What does ISO 37001 cover?
ISO 37001 focuses on a management system for preventing, detecting and responding to bribery. It uses risk assessment, appropriate due diligence and controls to support accountable decisions. Certification does not establish that bribery can never occur.
Who it is for
Organizations with bribery exposure through transactions, intermediaries, procurement or public-sector interactions.
Key areas to understand
Start with these areas. Identify which requirements apply to your activities and who is responsible for them.
- 1Assess bribery risks in relationships and transactions.
- 2Apply due diligence and approval controls proportionate to exposure.
- 3Provide reporting channels and investigate concerns.
Evidence to prepare
This list is a starting point. Check the standard for all required documents. For each item, record who is responsible, the activity or site it relates to, and a recent example showing how it works.
- Bribery risk assessment
- Business-associate due diligence
- Gift, hospitality and payment approvals
- Training and reporting arrangements
- Investigation and corrective-action records
Keep records that explain what was checked, which requirement was used and who checked it. Include any action taken when a requirement was not met. Link each record to the work it supports.
An internal audit example
Suggested checks from 4Auditee
Sample the appointment of an intermediary in a higher-risk transaction. Follow the risk assessment, due diligence and approval through to the services delivered and the payment made. Look for evidence that concerns changed the decision rather than merely being recorded.
Choose a sample that suits your activities and risks. If you find a gap, record the requirement, the evidence and what was missing. Check more examples if the first results suggest a wider problem.
A common problem to check
A signed code of conduct does not establish that a high-risk relationship was assessed. Test the reasoning and evidence behind approval.
Prepare for assessment
The assessment type for this guide is management-system certification. Confirm the requirements, what will be assessed and how the assessment will work with the responsible body or customer. These steps help you prepare. You must also follow the scheme’s official rules.
- Define what is covered. List the products, services, activities and sites. Record the standard edition, additional scheme rules and customer requirements.
- Find what is missing. Compare the requirements with current work. Prioritise gaps by risk. Assign someone responsible and a completion date.
- Keep records of everyday work. Check a sample of actual records and speak with the people involved. Make sure they understand their responsibilities.
- Check the results. Complete internal reviews and audits. Check that corrective actions worked before closing problems.
From one site to many
Make it easy to find who is responsible at each site. Keep company policies separate from records of local work. Link each site’s records to its activities, risks and requirements so you can spot gaps at individual sites.
Sites that share a management system do not automatically qualify for one certificate or assessment. Confirm which sites can be included and how they will be checked with the assessment body.
About this guide and its sources
4Auditee wrote this guide using the public source below. The evidence list, audit example and preparation steps are our suggestions. Read the official standard and scheme rules for the full requirements. This guide does not include the standard’s full text or provide certification.
DNV: ISO 37001 reference information