings should be grounded in criteria and verifiable evidence. Sample a higher-risk agency appointment, an approved gift, a conflict declaration or a reported concern and follow the records through the intended controls. An opinion such as “culture seems weak” is not a complete nonconformity without reference to a specific requirement and relevant findings.
The audit programme should consider competence, objectivity, risk and changes in the organization. Where weaknesses recur, seek the reason instead of prescribing retraining by default. Shark’s guides on repeating internal audit findings and corrective action explain how to make findings drive meaningful improvement.
19. Use management review to change real decisions
Management review should examine the programme’s continuing suitability and effectiveness, changes in risk, monitoring results, reported concerns, audit outcomes, training needs and resources. Minutes that simply state “anti-bribery reviewed” provide little evidence of leadership’s actual evaluation or the decisions needed to improve the system.
An example of substantive review would be identifying an unresolved intermediary-screening gap and approving new verification resources, interim controls and a follow-up effectiveness review. Record responsible owners and completion evidence. Improvement should result from examining the actual weakness and its significance rather than merely closing an action tracker.
20. Follow an example transaction from start to finish
Imagine a manufacturer appointing a market-entry consultant before a major tender. Commercial staff document the need for the intermediary; the anti-bribery function evaluates jurisdictional and relationship risk; management records approval conditions; and the contract specifies services and legitimate fees. Procurement and finance connect payments to actual deliverables and verify the recipient.
If ownership changes, commission amounts increase or a concern is reported, suitable reviewers assess those developments and decide whether to pause or change the relationship. This is one illustration, not an ISO-prescribed sequence. Its audit value is traceability: a reviewer can explain the original decision and how the organization handled later uncertainty.
ISO 37001:2025 audit readiness — 20 practical evidence checks
Use this practical checklist as an internal preparation aid, not as a reproduction or replacement of the standard. Tailor the sampling depth, applicable legal requirements and evidence expectations to your organization’s risk profile and scope.
- Scope identifies relevant operations, entities, locations and business associates.
- Applicable bribery laws, obligations and interested-party requirements are identified.
- Business context and relevant climate considerations are reviewed.
- Bribery risk assessments reflect actual markets, transactions and intermediaries.
- Leadership decisions and expectations demonstrate an appropriate anti-bribery culture.
- An anti-bribery function has defined authority and suitable escalation access.
- Policies are accessible and personnel understand their practical responsibilities.
- Business associates undergo proportionate, documented due diligence.
- Higher-risk contracts and partners receive suitable review and approval.
- Conflicts of interest are disclosed, evaluated and appropriately managed.
- Gifts and hospitality have suitable review, recording and escalation controls.
- Financial payments are supported by legitimate purpose and verifiable evidence.
- Procurement, tendering and sales decisions use appropriate non-financial controls.
- Donations, sponsorships and other benefits are reviewed where relevant.
- Business agreements communicate responsibilities and monitoring expectations.
- Training effectiveness is considered beyond attendance or completion figures.
- Reporting channels provide credible access and suitable protection.
- Concerns are assessed fairly with confidential, traceable investigation records.
- Internal audits and corrective actions address evidenced control weaknesses.
- Management reviews yield decisions, resources and effectiveness follow-up.
Frequently asked questions
Is ISO 37001:2025 the latest published international edition?
Yes. The ISO catalogue identifies ISO 37001:2025 as the published second edition, replacing ISO 37001:2016 and incorporating climate-action considerations from the 2024 amendment. Verify transition arrangements with the certification body involved.
Does certification guarantee a company has no bribery?
No. A management-system certificate is not a guarantee that bribery cannot occur. Prevention, detection, response and improvement remain ongoing responsibilities.
Is a signed supplier declaration sufficient due diligence?
Not for every relationship. Review the business purpose, applicable risk, identity, available information and necessary controls. A higher-risk associate may warrant additional checks and monitoring.
Does ISO 37001 specify one gift-value limit for all organizations?
The guidance here establishes no universal numeric gift threshold. Organizations should define suitable controls based on the full standard, their risks and applicable legal requirements.
Are whistleblower reports proof that bribery occurred?
No. Reports are concerns requiring fair, competent and confidential assessment. The existence or absence of reports should not be interpreted without context.
Primary resources: ISO 37001:2025 official standard listing; UKAS anti-bribery management system technical bulletin; OECD Good Practice Guidance on Internal Controls, Ethics and Compliance; and UNODC guidance for business anti-corruption programmes. The full applicable standard, regulations and contracts should be checked before formal conformity or legal decisions.
Preparing for ISO 37001 certification or an anti-bribery management system audit? Contact Shark Certification to discuss your organization, transaction risks and evidence preparation. Check any offered ISO 37001 service and specific accreditation scope directly before selecting a certification body. An effective programme is built on traceable operational decisions—not merely the volume of paperwork.
