Payment records and approvals are not enough by themselves. Organizations also need to understand why a transaction occurred, who benefited, and what risks the approver considered. Anti-bribery management starts with this decision context and aligns policy with everyday business dealings.
Service classification and standard role
Management-system auditing (MS). Depending on organizational scope and applicable edition, support may cover system implementation, internal audits, supplier audits, or preparation for an external audit. An independent certification body decides whether to issue a certificate under its procedures. This work focuses on bribery risks, due diligence, financial and non-financial controls, reporting, and investigations.
Who may need this and when
Organizations working with agents, tenders, procurement, cross-border operations, or layered business relationships can start by reviewing higher-risk transactions. Organizations using the 2016 edition or receiving a customer request may review edition differences and how existing controls can transition.
Common business challenges
Gifts, hospitality, and agent fees may be approved without recording their purpose or beneficiaries. A partner may be screened before signing but not reassessed after its role changes. Complete-looking approvals do not necessarily help managers identify the real issue.
Approach and applicable requirements
ISO 37001:2025 is the second edition of the anti-bribery management system requirements and guidance. It replaces the 2016 edition and applies to public, private, and nonprofit organizations, covering direct and indirect bribery risks. Its scope is not equivalent to every form of fraud, money laundering, or unlawful conduct. See the ISO overview.
Possible project scope, subject to agreement:
- Risk and partner due diligence: identify situations requiring enhanced review by geography, transaction, and relationship; record sources, review, approval, and update triggers.
- Business interactions and transaction controls: review the basis for payments, procurement, gifts, hospitality, and donations; connect controls to actual authority.
- Reporting, confidentiality, and improvement: route concerns to an appropriate channel and manage conflicts of interest. Case investigations and legal conclusions require appropriate professionals.
Support and work stages
- Select higher-risk activities and define an initial scope from transaction and partner types, policies, and incident summaries.
- Connect due-diligence results to transaction conditions and exception approvals, identifying update or escalation points.
- Use de-identified cases to review approvals, records, and reporting; plan role-based training.
- Review incidents, audits, and management-review information; assess 2016-edition gaps against formal requirements.
Possible deliverables include a risk-scenario list, due-diligence tiers and refresh rules, approval workflows, and reporting and improvement records. Review should show how higher-risk transactions affect approvals and controls.
Information to prepare
- Transaction types, locations, agents, and business relationships.
- Existing risk assessments, due diligence, and review summaries.
- Samples of procurement, payments, benefits, and exception approvals.
- De-identified summaries of reports, training, and improvements.
Start with an information index and de-identified examples. Share project data only after purpose, access, and retention are agreed.
Schedule and fees
Effort depends on locations, partners, and transaction complexity. Enhanced background checks, case investigations, legal services, and third-party certification need separate scope. Transition from the 2016 edition depends on the selected body's arrangements.
Frequently asked questions
Can a system guarantee that bribery will never occur?
Controls depend on context and execution. A system helps identify, prevent, and respond to risks; it cannot guarantee zero incidents.
Can all misconduct be covered by ISO 37001?
Shared mechanisms can be connected, but this standard focuses on bribery. Other issues need their own risks and requirements.
Should every partner receive the same depth of screening?
Use a risk-based approach and record why a review level was chosen and when it should be refreshed.
Must the old system be discarded?
Compare it with the 2025 edition and identify controls and evidence that remain useful; a complete rewrite is not assumed.
Is finance the only department that needs to participate?
Business, procurement, and managers also make key decisions and should confirm non-financial controls.
Who issues the certificate after consulting?
An independent third party evaluates under its applicable scheme. System support and certification scope, purpose, and timing should be agreed separately.
Related services
Bring one difficult transaction or business-benefit scenario and describe the current screening and approval process. Contact Captain International.