Key takeaways:
- ISO 37001 is the international reference standard for combating bribery in companies.
- It provides a structured framework for preventing, detecting and addressing risks.
- Its 2025 version further strengthens the requirements.
- Understanding this standard means equipping yourself with a solid governance tool recognized worldwide.
What is the ISO 37001 standard?
ISO 37001 is a standard published by the International Organization for Standardization, the global organization that develops ISO standards. It defines the requirements for an anti-bribery management system, often abbreviated as ABMS. Its purpose is simple: to help any organization prevent, detect and address bribery within its activities.
Structuring such an approach requires the expertise of a corporate governance firm.. It works alongsidecorporate compliance experts who are capable of translating the standard into a concrete framework. The stakes are significant. The United Nations and the World Economic Forum estimate that corruption costs approximately $2.6 trillion per year. This represents nearly 5% of global GDP.
This standard belongs to the family of management systems, just like ISO 9001 for quality. It applies to any organization, regardless of its size or sector. Private companies, public services, associations: anyone can implement it. It covers both direct and indirect bribery.
Are you protected against the risk of corruption?
Where does ISO 37001 come from?
The standard has its roots in the United Kingdom. It draws on the BS 10500 standard, developed by the British Standards Institution in connection with the UK Bribery Act, the British anti-corruption law. Following collaborative work between delegations from around twenty countries, ISO adopted the first version, ISO 37001:2016. Its development was entrusted to the ISO/TC 309 technical committee, which oversees governance and compliance standards.
In the United Kingdom, having a certified anti-bribery program constitutes a form of defense that can be invoked against the offense of failure to prevent bribery. Today, ISO 37001 converges with major international legislation, such as the same Bribery Act or the U.S. Foreign Corrupt Practices Act. It thus provides a common language on a global scale.
What changes with ISO 37001:2025
The standard has recently been revised. ISO 37001:2025 was published on February 28, 2025 and replaces the 2016 version. Companies already certified have a transition period: their certificates must transition to the new version by February 28, 2027. This update introduces several important new features:
- A now-formalized anti-bribery culture, to embed integrity at all levels of the organization.
- Strengthened management of conflicts of interest, with more precise identification criteria.
- Consideration of climate change in the context analysis, incorporated through a 2024 amendment.
- A clarification of the “anti-bribery function,” its role and its independence.
The text has also been harmonized with other standards, notably ISO 37301 on compliance management. This consistency facilitates the integration of several management systems within the same organization.
How does an anti-bribery management system work?
ISO 37001 is based on a continuous improvement approach. It follows the “plan, deploy, check, adjust” cycle, which is common to management standards. In practice, the company starts with an analysis of its bribery risks. Each organization then adapts its system to its context, activities and level of exposure. Measures are therefore proportionate to the risks actually identified.
Several elements structure the system. These include:
- An anti-bribery policy approved by management
- A strong leadership commitment
- The appointment of a dedicated person.
Due diligence regarding third parties and business partners is also included, as well as financial and commercial control measures. It also includes training programs, an internal whistleblowing system and regular audits. The entire system must be documented and traceable.
Obtaining ISO 37001 certification
An organization can go further and have its system certified. ISO 37001 certification is issued by an independent and accredited certification body, such as the AFNOR Group in France. It provides an external assessment and genuine legitimacy to the system. However, certification does not guarantee the total absence of corruption. It confirms that a structured system is in place to prevent it.
The process generally follows a three-year cycle. It begins with an initial audit, often preceded by a pre-assessment to measure gaps. The auditor interviews teams, examines practices and verifies compliance with the requirements of the standard. Surveillance audits, generally annual, then confirm that the system remains effective over time.
ISO 37001 and the Sapin II Law: what is the connection?
In France, the question quickly arises. The Sapin II Law applies to companies with more than 500 employees generating more than €100 million in turnover. It requires them to implement a comprehensive anti-corruption prevention program. Risk mapping, code of conduct, whistleblowing system, third-party assessment: its requirements largely overlap with those of ISO 37001.. The standard therefore provides a valuable methodological framework for structuring these obligations. To explore this text further, the Sapin 2 Law guide details each component of the required framework.
- One point to keep in mind: ISO 37001 remains a voluntary approach. It does not replace the law. However, it provides a solid way to demonstrate due diligence, particularly in the event of an inspection by the French Anti-Corruption Agency.
Why adopt this standard? The concrete benefits
Beyond compliance with the law, ISO 37001 provides tangible benefits:
- It reduces the legal and financial risks associated with corruption.
- It protects reputation, an asset that can be difficult to rebuild after a scandal.
- It also strengthens the trust of stakeholders: customers, investors, financial institutions or insurers see it as a strong signal of integrity.
Anti-bribery management also becomes a commercial lever. More and more contracting authorities require compliance guarantees from their suppliers, particularly to access public and international markets. A certification recognized worldwide facilitates these relationships.
Structuring such an approach requires method and experience. This is precisely the area of expertise of Eterra’s expertise, at the intersection of governance and compliance.
- Good to know: Eterra does not issue the certificate: only an accredited and independent body can do so. Our role is to prepare you for it.
ISO 37001 is a comprehensive anti-bribery management system, now strengthened by its 2025 version. The real question is no longer whether to take an interest in it, but how to structure your approach effectively.
YOUR QUESTIONS
FAQ - ISO 37001 Standard and its 2025 Version
Before contacting us, you may have these questions. Here are direct answers from our senior consultants.
—
What exactly is the ISO 37001 standard?
It is the international standard that defines the requirements for an anti-bribery management system (ABMS). It helps any organization, regardless of its size or sector, prevent, detect and address the risks of direct or indirect bribery.
What changes were introduced by the ISO 37001:2025 version?
Published on February 28, 2025, this version strengthens the anti-bribery culture within the company, clarifies the management of conflicts of interest, incorporates climate change into the context analysis and clarifies the role of the anti-bribery function. Certified companies have until February 28, 2027 to transition to this new version.
What is the link between ISO 37001 and the Sapin II Law?
The Sapin II Law requires companies with more than 500 employees and €100 million in turnover to implement an anti-bribery prevention program. The requirements of this law largely overlap with those of ISO 37001, which then becomes a useful methodological framework for structuring these obligations. However, the standard remains voluntary and does not replace the law.
Does ISO 37001 certification guarantee the absence of corruption within the company?
No. It confirms that a structured system is in place to prevent corruption, not that corruption is completely absent. The process follows a three-year cycle with an initial audit followed by regular surveillance audits conducted by an independent certification body such as AFNOR.
