An ISO 37001 audit checks that a company has a working system to prevent, detect and respond to bribery, and that the system is used in daily decisions. The auditor looks at the bribery risk assessment, the controls built from it, and the records that show those controls were applied. The current edition is ISO 37001:2025, which replaced the 2016 edition.
Last reviewed: 17 October 2026. Facts checked. ISO's own catalogue lists ISO 37001:2025 as edition 2 (February 2025) and shows the 2016 edition as withdrawn on 28 February 2025. Sources report added provisions on compliance culture, climate change impacts, conflict of interest and the anti-bribery function. One certification body source states that certified sites must complete the transition by 28 February 2027. We did not open the standard, which is a paid document, and we did not check Indian law. Confirm the transition date with your certification body.
What the standard covers
ISO 37001 sets requirements for an anti-bribery management system (ABMS). It does not say bribery is illegal. The law does that. The standard helps a company build controls so that bribery is less likely and, if it happens, is found and dealt with.
An ABMS certificate does not prove the company never had a bribery case. It shows that a certification body found the system designed and working at the time of the audit.
What is new in the 2025 edition
According to the sources we found:
- The older term "anti-bribery compliance function" became "anti-bribery function".
- The definition of conflict of interest is fuller.
- Climate change and compliance culture are addressed.
- Annex A, the guidance annex, is reported to have no major changes.
If the company is still working to the 2016 text, the auditor should ask for its transition plan and the date of its next certification audit.
Audit areas and evidence
| Area | Question to ask | Evidence to request |
|---|---|---|
| Context and scope | Which business units, countries and partners are in scope? | Scope statement, list of interested parties |
| Leadership | Does the governing body oversee the system? | Policy, board or committee minutes, named anti-bribery function |
| Risk assessment | Where is bribery most likely to occur? | Documented assessment by activity, country, partner and transaction type |
| Policy and procedures | Are rules on gifts, hospitality, donations and facilitation clear? | Written policy, gift and hospitality register |
| Due diligence | Are higher-risk partners checked before engagement? | Due diligence files for a sample of agents, distributors and contractors |
| Financial and commercial controls | Can a payment be made without approval? | Approval matrix, payment samples, contract clauses |
| Training | Do exposed staff understand the rules? | Training records, interviews |
| Reporting | Can staff raise concerns safely? | Whistleblowing channel, case log, non-retaliation rule |
| Investigation | Are concerns investigated independently? | Investigation records and outcomes |
| Review | Does top management see the results? | Internal audit report, management review |
Test the risk assessment first
Every other control should trace back to the risk assessment. Ask to see it, then pick two high-risk areas and follow them through. For example, if the assessment flags dealings with government approvals, check how payments and agents in that area are controlled.
An assessment that rates everything "medium" is a weak sign. So is one that ignores a business line the auditor knows is exposed.
Sample due diligence and payments
Choose a few third parties that act on the company's behalf, such as sales agents, customs brokers or consultants. For each, check:
- Was the check done before the contract started?
- Does the contract include anti-bribery wording and the right to audit?
- Is the fee in line with the work, and is the payment route normal?
- Is the check refreshed over time, based on risk?
Then trace a payment from invoice to bank to see whether the approval steps ran as written.
Gifts, hospitality and conflicts of interest
Read the register, not just the policy. Look for entries near a tender or contract award, for repeated gifts to the same person, and for approvals given after the event. Ask how staff declare a conflict of interest and whether declarations are reviewed. Under the new edition this area deserves more time.
Common findings
- The risk assessment is generic and not tied to real activities.
- Due diligence is done for new partners but never refreshed.
- The gift register exists but is empty.
- The reporting channel exists, but staff do not know about it.
- No one has tested whether the anti-bribery function has enough independence and access to the governing body.
For grading, see major vs minor nonconformities.
Frequently Asked Questions
Is ISO 37001 certification mandatory in India?
We did not find a requirement that applies to all companies. Some customers and global groups ask for it, so check your contracts. The certificate is voluntary.
How is ISO 37001 different from a code of conduct?
A code of conduct states values and rules. ISO 37001 requires a managed system around those rules: risk assessment, due diligence, controls, reporting, investigation and review.
Does the standard apply to small companies?
It is written for organisations of any size. The standard expects the controls to match the risk, so a small company with low exposure can use lighter controls.
What is the anti-bribery function?
It is the person or team given responsibility and authority to run the system. The 2025 edition uses this term in place of the older "compliance function". The auditor checks that the role has independence and access to top management.
Can the same person audit and run the system?
No. An internal auditor must be independent of what is audited. See our guide to running an ISO internal audit.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error