Continually improve your business with the international anti-bribery management system

Anti-bribery Management System

Corruption represents one of the greatest challenges of the modern business world, with estimated global costs reaching trillions of dollars annually. This phenomenon not only undermines the foundations of justice and the rule of law, but it directly affects economic development, increases business costs, and damages trust in institutions and markets.

In an era of heightened global regulatory scrutiny, where laws such as the US Foreign Corrupt Practices Act (FCPA), the UK Bribery Act, and numerous other national regulations impose strict penalties for corrupt practices, organizations worldwide recognize the need for robust systems to prevent, detect, and counter corruption.

The ISO 37001 – Anti-bribery Management Systems standard was developed in response to this need. As the first international standard specifically designed to combat bribery and corruption, ISO 37001 provides organizations of all sizes and sectors with a comprehensive framework for establishing, implementing, maintaining, and improving an anti-corruption management system.

For EU companies that strive for international business, participation in public procurement, or simply want to build a culture of integrity and transparency, ISO 37001 certification represents a powerful tool that demonstrates a commitment to ethical business and can significantly reduce the legal, financial, and reputational risks associated with corruption.

What is the ISO 37001 standard?

The ISO 37001:2016 standard – Anti-bribery Management Systems is an international standard that specifies requirements and provides guidelines for establishing, implementing, maintaining, and improving an anti-bribery management system. Published in October 2016, this standard represents a global consensus on best practices in the fight against corruption.

Key features of ISO 37001:

• Certification standard – Unlike ISO 26000 which is a guide, ISO 37001 is a certification standard with clearly defined requirements that organizations must meet in order to obtain a certificate.
• Based on ISO HLS – The standard uses the ISO High Level Structure, which means it has the same structure as other modern ISO standards for management systems (ISO 9001, ISO 14001, ISO 45001), facilitating integration.
• Applicable to all organizations – It is designed to be relevant to organizations of all types, sizes, and sectors:
  • Private companies (large, medium, small)
  • Public enterprises
  • Non-governmental organizations
  • Public administration
• Focus on bribery – The standard specifically focuses on the prevention, detection, and response to bribery (bribes), which is the most common and most problematic form of corruption in a business context.
• Reasonable approach – ISO 37001 does not guarantee that bribery will not occur (because an organization cannot control the behavior of all individuals in all situations), but it shows that the organization has implemented reasonable and proportionate measures to prevent, detect, and counter bribery.
• Risk-based – The standard requires organizations to conduct a bribery risk assessment and implement controls proportionate to the identified risks.
• Requirement for a compliance function – The standard requires the appointment of a responsible person (compliance officer) who has the independence and authority to lead the anti-corruption program.
• Due diligence requirements – Specific requirements for the assessment of business partners, especially those who conduct business on behalf of the organization.

ISO 37001 defines bribery as “offering, promising, giving, accepting or soliciting of an undue advantage of any value (which could be financial or non-financial), directly or indirectly, and irrespective of location(s), in violation of applicable law, as an inducement or reward for a person acting or refraining from acting in relation to the performance of that person’s duties.”

Key benefits of the ISO 37001 standard

The implementation of the ISO 37001 standard brings organizations multiple strategic and operational benefits:

• Reduction of corruption risk – A systematic approach to the identification, assessment, and control of bribery risks significantly reduces the likelihood of corrupt incidents.
• Legal protection – In many jurisdictions, possessing a certified anti-corruption system can be a mitigating circumstance in the event of an investigation or court proceeding, demonstrating that the organization has taken reasonable steps for prevention.
• Access to tenders and public procurement – Many public and private tenders, especially international ones, require evidence of anti-corruption measures. An ISO 37001 certificate can be a competitive advantage or even a prerequisite.
• Facilitated access to capital – Investors, banks, and insurance companies are increasingly evaluating governance risks. ISO 37001 demonstrates a robust approach that can facilitate access to financing under more favorable conditions.
• Reputation protection – Scandals related to corruption can destroy a reputation built over decades. ISO 37001 helps in the prevention of such crises and demonstrates a proactive commitment to integrity.
• Strengthening corporate culture – The implementation of the standard sends a clear message to employees, partners, and stakeholders about the organization’s values and acceptable behavior.
• Operational efficiency – Clear processes and procedures reduce ambiguities and the potential for abuse, which can improve efficiency.
• Global competitiveness – For companies that operate or aspire to the international market, ISO 37001 is a recognized reference that facilitates access.
• Compliance with regulations – The standard helps organizations meet the requirements of numerous anti-corruption laws and regulations.

Why is the ISO 37001 standard important

The importance of the ISO 37001 standard stems from the global context of corruption and anti-corruption efforts:

• Global pandemic of corruption – According to Transparency International, over two-thirds of the world’s countries have serious problems with corruption. It is estimated that corruption costs the global economy over 2.6 trillion dollars annually – 5% of global GDP.
• Heightened regulatory scrutiny – In recent decades, there has been a significant tightening of anti-corruption legislation:
  • US FCPA (Foreign Corrupt Practices Act) – penalties in the billions of dollars
  • UK Bribery Act – one of the strictest anti-corruption laws
  • French Sapin II Law
  • Brazilian Clean Company Act
  • UN Convention Against Corruption, ratified by over 180 countries
• Extraterritorial application – Many anti-corruption laws apply extraterritorially, which means that companies can be punished for corrupt acts committed anywhere in the world.
• High penalties – Penalties for violating anti-corruption laws can be enormous:
  • Financial penalties in the billions
  • Prison sentences for responsible individuals
  • Ban on participation in public procurement
  • Reputational damage
• Complexity of global business – In complex supply chains and international operations, the risk of corruption is multiplied. ISO 37001 provides a structured approach to managing these risks.
• Stakeholder expectations – Investors, buyers, employees, and the public have increasingly higher expectations regarding ethical business. Corruption is no longer acceptable as a “way of doing business”.
• Social license to operate – In many contexts, especially in extractive industries or infrastructure development, maintaining a social license to operate requires the demonstration of integrity.
• Competitive fairness – Corruption distorts market competition, favoring those who are willing to bribe instead of those with the best products or services. Anti-corruption efforts help in creating a fair market.

Key principles of the ISO 37001 standard

The ISO 37001 standard rests on several fundamental principles:

• Top management commitment Top management must demonstrate a clear, unambiguous commitment to the anti-corruption policy. This is not “delegate and forget” – leadership must be visible, active, and consistent.
• Independent compliance function The organization must appoint a person or function responsible for the anti-corruption program that has:
  • Independence from operational pressures
  • Authority and resources
  • Direct access to the highest level of management and the supervisory board
• Risk-based approach Different organizations, sectors, geographical locations, and activities carry different levels of corruption risk. ISO 37001 requires:
  • Systematic risk assessment
  • Controls proportionate to the identified risks
  • Continuous updating of the assessment
• Due diligence Before entering into business relationships, especially with partners who will act on behalf of the organization (agents, intermediaries, lobbyists), an anti-corruption risk assessment must be conducted.
• Financial and non-financial controls
  • Accurate and detailed bookkeeping
  • Prohibition of “off-the-books” accounts
  • Controls over gifts, hospitality, donations, sponsorships
• Transparency
  • Culture of transparency and speak-up
  • Employees are encouraged to report concerns
  • Protection of whistleblowers from retaliation
  • Accessible and confidential reporting channels
• Accountability and sanctions
  • Clear consequences for violating anti-corruption policies
  • Consistent application of disciplinary measures
  • Compensation for damages
• Continuous improvement
  • Monitoring, measurement, and analysis
  • Internal audits
  • Management review
  • Learning from incidents and near-misses

Structure of the ISO 37001 standard

The ISO 37001 standard follows the ISO High Level Structure (HLS) with 10 main sections:

• Clause 1-3: Scope, Normative references, Terms and definitions Basic structure, definitions of key terms such as bribery, anti-corruption compliance function, person associated with the organization.
• Clause 4: Context of the organization
  • Understanding the organization and its context
  • Understanding the needs and expectations of interested parties
  • Determining the scope of the anti-bribery management system
  • Anti-bribery management system
• Clause 5: Leadership
  • Leadership and commitment
  • Anti-corruption policy
  • Organizational roles, responsibilities, and authorities
  • Anti-corruption compliance function (compliance officer/function)
  • Delegation of decision-making
• Clause 6: Planning
  • Actions to address risks and opportunities
  • Bribery risk assessment (key requirement)
  • Objectives of the anti-corruption management system and planning to achieve them
• Clause 7: Support
  • Resources
  • Competence
  • Awareness
  • Communication
  • Documented information
• Clause 8: Operation
  • Operational planning and control
  • Due diligence (business partners, projects)
  • Financial controls
  • Non-financial controls:
    • Gifts, hospitality, donations, benefits
  • Controls over inadequate compliance
  • Establishing and implementing anti-corruption controls
  • Managing the engagement of persons doing business on behalf of or for the benefit of the organization
  • Raising concerns (whistleblowing)
  • Investigating and dealing with bribery
  • Response to incidents
• Clause 9: Performance evaluation
  • Monitoring, measurement, analysis, and evaluation
  • Internal audit
  • Management review
• Clause 10: Improvement
  • Nonconformity and corrective action
  • Continuous improvement
• Annex A: Guidelines for the use of the standard

Key concepts of the ISO 37001 standard

Understanding key concepts is critical for effective implementation:

• Bribery Offering, promising, giving, accepting, or soliciting an undue advantage. It can be:
  • Active bribery: offering or giving a bribe
  • Passive bribery: soliciting or accepting a bribe
  • Public sector: bribe to public officials
  • Private sector: commercial bribery between private parties
• Undue advantage Anything to which the recipient is not entitled or which is not justified. It can be:
  • Financial (cash, loans, rebates)
  • Non-financial (hiring relatives, favors, political influence, sexual favors)
• Person associated with the organization Employee, director, owner, volunteer, or anyone else who does business on behalf of or for the benefit of the organization (agents, intermediaries, consultants, subcontractors, joint venture partners).
• Due diligence The process of evaluating bribery risks prior to:
  • Engaging business partners
  • Starting projects
  • Entering new markets
  • Mergers or acquisitions
• Bribery risk assessment A systematic analysis that identifies:
  • Where the risks are (functions, business units, geographic locations, transactions)
  • What the risks are (types, scenarios)
  • Likelihood that the risk will materialize
  • Impact if the risk materializes
  • Existing controls and their adequacy
  • Residual risk and the need for additional measures
• ABMS Compliance Function A person or team responsible for overseeing the anti-corruption program. Must have:
  • Independence (not subject to operational pressures)
  • Authority
  • Resources
  • Access to the highest level of management
• Facilitating payments Small, illegal payments made to “speed up” routine administrative actions. Although smaller than classic bribes, most standards and laws treat them as bribery.
• Red flags Warning signs that may indicate potential bribery:
  • Unusual payment structures or destinations
  • Excessive commercial intermediaries or agents
  • Requests for cash or payments to offshore accounts
  • Close relationship of the intermediary with officials
  • Refusal of anti-corruption clauses in contracts
• Speak-up/Whistleblowing Mechanisms that allow employees and other associated persons to anonymously or confidentially report concerns or suspicions of bribery without fear of retaliation.

Areas of application of the ISO 37001 standard

The ISO 37001 standard is applicable to a wide range of organizations and sectors:

• Types of organizations:
  • Private companies (from multinational corporations to small enterprises)
  • Public enterprises and state-owned enterprises
  • Non-governmental organizations (especially those receiving donations or managing projects)
  • Public administration (city and municipal institutions)
• High-risk sectors:
  • Infrastructure and construction: public procurement, permits, inspections
  • Extractive industries: exploitation permits, land rights
  • Defense and security: public procurement, high contract value
  • Pharmacy and healthcare: relations with doctors and public health systems
  • Telecommunications: licenses, regulatory approvals
  • Energy: permits, concessions, regulation
• High-risk geographic locations: Organizations operating in or with countries with a high level of corruption according to the Transparency International Corruption Perceptions Index
• Specific activities:
  • Public procurement: participation in public sector tenders
  • Lobbying and political relations: interaction with officials
  • Sponsorships and donations: especially in contexts where there are ties to officials
  • Joint ventures: partnerships where risk is shared
  • Mergers and acquisitions: inheriting risks and liabilities
  • Use of agents, intermediaries, consultants: third parties acting on behalf of the organization
• Size of the organization:
  • The ISO 37001 standard can be scaled – small entrepreneurs can implement a proportionally simpler system, while large multinational corporations need a more sophisticated infrastructure

Benefits of implementing the ISO 37001 standard

Organizations that implement the ISO 37001 standard achieve tangible benefits:

• Legal and regulatory benefits:
  • Mitigation of penalties: In some jurisdictions, holding an ISO 37001 certificate can lead to a reduction in penalties
  • Affirmative defense: Demonstration of “adequate procedures” that can be a defense in case of an investigation
  • Compliance with multiple laws: A single system that helps meet the FCPA, UK Bribery Act, Sapin II, and others
  • Facilitated due diligence: Partners and buyers accept ISO 37001 as proof of robust controls
• Business benefits:
  • Access to tenders: Many international tenders, especially those of multilateral development banks (World Bank, EBRD), prefer or require anti-corruption certificates
  • Competitive advantage: Differentiation from competitors who do not have certified systems
  • Facilitated onboarding with buyers: Faster vendor approval procedure
  • Stronger partnerships: More reliable partners prefer working with certified organizations
• Financial benefits:
  • More favorable financing conditions: Banks may offer better interest rates to organizations with certified anti-corruption systems
  • Access to ESG funds: Investors focused on governance criteria
  • Lower insurance premiums: Demonstration of risk management
  • Reduction of losses: Prevention of corruption that drains resources
• Operational benefits:
  • Clearer processes: Reduction of ambiguity in decision-making
  • More efficient resource allocation: Fair competition within the organization
  • Better cost control: Transparency reduces “leakage”
  • Higher quality partners: Due diligence attracts reliable collaborators
• Cultural and reputational benefits:
  • Strong ethical culture: Clear values and standards of behavior
  • Employee pride: People want to work in ethical organizations
  • Employer branding: Attracting talents who value integrity
  • Reputation of integrity: Protection of the most valuable intangible asset
  • Trust with stakeholders: Stronger relationships with buyers, suppliers, community
• Social benefits:
  • Contribution to the fight against corruption: Creating an ecosystem of integrity
  • Fair competition: Contribution to a fair market
  • Sustainable development: Corruption is an obstacle to sustainable development

ISO 37001 standard implementation process

Shutterstock

Explore

The implementation of ISO 37001 requires a structured and systematic approach:

• Phase 1: Preparation and engagement (2-4 weeks)
  • Education and obtaining the commitment of the board and top management
  • Appointment of the ABMS Compliance Officer
  • Formation of the implementation team
  • Allocation of budget and resources
  • Defining the scope (the whole organization or a pilot)
  • Development of the project plan
• Phase 2: Gap analysis and risk assessment (4-6 weeks)
  • Detailed mapping of current anti-corruption measures against ISO 37001 requirements
  • Identification of gaps
  • Comprehensive bribery risk assessment:
    • Mapping functions, processes, locations
    • Identification of interactions with the public and private sectors
    • Analysis of third-party relationships
    • Evaluation of geographic risks
    • Assessment of transactional risks (tenders, permits, customs processes)
  • Assessment of existing controls
  • Evaluation of residual risks
  • Prioritization of actions according to risk
• Phase 3: Development of policies and procedures (6-8 weeks)
  • Anti-corruption policy (clear, concise, understandable statement from top management)
  • Code of conduct
  • Specific procedures:
    • Due diligence procedure for business partners
    • Gifts and hospitality policy
    • Donations and sponsorships policy
    • Political contributions policy
    • Hiring procedure
    • Procurement procedure
    • Facilitating payments policy
    • Conflict of interest policy
    • Whistleblowing procedure
    • Investigation procedure
    • Financial controls and accounting procedure
    • HR procedures (background checks, contractual clauses, discipline)
• Phase 4: System due diligence (4-6 weeks)
  • Mapping of all third parties (agents, consultants, joint venture partners, distributors)
  • Third-party risk assessment
  • Due diligence questionnaires
  • Background checks for high-risk partners
  • Remediation or termination of risky relationships
  • Anti-corruption clauses in contracts
• Phase 5: Training and awareness raising (continuous)
  • Top management training: roles and responsibilities
  • Employee training: everyone must understand the basics of the policy
  • Targeted training for high-risk functions:
    • Sales and business development
    • Procurement
    • Legal and contract management
    • Finance and accounting
    • Operations (staff interacting with officials)
  • Training for due diligence staff
  • Training for investigators for processing reports
  • Communication campaign (posters, emails, town halls)
• Phase 6: Implementation of controls (8-12 weeks)
  • Rolling out procedures throughout the organization
  • Implementation of technological solutions (where relevant):
    • Gifts & hospitality tracking system
    • Third-party due diligence platforms
    • Whistleblowing hotline
    • E-learning platforms
  • Testing controls
  • Validation of effectiveness
• Phase 7: Documentation and records (continuous)
  • Comprehensive system documentation (ABMS Manual)
  • Templates and forms
  • Systems for maintaining records (trainings, due diligence, gifts registry, investigations)
• Phase 8: Internal audit and preparation for certification (4-6 weeks)
  • Training of internal auditors
  • Conducting a complete internal audit
  • Identification and resolution of nonconformities
  • Mock audit by consultants
  • Management review
  • Final preparation for the certification audit
• Phase 9: Certification audit
  • Selection of an accredited certification body
  • Stage 1 audit (documentary review)
  • Stage 2 audit (on-site audit)
  • Resolution of non-conformities
  • Issuance of the certificate

Total time: usually 9-15 months depending on the size and complexity of the organization.

ISO 37001 standard certification process

The ISO 37001 certification is conducted through a standardized process:

• Selection of a certification body:
  • Must be accredited (e.g., by UKAS, DAkkS, ANAB)
  • Experience in anti-corruption audits
  • Knowledge of the relevant industry
  • Geographical coverage (important for multinational organizations)
• Application and planning:
  • Submission of the application with basic information
  • The certification body determines the number of audit days according to ISO 37301 (standard for auditing ABMS)
  • Scheduling audit dates
• Stage 1 Audit (Documentary review):
  • Review of ABMS documentation
  • Verification whether the system is adequately documented
  • Understanding the organization and its context
  • Identification of potential issues before Stage 2
  • Can be conducted remotely or on-site
• Stage 2 Audit (Implementation audit):
  • Preparation:
    • Complete documentation available to auditors
    • Key personnel informed and available
    • Records organized
  • Opening meeting:
    • Presentation of the audit team and scope
    • Explanation of the methodology
    • Q&A
  • Audit activities:
    • Interviews:
      • Top management (board, CEO, CFO)
      • Compliance Officer and team
      • High-risk functions (sales, procurement, operations)
      • HR, Legal, Finance, IT
      • Sample of employees at different levels
    • Review of documentation and records:
      • Bribery risk assessments
      • Due diligence files
      • Gifts & hospitality register
      • Training records
      • Investigation files (if any exist)
      • Contracts with third parties
      • Financial controls documentation
    • Verification of implementation:
      • How procedures work in practice
      • Employee awareness of policies
      • Effectiveness of controls
      • Culture and tone at the top
  • Closing meeting:
    • Presentation of findings
    • Classification of non-conformities:
      • Major: Systemic flaw, severe deviation from requirements
      • Minor: Isolated issue, does not threaten the integrity of the system
    • Discussion on next steps
• Post-audit:
  • The organization develops a Corrective Action Plan for all non-conformities
  • Implementation of corrective actions (usually 90 days for major, 30 days for minor)
  • The auditor verifies the closure of actions (can be documentary or by a return visit)
• Issuance of the certificate:
  • If all non-conformities are resolved
  • The certificate is valid for 3 years
  • With mandatory annual surveillance audits
• Publication:
  • The certificate is published in the ISO Survey and IAF CertSearch databases (depending on the system of the certification body)

ISO 37001 certificate – features and importance

The ISO 37001 certificate is an official document that confirms compliance:

• Content of the certificate:
  • Full name and address of the organization
  • Scope of certification (which activities, locations are covered)
  • Certificate number
  • Issue date and expiry date (3 years)
  • Name and logo of the accredited certification body
  • Accreditation body (e.g., UKAS logo)
  • Statement of compliance with ISO 37001:2016
• Scope definition: A clearly defined scope is critical. For example:
  • “Design, manufacturing and sales of automotive components”
  • “Provision of engineering consulting services in the oil & gas sector”
  • Geographical scope can be specified (e.g., “operations in Europe (EU)”)
  • Multi-site certificates can cover multiple locations
• Validity and maintenance:
  • Initial certificate: 3 years
  • Year 1 surveillance audit: usually 1/3 the length of the initial audit
  • Year 2 surveillance audit: similar to Year 1
  • Re-certification audit (Year 3): similar to the initial audit
• Certificate transfer: If an organization wishes to change its certification body, a transfer audit can be conducted instead of a full re-certification cycle.
• Suspension or withdrawal: A certificate can be suspended or withdrawn if:
  • The organization does not allow a surveillance audit
  • Major non-conformities are identified that are not resolved
  • The organization misuses the certificate (e.g., false claims)
  • A serious incident occurs that indicates a systemic failure

Importance of the ISO 37001 certificate

An ISO 37001 certificate carries significant weight in various contexts:

• Legal context:
  • “Adequate procedures” defence: Under the UK Bribery Act, possessing a certified ABMS can be an “adequate procedures” defense
  • Penalty reduction: Some jurisdictions or prosecutors may consider it as a mitigating circumstance
  • Deferred Prosecution Agreements: The implementation of ISO 37001 is often part of a settlement
• Business context:
  • Pre-qualification for tenders: Many multilateral development banks, UN agencies, and public procurement reward or require anti-corruption certificates
  • Vendor due diligence: Multinational corporations conducting third-party due diligence recognize ISO 37001
  • Partnership agreements: Facilitates the conclusion of joint ventures and strategic partnerships
• Financial context:
  • ESG ratings: Rating agencies (MSCI, Sustainalytics, etc.) positively evaluate ISO 37001
  • Credit rating: Governance is part of credit analysis
  • Green/social bonds: Robust governance is a prerequisite
• Reputational context:
  • Brand differentiation: In industries with a perception of corruption
  • Crisis resilience: If an incident occurs, the certificate can help demonstrate that it was an isolated case, not a systemic problem
  • Media and PR: A positive communication story
• Internal:
  • Clarity for employees: The certificate signals the organization’s seriousness
  • Empowerment for the compliance function: Adds weight to compliance activities

Price of the ISO 37001 standard

The costs of implementing and certifying the ISO 37001 standard vary depending on several factors:

• Consulting services:
  • Gap analysis and initial assessment
  • Bribery risk assessment facilitation
  • Development of policies, procedures, and documentation
  • Due diligence framework design
  • Training for different levels
  • Internal audit training
  • Mock audit and preparation for certification These costs depend on:
  • Size and complexity of the organization
  • Geographic dispersion
  • Number of locations
  • Current level of anti-corruption measures
  • Need for on-site vs remote support
• Certification costs:
  • Application fee
  • Stage 1 and Stage 2 audit (number of days depends on the organization’s size according to ISO 37301)
  • Surveillance audits (annually)
  • Re-certification audit (every 3 years)
  • Auditor travel expenses (if relevant)
• Internal costs:
  • Time of the compliance officer and team
  • Time of other employees in implementation
• Technology (if used):
  • Whistleblowing hotline/platform
  • Due diligence software
  • Gifts & hospitality tracking system
  • E-learning platform
• Due diligence costs:
  • Background check services
  • Database subscriptions (World-Check, Dow Jones Risk & Compliance)
  • Legal reviews of contracts and clauses
• Ongoing costs:
  • Compliance function (salaries and resources)
  • Annual training
  • Surveillance audits
  • Refresher due diligence
  • Risk assessment updating
  • Technology subscriptions

ROI perspective: Although the costs can be significant, they should be compared to:

• Potential fines (FCPA fines can range from hundreds of millions to billions)
• Reputational damage from a scandal
• Lost business opportunity without a certificate
• Operational leakage from corruption

Mobes Group can help optimize costs through an efficient implementation plan that maximizes value.

If you are interested in the price of the ISO 37001 standard, fill out the REQUEST FOR A QUOTE and our team will provide you with a personalized price for the ISO 37001 standard as soon as possible.

Based on your inquiry, you will receive:

• clear information about the price and duration of the process,
• an explanation of the steps for implementing the standard,
• expert support throughout the entire certification process.

Fill out the form and take the first step towards compliance with the ISO 37001 standard and the improvement of your business.

European certificate ISO 37001

In Europe (EU), the awareness of the importance of anti-corruption systems is growing:

• Applicability in the EU: ISO 37001 is a global standard and is equally applied in Europe (EU) as anywhere else in the world. A certificate issued in Europe (EU) has the same validity and recognition as a certificate issued in London, Berlin, or New York.
• Specific European context:
  • Perception of corruption: According to the Transparency International CPI (Corruption Perceptions Index), the European market tackles the perception of corruption, making anti-corruption certificates particularly valuable.
  • EU regulatory framework: Various directives and regulations require the strengthening of anti-corruption measures.
  • Public procurement: Frequent allegations of corruption – ISO 37001 can help EU companies differentiate themselves.
  • Export opportunities: EU companies that export or strive for international partnerships have a competitive advantage with the certificate.
• Regional drivers:
  • Companies working with multinational clients to whom ISO 37001 is important
  • Participants in international tenders
  • Companies in high-risk sectors (infrastructure, energy, pharmacy)
  • Organizations that want to build a reputation of integrity
• Mobes Group support: Mobes Group provides specialized support to EU companies:
  • Understanding EU anti-corruption laws and their integration with ISO 37001
  • Regional knowledge of risks specific to Europe (EU)
  • Connecting with relevant local stakeholders
  • Preparation of documentation in the English language
  • Consultations tailored to the local business culture

ISO 37001 standard in Europe (EU) – legal framework and support

Europe (EU) has a developed anti-corruption legal framework:

• Key regulations:
  • EU Anti-Corruption Directive framework: The primary framework defining corruption, prevention of conflict of interest, and control mechanisms.
  • European criminal law standards on corruption: Definition of criminal offenses of receiving and giving a bribe.
  • Directive on the fight against fraud to the Union’s financial interests by means of criminal law (PIF Directive): Regulates the jurisdiction in combating organized crime and severe fraud.
  • EU Public Procurement Directives: Anti-corruption measures in public procurement.
  • European Transparency Register regulations: Transparency of influence on decision-making.
  • EU Whistleblowing Directive (Directive (EU) 2019/1937): Protection of those who report corruption.
  • EU Competition Law and State Aid rules: Anti-corruption measures.
  • EU Freedom of Information frameworks (Regulation 1049/2001): Transparency of public administration.
• Institutional framework:
  • European Anti-Fraud Office (OLAF): Independent body for the prevention of corruption.
  • European Public Prosecutor’s Office (EPPO): Criminal prosecution of corruption.
  • European Court of Auditors (ECA): Control of public funds.
  • European Data Protection Supervisor (EDPS): Transparency.
• EU Anti-Corruption Strategy: Europe (EU) has an Anti-Corruption Strategy with action plans that covers:
  • Prevention of corruption
  • Public procurement
  • Privatization
  • Strengthening the judicial system
  • Media and civil society
• ISO 37001 standard as an upgrade: While EU laws define what is illegal and prescribe penalties, ISO 37001:
  • Provides a systematic framework for prevention
  • Integrates global best practices
  • Enables the demonstration of due diligence
  • Helps in building a culture of integrity that goes beyond minimum compliance
• Implementation support:
  • European Chambers of Commerce (Eurochambres): Integrity and anti-corruption programs
  • BusinessEurope: Business Integrity Initiative
  • Transparency International EU: CSOs working on anti-corruption
  • EU projects: Support through Horizon Europe and structural funds
  • European Investment Bank (EIB), Council of Europe (GRECO), UNDP: Governance and anti-corruption support programs

Maintaining the ISO 37001 certificate

The ISO 37001 certificate requires active maintenance:

• Surveillance audits:
  • Year 1 and Year 2: Annual surveillance audits
  • Focus on:
    • Continuous effectiveness of the system
    • Management review
    • Resolution of non-conformities from the previous audit
    • Changes in the system or organization
    • Handling of incidents (if any occurred)
    • Training effectiveness
    • Bribery risk assessment updates
• Continuous activities:
  • Bribery risk assessment refresh: Minimum annually or when significant changes occur
  • Training: Regular refresher training, training for new employees
  • Due diligence: Continuous monitoring of existing third parties, due diligence for new ones
  • Internal audits: Minimum once a year, covering all elements of the standard
  • Management review: Minimum once a year, evaluates the effectiveness of the ABMS
  • Investigations: Prompt investigation of all reported concerns
  • Policy updates: Updating policies according to changes in laws, risks, or the organization
• Change management: All significant changes must be evaluated for anti-corruption risk:
  • New markets or geographic expansions
  • New products or services
  • Mergers or acquisitions
  • New business models or partners
  • Organizational restructuring
  • Changes in regulation
• Documentation updating:
  • Documentation must reflect actual practice
  • Lessons learned from incidents or near-misses
  • Best practices from other parts of the organization or industry
• KPI monitoring: Tracking metrics such as:
  • Number of whistleblowing reports received
  • Response time to reports
  • Training completion rates
  • Due diligence completion rates
  • Gifts & hospitality declarations
  • Third party risks identified and mitigated
• Preparation for re-certification:
  • Year 3: Re-certification audit which is similar in scope to the initial audit
  • Comprehensive system assessment
  • Demonstration of continuous improvement during the 3-year cycle

Integration with other management systems

The ISO 37001 standard naturally integrates with other standards:

• ISO 9001 standard (Quality):
  • Common HLS structure facilitates integration
  • Quality includes “doing the right thing” which includes ethical behavior
  • Procurement controls and supplier management
  • Document control and records management
• ISO 14001  standard (Environment):
  • Common structure
  • Environmental permits – bribery risk for obtaining permits
  • Compliance with environmental regulations – bribery risk for inspections
  • Common due diligence procedures
• ISO 45001 standard (Occupational Health and Safety):
  • Safety permits and inspections – risk areas
  • Common compliance approach
  • “Speak-up” culture applicable to both safety and anti-corruption
• ISO 27001 standard (Information Security):
  • Protection of sensitive data (investigation files, whistleblower identities)
  • Cyber risks – cyber extortion can be a form of bribery
  • Access controls and confidentiality
• ISO 26000 standard (Social Responsibility):
  • ISO 37001 operationalizes Fair Operating Practices (Section 6.6) from ISO 26000
  • Common stakeholder engagement
  • Governance principles
• SA8000 standard, SEDEX SMETA standard (Labor standards):
  • Anti-corruption as part of ethical trade
  • Common worker voice and whistleblowing mechanisms
• ISO 31000 standard (Risk Management):
  • Bribery risk assessment as part of enterprise risk management
  • Integrated view of risks
• ISO 37301 standard (Compliance Management System):
  • ISO 37001 is a specialized compliance standard
  • Can be part of a broader compliance system

Advantages of an integrated approach:

• Efficiency: One integrated audit instead of multiple
• Consistency: A unified approach to governance and controls
• Synergies: Common processes (due diligence, training, document control)
• Holistic risk management: Understanding how risks overlap
• Unified culture: A unified message about values and standards

Mobes Group has the expertise in designing integrated management systems that maximize efficiency.

Mobes Group – your partner for ISO 37001 certification

Mobes Group is a specialized consultant for the implementation of the ISO 37001 standard in Europe (EU):

• Deep expertise:
  • Anti-corruption legislation (global and local)
  • Bribery risk assessment methodologies
  • Due diligence best practices
  • Investigation techniques
  • Whistleblowing program design
  • Anti-corruption trainings and awareness campaigns
• Complete services:
  • Initial assessment:
    • Gap analysis according to ISO 37001
    • Preliminary bribery risk assessment
    • Readiness evaluation
    • Implementation plan and timeline
  • Bribery Risk Assessment:
    • Facilitation of comprehensive risk assessment workshops
    • Mapping of functions, processes, geographies, transactions
    • Identification and evaluation of risks
    • Prioritization according to likelihood and impact
    • Control assessment and gap identification
  • ABMS development:
    • Anti-corruption policy and code of conduct
    • Suite of procedures (due diligence, gifts, donations, whistleblowing, investigation)
    • Financial and non-financial controls
    • ABMS Manual and documentation
    • Templates and forms
  • Due Diligence Framework:
    • Third party risk categorization
    • Due diligence questionnaires
    • Risk-based screening protocols
    • Red flag identification
    • Contractual clauses
    • Ongoing monitoring procedures
  • Training:
    • Board and executive leadership
    • Compliance function
    • High-risk functions (sales, procurement, government relations)
    • General employee awareness
    • Investigators training
    • Train-the-trainer programs
  • Investigation Support:
    • Investigation protocol design
    • Investigation team training
    • Forensic support (if needed)
  • Technology Advisory:
    • Evaluation and selection:
      • Whistleblowing platforms
      • Due diligence software
      • Gifts & hospitality tracking
      • E-learning platforms
    • Implementation support
  • Preparation for certification:
    • Internal audit
    • Mock certification audit
    • Non-conformity remediation
    • Audit readiness coaching
  • Post-certification:
    • Preparation for surveillance audits
    • Risk assessment refresh
    • Continuous improvement consulting
• Local and global perspective:
  • Knowledge of EU anti-corruption legislation
  • Experience with anti-corruption challenges in the region
  • Application of international best practices
  • Networking with the global anti-corruption community

Why choose Mobes Group?

• Specialized expertise in anti-corruption: Unlike generalist consultants, our team is specialized in compliance and anti-corruption, with a deep understanding of both global standards and local realities.
• Practical, not theoretical approach: We have worked with organizations facing real anti-corruption challenges. We understand the realities of doing business in contexts where corruption is a systemic problem.
• Risk-based mentality: We do not believe in “one-size-fits-all”. We help organizations develop systems proportional to their specific risks, not generic procedures.
• Independence and integrity: Our advice is not colored by politics or conflicts of interest. We speak the truth, even when it is uncomfortable.
• Culture, not just compliance: We understand that an ISO 37001 certificate is valuable only if supported by an authentic culture of integrity. We help build that culture, not just on “paper”.
• Confidentiality: Anti-corruption implementation often reveals sensitive information. We guarantee absolute discretion.
• Investigation support: If an incident occurs during or after implementation, we can provide support in investigation and remediation.
• Long-term partnership: Anti-corruption is not “set-and-forget”. Many of our clients work with us for years, continuously improving their ABMSs.
• Reputation and integrity: Our own reputation depends on integrity. We will never be part of the problem – our goal is to be part of the solution.

Most common challenges and how to overcome them

• Challenge 1: “Tone at the top” is not authentic. Leadership only seemingly advocates the fight against corruption, but the signals of real priority are different.
  • Solution:
    • Explicit communication from the board and CEO
    • “Walk the talk” – visible behavior that models standards
    • Linking executive compensation to compliance performance
    • Zero tolerance demonstrated through actions, not just words
    • Board oversight and regular reporting
• Challenge 2: “But everybody does it” mentality. In contexts where corruption is endemic, the perception that “there is no other way”.
  • Solution:
    • Education on long-term risks (legal, reputational, operational)
    • Showcase successful examples of companies doing business with integrity
    • Creatively looking for alternatives (e.g., instead of a bribe, a legal consulting fee)
    • A strong support function that helps the business find legal paths
    • Willingness to walk away from some opportunities
• Challenge 3: Due diligence is too extensive/too slow. The business wants fast decisions, due diligence slows down.
  • Solution:
    • Risk-based tiering: fast track for low-risk, detailed for high-risk
    • Technology: automated screening platforms
    • Pre-approved lists of reliable partners
    • Standard clauses that accelerate contracting
    • Education of the business function on the value of due diligence
• Challenge 4: Fear of reporting (whistleblowing). Employees fear retaliation or do not believe anything will happen.
  • Solution:
    • Anonymity guaranteed through a third-party hotline
    • Visible action on reported cases
    • Non-retaliation policy strictly enforced
    • Communication of outcomes (anonymized)
    • Leadership that praises the courage of reporting
• Challenge 5: Gifts and hospitality – where is the limit? It is unclear what is acceptable “relationship building” versus bribery.
  • Solution:
    • Clear monetary limits
    • Pre-approval for anything above a certain threshold
    • Transparency through a register
    • “Smell test”: would it be embarrassing if it became public?
    • Categorical ban on cash
    • Timing: not around tender periods or decision-making
• Challenge 6: “We are too small for ISO 37001”. The perception that the standard is only for large corporations.
  • Solution:
    • ISO 37001 is scalable – small organizations can have simpler systems
    • Focus on priority risks
    • Leveraging existing procedures where possible
    • Phased approach to implementation
    • ROI demonstration – even small companies face big risks
• Challenge 7: Integration with business processes. Anti-corruption controls are perceived as an “add-on” that slows down the business.
  • Solution:
    • Build compliance INTO the process, not as a separate step
    • Automation where possible
    • Clear escalation path when compliance and business are in conflict
    • Demonstration of business value (higher quality partners, fewer risks)

The future and the ISO 37001 standard

The anti-corruption field continues to evolve:

• Regulatory changes:
  • OECD Convention: Continuous strengthening of implementation
  • EU: Directives such as the EU Whistleblowing Directive
  • National laws: More and more countries are introducing or strengthening anti-corruption legislation
  • Extraterritoriality: Broader application of extraterritorial jurisdiction
• Technology:
  • AI and machine learning: For identifying red flags in transaction data
  • Blockchain: For transparency in supply chains and transaction records
  • Advanced analytics: For discovering patterns of corruption
  • Digital forensics: More sophisticated investigation tools
  • Biometric and identity verification: For due diligence
  • But also new risks: Cyber extortion, cryptocurrency bribes
• Increased transparency:
  • Beneficial ownership registries: Harder to hide real owners
  • Open data: More publicly available information for due diligence
  • Whistleblowing protection: Stronger protections in more jurisdictions
  • Public registries: Company registers, lobbying registers
• ESG integration:
  • Anti-corruption as a critical “G” in ESG
  • ESG ratings include anti-corruption as a major factor
  • Investor activism around governance issues
  • Link between anti-corruption and SDGs (SDG 16)
• Focus on supply chains:
  • Broader responsibility for corruption in the value chain
  • Supply chain transparency legislation
  • Expectation of due diligence throughout the entire chain
• Revision of the standard: ISO standards are usually revised every 5 years. ISO 37001 will likely be revised to include:
  • Newer anti-corruption trends and best practices
  • Technological developments
  • Lessons learned from implementation
  • Stronger requirements around third-party management
  • Integration with other compliance areas (sanctions, AML, human rights)

Organizations that implement ISO 37001 today are not only addressing current needs but are building a foundation for long-term resilience and integrity.

How to Start?

If you want to introduce the ISO 37001 standard in your company, the process is simple:

• Contact Mobes Group – Contact page or send a request for a quote
• Initial Consultation – Our team will analyze your needs and current state
• Tailored Plan – You will receive a detailed implementation plan adapted to your enterprise
• Implementation – With our support, you will carry out all necessary changes
• Certification – We will help you successfully go through the certification process

ISO 37001 standard

In a world where corruption represents a trillion-dollar drain on the global economy and where penalties for corrupt practices can destroy organizations, ISO 37001 is not a luxury – it is a fundamental element of responsible corporate governance.

For organizations in Europe (EU), whether they are domestic companies aspiring to international competitiveness, multinational corporations operating locally, or public institutions committed to integrity, ISO 37001 provides a credible, internationally recognized framework for demonstrating commitment to anti-corruption.

The path to ISO 37001 certification is not always easy. It requires the courage to face uncomfortable realities, the determination to uphold standards even when it means losing some opportunities, and the persistence to build a culture that goes beyond compliance and becomes part of the organization’s DNA. But the rewards are massive: reduced risk, stronger reputation, better business resilience, and the awareness that your organization contributes to a fair and transparent business environment.

Your path to business excellence begins here. Contact Mobes Group today and discover how the ISO 37001 standard can improve your business.

Mobes Europe – Elite Consulting Services for ISO Standard Implementation & Certification

Email: info@mobes.eu