What is the primary objective of ISO 37001?

ISO 37001 specifies requirements for establishing, implementing, maintaining, and improving an Anti-Bribery Management System (ABMS) to prevent, detect, and respond to bribery. It enables organizations to demonstrate reasonable, proportionate measures addressing bribery risks, complying with anti-bribery laws and voluntary commitments, without guaranteeing bribery will never occur. Applicable across sectors and sizes, it follows the PDCA cycle via Clauses 4–10, emphasizing risk-based controls like due diligence and financial safeguards.

Who is legally or professionally required to comply with ISO 37001?

ISO 37001 is voluntary and applicable to any organization—public, private, or not-for-profit—regardless of size, type, or location. No legal mandates exist, but professionals in high-risk sectors (e.g., extractives, construction, public procurement) adopt it for regulatory alignment (e.g., FCPA, UK Bribery Act), tender requirements, or investor ESG demands. Boards, CCOs, and procurement leads pursue it to mitigate third-party risks, where 95% of cases originate.

Does ISO 37001 require an external audit or third-party certification?

ISO 37001 certification is optional but involves accredited third-party audits for external validation. Stage 1 reviews documentation; Stage 2 verifies implementation effectiveness. Successful audits yield a 3-year certificate with annual surveillance (every 12–24 months). Certification amplifies evidentiary value in investigations, demonstrating "reasonable steps," though it offers no absolute legal immunity.

How often should an assessment for ISO 37001 be performed?

Bribery risk assessments under ISO 37001 must be conducted initially, then periodically and when significant changes occur. Mature programs align with 99% onboarding due diligence, 56% periodic reviews independent of contracts, and annual internal audits. Clause 9 requires ongoing monitoring, with management reviews evaluating performance at planned intervals to support continual improvement.

What are the consequences of non-compliance with ISO 37001?

Non-conformance with ISO 37001 risks certification denial, suspension, or withdrawal by auditors. Operationally, it exposes organizations to bribery incidents without demonstrable due diligence, potentially increasing fines, reputational damage, and liability under laws like FCPA or UK Bribery Act. While not legally binding, absent ABMS evidence may worsen enforcement penalties; certification can mitigate by up to 15% compliance costs.

An ISO 37001 be mapped to other international frameworks?

Yes, ISO 37001 aligns with the Harmonized Structure (HS), enabling seamless integration with standards sharing Clauses 4–10. Its PDCA architecture maps to broader systems, reducing duplication in audits and reviews. Globally recognized, it complements OECD conventions and national laws, providing a benchmark for anti-bribery controls without overlap into fraud or money laundering.

What is the first step to begin implementing ISO 37001?

The first step is determining organizational context and scope per Clause 4, including bribery risk assessment. Identify internal/external issues, interested parties, and ABMS boundaries, followed by leadership commitment (Clause 5) via policy and roles. Conduct a gap analysis against Clauses 4–10 to prioritize actions, ensuring proportionality to risks like third-party exposure.

What is the primary objective of AS9110C?

AS9110C's primary objective is to enable aviation maintenance organizations to consistently provide products and services meeting customer and applicable statutory/regulatory requirements while enhancing customer satisfaction through effective QMS application and continual improvement. It incorporates ISO 9001:2015's Annex SL structure (Clauses 4–10) with aviation-specific additions like configuration management, product safety, counterfeit parts prevention, traceability, preservation, and human factors controls, ensuring continuing airworthiness for repair stations and MRO providers.

Who is legally or professionally required to comply with AS9110C?

AS9110C applies to organizations whose primary business is aviation maintenance, repair, overhaul (MRO), or continuing airworthiness management services. This includes independent repair stations, airline maintenance departments, engine/avionics shops, component overhaul facilities, and OEMs with autonomous MRO operations. Certification is often contractually required by OEMs, airlines, and regulators for OASIS listing and supply-chain access, regardless of organization size.

Does AS9110C require an external audit or third-party certification?

Yes, AS9110C requires third-party certification through accredited bodies listed in the IAQG OASIS database. Organizations must demonstrate full QMS operational maturity (minimum 3 months, including internal audits and management review) before Stage 1 (documentation) and Stage 2 (on-site effectiveness) audits. Surveillance audits occur annually, with recertification every 3 years.

How often should an assessment for AS9110C be performed?

Internal audits for AS9110C must be performed at planned intervals based on process risk, status, and importance, with full cycles completed before certification. Critical processes like configuration management and maintenance release require higher frequency. Management reviews occur regularly (e.g., semi-annually), using performance data from monitoring (Clause 9.1).

What are the consequences of non-compliance with AS9110C?

Non-compliance with AS9110C risks loss of repair station approvals, contract termination, regulatory sanctions, and safety incidents. It can lead to exclusion from OEM contracts/OASIS, fines under aviation regulations (e.g., FAA/EASA Part 145), litigation from airworthiness failures, rework costs, and reputational damage in the global supply chain.

Can AS9110C be mapped to other international frameworks?

Yes, AS9110C aligns directly with ISO 9001:2015 via its Annex SL high-level structure and shares common elements with AS9100 (manufacturing) and AS9120 (distribution). IAQG correlation matrices facilitate mapping, enabling integrated management systems while retaining maintenance-specific controls like counterfeit prevention and release-to-service.

What is the first step to begin implementing AS9110C?

The first step is to define the QMS scope, perform a gap analysis against Clauses 4–10, and map regulatory/customer requirements. Secure executive sponsorship, identify interested parties (e.g., FAA/EASA), and produce a prioritized remediation plan using risk-based tools like worksheets for Clause 6.1 risks.

Standards Comparison

ISO 37001 vs AS9110C

ISO 37001

Voluntary

2025

International standard for anti-bribery management systems

AS9110C

Mandatory

2016

International QMS standard for aviation maintenance organizations.

Quick Verdict

ISO 37001 provides anti-bribery management systems for all organizations worldwide, mitigating corruption risks through due diligence and controls. AS9110C delivers quality management for aviation MROs, ensuring airworthiness via traceability and safety. Companies adopt them for compliance, risk reduction, and market access.

Anti-Bribery/Compliance

ISO 37001

ISO 37001: Anti-bribery management systems

Cost

€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Risk-based anti-bribery management system framework
Mandatory third-party due diligence and monitoring
Leadership commitment and compliance function requirements
PDCA cycle for continual improvement and audits
Internationally certifiable with evidentiary legal mitigation

Quality Management

AS9110C

AS9110C: Quality Management Systems for Aviation Maintenance Organizations

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Configuration management and traceability controls
Counterfeit and suspect parts prevention
Risk-based operational planning and execution
Human factors in root cause analysis
Dedicated aviation safety policy requirements

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

ISO 37001 Details

What It Is

ISO 37001: Anti-bribery management systems is an international certifiable standard providing requirements for establishing, implementing, and maintaining an Anti-Bribery Management System (ABMS). It uses a risk-based PDCA (Plan-Do-Check-Act) approach to prevent, detect, and respond to bribery risks across organizations, covering direct/indirect bribery by personnel and business associates.

Key Components

Core clauses 4-10: context, leadership, planning, support, operation, evaluation, improvement.
Key controls: policy, risk assessment, due diligence, financial/non-financial controls, training, reporting.
Built on ISO Harmonized Structure for integration with standards like ISO 9001.
Optional third-party certification with audits.

Why Organizations Use It

Mitigates legal risks (e.g., FCPA, UK Bribery Act) via evidentiary due diligence.
Enhances reputation, stakeholder trust, ESG alignment.
Drives efficiencies (up to 15% compliance cost reduction), operational controls.
Competitive edge in tenders, high-risk sectors.

Implementation Overview

Phased: gap analysis, risk assessment, controls, training, audits.
Scalable for all sizes/sectors; 6-12 months typical.
Certification via accredited bodies with surveillance audits.

AS9110C Details

What It Is

AS9110C (AS9110:2016 Rev C), officially Quality Management Systems Requirements for Aviation Maintenance Organizations, is an international certification standard. It builds on ISO 9001:2015's Annex SL structure, tailoring QMS for maintenance, repair, and overhaul (MRO) providers. Primary purpose: ensure safe, compliant aviation services via risk-based thinking, PDCA, and aviation-specific controls.

Key Components

10 clauses covering context, leadership, planning, support, operation, evaluation, improvement.
Distinctive additions: configuration management, counterfeit parts prevention, human factors, traceability, preservation, product safety.
~300 requirements; certification through accredited bodies, listed in IAQG OASIS.

Why Organizations Use It

Contractual mandates from OEMs/airlines; regulatory alignment (FAA/EASA Part 145).
Mitigates safety risks, improves on-time delivery, reduces rework.
Enhances market access, customer trust, operational resilience.

Implementation Overview

Phased: gap analysis, process design, training, pilots, audits (6-12 months typical).
Applies to MROs globally; requires operational QMS evidence before Stage 2 certification audit.

Key Differences

Aspect	ISO 37001	AS9110C
Scope	Anti-bribery management systems only	Aerospace maintenance quality management
Industry	All sectors worldwide, any size	Aviation MRO organizations globally
Nature	Voluntary certifiable management standard	Voluntary aerospace QMS certification
Testing	Third-party certification audits, surveillance	Stage 1/2 audits, annual surveillance
Penalties	No legal penalties, certification loss	No legal penalties, certification loss

Scope

ISO 37001

Anti-bribery management systems only

AS9110C

Aerospace maintenance quality management

Industry

ISO 37001

All sectors worldwide, any size

AS9110C

Aviation MRO organizations globally

Nature

ISO 37001

Voluntary certifiable management standard

AS9110C

Voluntary aerospace QMS certification

Testing

ISO 37001

Third-party certification audits, surveillance

AS9110C

Stage 1/2 audits, annual surveillance

Penalties

ISO 37001

No legal penalties, certification loss

AS9110C

No legal penalties, certification loss

Frequently Asked Questions

Common questions about ISO 37001 and AS9110C

ISO 37001 FAQ

AS9110C FAQ

You Might also be Interested in These Articles...

Proving CIS Controls v8.1 Works: A KPI & Evidence Framework for Board Reporting, Audits, and Continuous Assurance

Prove CIS Controls v8.1 effectiveness with KPI catalog, evidence checklist & reporting cadence. Ideal for board reports, audits & cyber-insurance. Measure outco

The Service-Oriented SOC: Leveraging Maturity Assessments to Guarantee SLOs and Operational Predictability

Transform your SOC into a service provider using maturity assessments to standardize workflows, guarantee SLOs, and ensure predictability amid turnover and risi

Your Compliance Command Center: How Modern Tools Orchestrate Cross-Departmental Adherence

Unlock your compliance command center with modern tools for real-time monitoring, automation & integrations across IT, HR, Legal & Finance. Slash non-compliance

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how ISO 37001 and AS9110C compare against other standards

Other ISO 37001 Comparisons

Other AS9110C Comparisons

Quick Verdict

What It Is

Key Components

Core clauses 4-10: context, leadership, planning, support, operation, evaluation, improvement.

Key controls: policy, risk assessment, due diligence, financial/non-financial controls, training, reporting.

Built on ISO Harmonized Structure for integration with standards like ISO 9001.

Optional third-party certification with audits.

What It Is

Key Components

10 clauses covering context, leadership, planning, support, operation, evaluation, improvement.

Distinctive additions: configuration management, counterfeit parts prevention, human factors, traceability, preservation, product safety.

~300 requirements; certification through accredited bodies, listed in IAQG OASIS.

Aspect

ISO 37001

AS9110C

Scope

Anti-bribery management systems only

Aerospace maintenance quality management

Industry

All sectors worldwide, any size

Aviation MRO organizations globally

Nature

Voluntary certifiable management standard

Voluntary aerospace QMS certification

Testing

Third-party certification audits, surveillance

Stage 1/2 audits, annual surveillance

Penalties

No legal penalties, certification loss