ISO 37001 — Anti-bribery management systems
What is ISO 37001?
ISO 37001 is the international standard for anti-bribery management systems. Serbia has adopted it as SRPS ISO 37001:2025. It requires the organisation to identify where it is exposed to the risk of bribery, put in place controls proportionate to that risk, and keep records showing that the controls work.
It covers bribery — both giving and receiving bribes. Fraud, cartels, anti-competitive practices and money laundering aren’t specifically addressed by the standard, although an organisation can extend its system to cover them. The current edition is ISO 37001:2025. The standard is voluntary.
What the standard requires
- An anti-bribery policy adopted by top management and communicated to employees and business associates.
- An anti-bribery compliance function with direct and prompt access to top management and the governing body.
- A bribery risk assessment covering activities, business associates and the markets where you operate.
- Due diligence on business associates before entering into a relationship — proportionate to the risk, not the same for everyone.
- Controls over gifts, hospitality, donations and sponsorships, with rules and records. The standard requires a procedure; a monetary threshold is a common solution, not a requirement of the standard.
- A channel for raising concerns that protects the person who reports.
Moving to ISO 37001:2025
ISO 37001:2025 was published on 28 February 2025 and replaces the 2016 edition. The transition rules, set by the IAF in IAF MD 30, are:
- since 31 August 2026, new certifications and recertifications have been issued only against the 2025 edition;
- by 28 February 2027, all existing certificates to the 2016 edition must move to the new edition; after that date they are no longer valid.
What is new in the 2025 edition:
- The harmonised structure — aligned with other management system standards, with harmonised terminology.
- An anti-bribery culture as a specific requirement for top management, not just a set of controls.
- Planning of changes as a new clause.
- Conflicts of interest added to the requirements for staff awareness.
- Training for business associates set out as a separate requirement.
- Mergers and acquisitions added as an area of risk.
- Climate change in the consideration of context and interested parties.
If you hold a certificate to the 2016 edition, the transition isn’t a new project — most of the system stays. Get in touch and we will assess what specifically needs to be added in your case.
Who it is for
The standard makes no distinction by size or sector — it is used by state-owned enterprises and by firms with ten employees alike. It is asked for where exposure is greatest: in public procurement and tenders, by exporters working with foreign clients, in construction and infrastructure, and by companies that operate through intermediaries, agents and distributors.
The standard singles out working through intermediaries: it requires the controls to extend to business associates acting on the organisation’s behalf, and requires their commitment to the rules — so exposure is reduced by choosing and monitoring associates, in advance rather than after the fact.
What implementation looks like
- Risk assessment by activity, business associate and market. Without it, all the other controls are guesswork.
- Policy and rules — gifts, hospitality, donations, conflicts of interest, working with intermediaries.
- Responsibilities and authorities, including the compliance function and how it reports to management.
- Due diligence on associates proportionate to the risk, with a record of what was checked and on what basis the decision was made.
- A reporting channel and an investigation procedure, with protection for the person who reports.
- Staff training, above all for those who contract, buy and negotiate.
- Internal audit and management review, followed by the certification audit if certification is the goal.
What changes in practice
The biggest change isn’t the paperwork; it’s that decisions follow a rule and leave a trail. A gift above an amount you set yourself must be reported. An intermediary must be checked before the contract is signed. A donation needs a justification that someone else approves.
- Fewer grey areas where decisions are made ‘by feel’.
- Evidence for the contracting authority in public procurement and international tenders.
- Employees know where to raise a concern and that they won’t suffer for doing so.
- When something does go wrong, there is a record showing where the system gave way.
See also
Where the risk really appears
Bribery risk doesn’t only appear in its obvious form. ISO 37001 requires the assessment to cover situations that aren’t perceived as bribery, for example:
- a gift, hospitality or travel connected with a purchasing decision;
- a commission to an intermediary with no clearly described service behind it;
- a donation or sponsorship to a party connected with the decision-maker;
- hiring or engaging someone close to a customer’s decision-maker;
- a ‘facilitation payment’ to speed up an administrative procedure.
For each such situation the standard requires a rule and a record — so that there is no argument afterwards about what the intention was.
Climate change in the organisation’s context
Climate change became part of the context review through an amendment in February 2024, which updated the 2016 edition. The 2025 edition includes it in the text of the standard itself — because it was published after that amendment, no separate amendment is needed.
The organisation must determine whether climate change is a relevant issue; a note adds that interested parties can have requirements related to it. This isn’t a separate system or new documentation — the consideration must take place and be visible, in the context analysis and in the management review. If you conclude that climate change isn’t relevant to your anti-bribery management system, that is an acceptable outcome too, provided it is clear the question was asked.
How long implementation takes
Implementing ISO 37001 usually takes 30 to 90 days. Exactly how long depends on the size of the organisation, the number of employees and how much of the above is already in place. We give an estimate for your case after a short conversation about the scope. On your side, for small and medium-sized organisations it takes 2 to 5 hours a week in total, spread across several people — more on this in our frequently asked questions.
What affects the price
Three things affect the cost of implementation:
- the size of the organisation;
- the number of employees;
- the standard being implemented — the amount of work differs from standard to standard.
We can only give an exact price after you get in touch and we have a short conversation about the scope. Without that, any figure would be guesswork, so we don’t give one here.
Frequently asked questions
Is ISO 37001 a legal requirement?
No. The standard is voluntary. Legal obligations relating to preventing bribery exist separately — ISO 37001 is a way of organising how you meet them, showing that you do, and checking this regularly.
Does ISO 37001 guarantee there is no bribery in the company?
No, and the standard itself says so explicitly. The certificate confirms that there is a system of controls appropriate to the risk, not that a failure can’t happen.
Can it be combined with ISO 9001 or ISO 27001?
Yes. ISO 37001 has the same harmonised structure, so the policy, internal audits and management review are done together instead of twice.
What if an intermediary breaks the rules?
The standard requires due diligence on associates before entering into a relationship, proportionate to the risk, and contract clauses that commit the associate to the same rules. The risk is reduced through choice and monitoring, not through explanations after the event. Contracts with higher-risk associates should also let you end the relationship if they engage in bribery.
Do we have to check every business associate?
Not every one, and not in the same way. The standard requires due diligence proportionate to the risk — how deep it goes depends on the type of work, the country, the value of the contract and the associate’s role. What is required is that the criteria for deciding how far to go are written down and applied consistently.
What if we find bribery in our own company?
The standard requires a procedure to exist in advance: whom it is reported to, who investigates, how the person who reported is protected and what happens next. It also requires that reports can be made anonymously and that anyone who reports in good faith doesn’t suffer for it.
General questions — cost and duration, who issues the certificate and how long it is valid — are covered in our frequently asked questions.
Related standards
- ISO 9001 — quality management systems; ISO 37001 shares its structure and its system-level procedures.
- ISO 27001 — information security; relevant because reports and investigations contain sensitive data.
- ISO 26000 — guidance on social responsibility, in which anti-corruption is one of the issues under ‘fair operating practices’.
- Frequently asked questions about ISO standards — how certification works, how long a certificate is valid, what new editions mean.
- Overview of all standards — if you’re not sure what you need.
How STANDARDISO can help
We guide you through the whole process — from the bribery risk assessment, through the policy, rules for gifts and due diligence on business associates, to the reporting channel and the internal audit. The certificate is issued by an independent, accredited certification body.
We work from your real processes: the documentation describes what you actually do, rather than forcing your work into a template. We train your staff so they can keep using the system after the audit. Everyone on our team works in English, and we can prepare your documentation in English, Serbian or both.