What is the primary objective of ISO 37001?

ISO 37001 establishes requirements for an Anti-Bribery Management System (ABMS) to prevent, detect, and respond to bribery. It follows the PDCA cycle across Clauses 4–10, requiring proportionate controls like risk assessment, due diligence, financial controls, training, and reporting. Certification demonstrates reasonable measures but does not guarantee no bribery occurs.

Who is legally or professionally required to comply with ISO 37001?

ISO 37001 applies voluntarily to all organizations regardless of size, type, or sector. It covers public, private, and not-for-profit entities facing bribery risks from personnel, business associates, direct/indirect acts, or receiving bribes. High-risk sectors like extractives, construction, and public procurement adopt it for evidentiary value in enforcement.

Does ISO 37001 require an external audit or third-party certification?

ISO 37001 certification is optional but involves accredited third-party audits. Stage 1 reviews documentation; Stage 2 verifies effectiveness. Certificates last 3 years with annual surveillance audits. Internal audits are mandatory under Clause 9.2.

How often should an assessment for ISO 37001 be performed?

Bribery risk assessments under Clause 4.5 must be conducted periodically and when changes occur. Mature programs perform onboarding due diligence (99% of firms), periodic reviews (56%), and reassessments at contract renewal or events like M&A. Internal audits occur at planned intervals.

What are the consequences of non-compliance with ISO 37001?

Non-conformance with ISO 37001 leads to audit findings, certification denial/suspension, and heightened bribery liability. It offers no absolute prosecution immunity but certification may reduce penalties as evidence of due diligence. ABMS gaps expose organizations to fines, debarment, and reputational harm.

Can ISO 37001 be mapped to other international frameworks?

Yes, ISO 37001 aligns with the Harmonized Structure (HS) for integration with ISO management systems. Its PDCA architecture (Clauses 4–10) supports combining with standards sharing HS/HLS, enabling unified audits, reviews, and risk processes without duplication.

What is the first step to begin implementing ISO 37001?

Conduct a bribery risk assessment and context analysis under Clauses 4.1–4.5. Determine internal/external issues, interested parties, ABMS scope, and risks to inform proportionate planning (Clause 6). Secure leadership commitment (Clause 5) and perform a gap analysis against requirements.

What is the primary objective of APRA CPS 234?

APRA CPS 234 requires regulated entities to maintain an information security capability commensurate with vulnerabilities and threats to information assets. This minimizes the likelihood and impact of incidents on confidentiality, integrity, or availability (CIA), including assets managed by related parties or third parties (paragraphs 1, 15-16). Effective from 1 July 2019, it ensures continued sound operation and protects depositors, policyholders, beneficiaries, and customers.

Who is legally or professionally required to comply with APRA CPS 234?

APRA CPS 234 applies to all APRA-regulated entities, including authorised deposit-taking institutions (ADIs), general insurers, life companies, private health insurers, and RSE licensees (paragraph 2). For Heads of groups, it extends group-wide, including non-regulated entities (paragraph 4). Foreign ADIs, Category C insurers, and eligible foreign life insurers comply for Australian branch operations (paragraph 3). Boards hold ultimate responsibility (paragraph 13).

Does APRA CPS 234 require an external audit or third-party certification?

No, APRA CPS 234 does not mandate external audits or third-party certification. It requires internal audit to review design and operating effectiveness of controls, including those by related parties or third parties, using appropriately skilled personnel (paragraphs 32-34). Systematic testing must be by functionally independent specialists (paragraph 30), but external involvement is optional if commensurate with risks.

How often should an assessment for APRA CPS 234 be performed?

The testing program under APRA CPS 234 must be reviewed at least annually or upon material changes to information assets or the business environment (paragraph 31). Testing frequency is commensurate with vulnerability/threat changes, asset criticality/sensitivity, incident consequences, untrusted environments, and asset changes (paragraph 27). Incident response plans require annual review and testing (paragraph 26).

What are the consequences of non-compliance with APRA CPS 234?

Non-compliance with APRA CPS 234 exposes entities to APRA's prudential powers, including directions, increased supervision, and enforcement actions (paragraphs 9-11). Entities must notify APRA within 72 hours of material incidents (paragraph 35) or 10 business days of unremediable material control weaknesses (paragraph 36), triggering scrutiny. Breaches risk reputational damage, operational restrictions, and systemic stability impacts.

Can APRA CPS 234 be mapped to other international frameworks?

Yes, APRA CPS 234's outcomes-based requirements can be mapped to frameworks like ISO 27001 and NIST Cybersecurity Framework. Its focus on governance, asset classification, commensurate controls, testing, and third-party oversight aligns with ISO 27001's ISMS and NIST's Identify-Protect-Detect-Respond-Recover functions, enabling proportional implementation without prescriptive controls.

What is the first step to begin implementing APRA CPS 234?

The first step for implementing APRA CPS 234 is for the Board to assume ultimate responsibility and define information security roles and responsibilities (paragraphs 13-14). This establishes governance, followed by classifying information assets by criticality and sensitivity to drive commensurate capability, policies, and controls (paragraphs 20-21).

Standards Comparison

ISO 37001 vs APRA CPS 234

ISO 37001

Voluntary

2025

International standard for anti-bribery management systems

APRA CPS 234

Mandatory

2019

Australian prudential standard for information security resilience

Quick Verdict

ISO 37001 offers voluntary global anti-bribery certification for all sectors, mitigating legal risks through due diligence. APRA CPS 234 mandates information security for Australian financial firms, ensuring cyber resilience via strict testing and notifications.

Anti-Bribery/Compliance

ISO 37001

ISO 37001 Anti-Bribery Management Systems

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Risk-based Anti-Bribery Management System framework
Mandatory third-party due diligence and monitoring
Leadership commitment and anti-bribery culture emphasis
PDCA cycle for continual improvement
Internationally certifiable standard with audits

Information Security

APRA CPS 234

APRA Prudential Standard CPS 234 Information Security

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Board ultimate responsibility for information security
72-hour APRA notification for material incidents
Systematic independent testing of controls
Third-party managed asset requirements
Asset classification by criticality and sensitivity

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

ISO 37001 Details

What It Is

ISO 37001 Anti-Bribery Management Systems is a certifiable international standard providing requirements and guidance for establishing, implementing, and improving an Anti-Bribery Management System (ABMS). Its primary purpose is to help organizations prevent, detect, and respond to bribery risks proportionately, using a risk-based PDCA (Plan-Do-Check-Act) approach across public, private, and not-for-profit sectors.

Key Components

Clauses 4–10 covering context, leadership, planning, support, operations, evaluation, and improvement.
Core controls: anti-bribery policy, risk assessments, third-party due diligence, financial/non-financial controls, training, reporting, and audits.
Built on ISO Harmonized Structure for integration with standards like ISO 9001.
Optional third-party certification with annual surveillance audits.

Why Organizations Use It

Mitigates legal risks (e.g., FCPA, UK Bribery Act) via evidentiary "reasonable steps".
Enhances reputation, stakeholder trust, and ESG alignment.
Delivers 15% compliance cost reductions and cultural shifts.
Provides competitive edge in tenders and partnerships.

Implementation Overview

Phased approach: gap analysis, risk assessment, control design, training, monitoring, certification. Applicable to all sizes/sectors; scalable and integrable.

APRA CPS 234 Details

What It Is

APRA Prudential Standard CPS 234 (Information Security) is a binding Australian regulation for APRA-regulated financial institutions. Effective from 1 July 2019, it requires maintaining an information security capability commensurate with threats and vulnerabilities to minimize impacts on confidentiality, integrity, and availability (CIA) of information assets, including those managed by third parties. It adopts a risk-based, assurance-driven approach emphasizing governance and resilience.

Key Components

Board ultimate responsibility (para 13) and defined roles
Asset classification by criticality and sensitivity (para 20)
Commensurate lifecycle controls, systematic testing, internal audit (paras 21-34)
Incident detection/response plans with annual testing (paras 23-26)
APRA notifications: 72 hours for material incidents, 10 business days for weaknesses (paras 35-36) No fixed controls; ~24 core requirements.

Why Organizations Use It

Mandatory for banks, insurers, super funds to avoid penalties, ensure operational resilience, manage third-party risks, and meet prudential obligations. Builds trust, reduces incident impacts, enhances competitiveness.

Implementation Overview

Phased: gap analysis, policy framework, asset inventory/classification, controls/testing, monitoring. Applies Australia-wide to regulated entities of all sizes; requires independent assurance, no certification but APRA supervision. Typically 12-18 months.

Key Differences

Aspect	ISO 37001	APRA CPS 234
Scope	Anti-bribery management systems only	Information security and cyber resilience
Industry	All sectors worldwide	Australian financial services only
Nature	Voluntary certifiable standard	Mandatory prudential regulation
Testing	Internal audits, management reviews	Systematic independent control testing
Penalties	Certification loss, no legal penalties	Regulatory sanctions, fines, enforcement

Scope

ISO 37001

Anti-bribery management systems only

APRA CPS 234

Information security and cyber resilience

Industry

ISO 37001

All sectors worldwide

APRA CPS 234

Australian financial services only

Nature

ISO 37001

Voluntary certifiable standard

APRA CPS 234

Mandatory prudential regulation

Testing

ISO 37001

Internal audits, management reviews

APRA CPS 234

Systematic independent control testing

Penalties

ISO 37001

Certification loss, no legal penalties

APRA CPS 234

Regulatory sanctions, fines, enforcement

Frequently Asked Questions

Common questions about ISO 37001 and APRA CPS 234

ISO 37001 FAQ

APRA CPS 234 FAQ

You Might also be Interested in These Articles...

The NIS2 "FTE Trap": Why 5 Analysts for 24/7 Security is Actually 8 (and Why the Board Needs to Know)

Exposed: NIS2 FTE Trap math shows 5 analysts fail 24/7 coverage due to sickness, training, leave & 2026 churn. Line-by-line breakdown for compliance. Alert your

Beyond the Burden: How Intuitive Compliance Software Transforms Daily Workflows

Explore intuitive compliance software that automates workflows, simplifies onboarding, and reduces stress. Cut non-compliance costs 3x and boost efficiency for

From Reactive Gatekeeper to Proactive Strategist: How Compliance Software Reshapes the Compliance Professional's Day

Discover how compliance software automates monitoring, delivers real-time insights, and transforms compliance pros from reactive gatekeepers to proactive strate

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how ISO 37001 and APRA CPS 234 compare against other standards

Other ISO 37001 Comparisons

Other APRA CPS 234 Comparisons

What It Is

Key Components

Clauses 4–10 covering context, leadership, planning, support, operations, evaluation, and improvement.

Core controls: anti-bribery policy, risk assessments, third-party due diligence, financial/non-financial controls, training, reporting, and audits.

Built on ISO Harmonized Structure for integration with standards like ISO 9001.

Optional third-party certification with annual surveillance audits.

What It Is

Key Components

Board ultimate responsibility (para 13) and defined roles

Asset classification by criticality and sensitivity (para 20)

Commensurate lifecycle controls, systematic testing, internal audit (paras 21-34)

Incident detection/response plans with annual testing (paras 23-26)

APRA notifications: 72 hours for material incidents, 10 business days for weaknesses (paras 35-36) No fixed controls; ~24 core requirements.

Aspect

ISO 37001

APRA CPS 234

Scope

Anti-bribery management systems only

Information security and cyber resilience

Industry

All sectors worldwide

Australian financial services only

Nature

Voluntary certifiable standard

Mandatory prudential regulation

Testing

Internal audits, management reviews

Systematic independent control testing

Penalties

Certification loss, no legal penalties

Regulatory sanctions, fines, enforcement