What is the primary objective of ISO 37001?

ISO 37001 establishes requirements for an Anti-Bribery Management System (ABMS) to prevent, detect, and respond to bribery. It follows the PDCA cycle across Clauses 4–10, requiring proportionate controls like risk assessment, due diligence, financial controls, training, and continual improvement. Applicable to all organization types and sizes, it covers direct/indirect bribery by personnel and business associates but does not guarantee bribery elimination.

Who is legally or professionally required to comply with ISO 37001?

ISO 37001 is voluntary with no universal legal mandate but is professionally essential for high-bribery-risk organizations. It applies to public, private, and not-for-profit entities of any size, particularly multinationals, extractives, construction, and public-sector interactors. Certification demonstrates "reasonable steps" to regulators like FCPA/UK Bribery Act enforcers, with 95% of cases involving third parties.

Does ISO 37001 require an external audit or third-party certification?

ISO 37001 certification requires accredited third-party audits but is optional. Stage 1 reviews documentation; Stage 2 verifies effectiveness. Certificates last 3 years with annual surveillance audits every 12–24 months. Certification amplifies evidentiary value, potentially reducing liability, though internal audits suffice for non-certified ABMS.

How often should an assessment for ISO 37001 be performed?

Bribery risk assessments under ISO 37001 must be performed periodically and when significant changes occur. Clause 4.5 mandates ongoing reviews, with 99% of firms assessing third parties at onboarding and 56% conducting independent periodic checks. Internal audits occur at planned intervals, feeding annual management reviews and PDCA cycles.

What are the consequences of non-compliance with ISO 37001?

Non-conformance with ISO 37001 leads to audit findings, certification denial/revocation, and heightened bribery liability. No absolute legal shield exists, but absent ABMS, organizations face full fines (e.g., up to 15% higher compliance costs), reputational damage, and lost contracts. Mature ABMS can cut costs by 15% and boost engagement 3–5pp.

An ISO 37001 be mapped to other international frameworks?

Yes, ISO 37001 aligns with the Harmonized Structure (HS) for seamless integration with ISO management systems. Its PDCA architecture maps to standards sharing HS/HLS, enabling unified audits, documentation, and reviews. Clause sequencing supports combined risk assessments and controls without duplication.

What is the first step to begin implementing ISO 37001?

The first step is determining organizational context and scope per Clause 4. Identify internal/external issues, interested parties (e.g., regulators, third parties), and bribery risks to define ABMS boundaries. This risk-based foundation informs leadership commitment (Clause 5) and planning (Clause 6), followed by gap analysis.

What is the primary objective of ISO 13485?

ISO 13485:2016 specifies requirements for a quality management system (QMS) where organizations demonstrate ability to consistently provide medical devices and related services that meet customer and applicable regulatory requirements. This standard, structured across Clauses 4–8, emphasizes documented processes, risk-based controls, validation, traceability, and post-market surveillance for device lifecycle stages including design, production, distribution, installation, servicing, and disposal. It ensures QMS effectiveness through objective evidence of established, implemented, and maintained procedures.

Who is legally or professionally required to comply with ISO 13485?

ISO 13485 applies to organizations involved in one or more stages of the medical device lifecycle, including manufacturers, contract manufacturers, suppliers, importers, distributors, and service providers. Target entities encompass those handling design/development, production, storage/distribution, installation, servicing, or associated activities like sterilization and calibration. Organizations must identify their regulatory roles (e.g., manufacturer under EU MDR) and incorporate applicable regulatory requirements into the QMS, with no specific employee or revenue thresholds but scope tailored to activities and justified exclusions.

Does ISO 13485 require an external audit or third-party certification?

ISO 13485 certification is voluntary but typically involves external audits by accredited certification bodies following a two-stage process: Stage 1 (documentation review) and Stage 2 (implementation verification). Ongoing surveillance audits occur annually, with recertification every three years. While the standard mandates internal audits (Clause 8.2.4), third-party certification provides market-recognized evidence of conformity, often required for regulatory submissions or supplier qualification.

How often should an assessment for ISO 13485 be performed?

Internal audits for ISO 13485 must be conducted at planned intervals per Clause 8.2.4, with management reviews at planned intervals per Clause 5.6. Frequency is risk-based: typically annually for surveillance audits by certification bodies, with internal audits scheduled by process risk. Management reviews incorporate inputs like audits, complaints, CAPA, and regulatory changes, ensuring continual QMS effectiveness assessment.

What are the consequences of non-compliance with ISO 13485?

Non-compliance with ISO 13485 risks certification denial/suspension, regulatory enforcement, product holds, recalls, fines, and market access barriers. Weaknesses in documentation, validation, CAPA, or post-market surveillance trigger audit nonconformities, FDA Form 483 observations, or EU Notified Body actions. Record retention failures (minimum device lifetime or two years post-release) undermine traceability, escalating liability for device safety issues.

Can ISO 13485 be mapped to other international frameworks?

ISO 13485 provides Annex B correspondence to ISO 9001:2015 but excludes certain elements, functioning as a stand-alone standard. It aligns with regulatory frameworks like EU MDR/IVDR QMS expectations and the FDA QMSR (effective February 2, 2026, incorporating ISO 13485 into 21 CFR Part 820). Complementary standards include ISO 14971 (risk), IEC 62366-1 (usability), and ISO 11607 (packaging), enabling integrated implementation without claiming dual conformity.

What is the first step to begin implementing ISO 13485?

The first step is establishing QMS scope per Clause 4.1, documenting processes, interactions, risk-based controls, and justifications for exclusions (e.g., Clause 7 design for contract manufacturers). Identify regulatory roles, applicable requirements, and outsourced processes requiring quality agreements, forming the foundation for documentation, medical device files, and lifecycle controls.

Standards Comparison

ISO 37001 vs ISO 13485

ISO 37001

Voluntary

2025

International standard for anti-bribery management systems

ISO 13485

Mandatory

2016

International standard for medical device quality management systems.

Quick Verdict

ISO 37001 provides anti-bribery management for all organizations worldwide, mitigating corruption risks through due diligence. ISO 13485 mandates quality systems for medical devices, ensuring safety via lifecycle controls. Companies adopt them for compliance, risk reduction, and market access.

Anti-Bribery/Compliance

ISO 37001

ISO 37001:2016 Anti-Bribery Management Systems

Cost

€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Risk-based anti-bribery controls proportionate to exposure
Comprehensive third-party due diligence and monitoring
Leadership commitment with dedicated compliance function
PDCA cycle for continual improvement and audits
Globally recognized certifiable management system standard

Quality Management

ISO 13485

ISO 13485:2016 Medical devices Quality management systems

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Risk-based controls throughout device lifecycle
Design and development validation requirements
Post-market surveillance and complaint handling
Supplier evaluation and outsourcing controls
Traceability and record retention for devices

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

ISO 37001 Details

What It Is

ISO 37001:2016 is an international certifiable standard for Anti-Bribery Management Systems (ABMS). It provides requirements to prevent, detect, and respond to bribery risks across organizations of any size or sector. The risk-based approach follows the ISO Harmonized Structure and PDCA cycle, focusing on bribery (direct/indirect, giving/receiving) via leadership, controls, and evaluation.

Key Components

Clauses 4-10 cover context, leadership, planning, support, operations, evaluation, improvement.
Core elements: anti-bribery policy, risk assessments, due diligence, financial/non-financial controls, training, reporting, audits.
Built on proportionality; certifiable with third-party audits (3-year cycle, surveillance).

Why Organizations Use It

Mitigates legal risks (FCPA, UK Bribery Act), reduces liability via "reasonable steps" evidence.
Builds trust, enables market access, cuts compliance costs (up to 15%).
Enhances reputation, ESG alignment, operational efficiency.

Implementation Overview

Phased: gap analysis, risk assessment, controls design, training, audits.
Scalable for SMEs/multinationals; 6-12 months typical; optional certification.

ISO 13485 Details

What It Is

ISO 13485:2016 is the international standard titled Medical devices — Quality management systems — Requirements for regulatory purposes. It provides a certifiable framework for organizations in the medical device lifecycle, emphasizing risk-based controls to ensure devices meet customer and regulatory requirements consistently.

Key Components

Organized into Clauses 4–8 covering QMS, management responsibility, resources, product realization, and measurement/improvement.
Requires documented processes, medical device files, validation, traceability, and post-market surveillance.
Built on process approach with regulatory integration; certification via accredited bodies.

Why Organizations Use It

Enables market access (EU MDR, FDA QMSR alignment effective 2026).
Mitigates risks like recalls and liabilities.
Builds stakeholder trust and supply chain assurance.
Drives operational efficiency and scalability.

Implementation Overview

Phased approach: gap analysis, documentation, training, validation, audits.
Applies to manufacturers, suppliers, distributors globally.
Involves certification audits (Stage 1/2, surveillance).

Key Differences

Aspect	ISO 37001	ISO 13485
Scope	Anti-bribery management systems only	Medical device quality management lifecycle
Industry	All sectors, global applicability	Medical devices and related services
Nature	Voluntary certifiable management standard	Regulatory-purpose QMS standard
Testing	Third-party certification audits, surveillance	Internal audits, process validation, calibration
Penalties	Certification loss, no direct legal penalties	Regulatory enforcement, market access denial

Scope

ISO 37001

Anti-bribery management systems only

ISO 13485

Medical device quality management lifecycle

Industry

ISO 37001

All sectors, global applicability

ISO 13485

Medical devices and related services

Nature

ISO 37001

Voluntary certifiable management standard

ISO 13485

Regulatory-purpose QMS standard

Testing

ISO 37001

Third-party certification audits, surveillance

ISO 13485

Internal audits, process validation, calibration

Penalties

ISO 37001

Certification loss, no direct legal penalties

ISO 13485

Regulatory enforcement, market access denial

Frequently Asked Questions

Common questions about ISO 37001 and ISO 13485

ISO 37001 FAQ

ISO 13485 FAQ

You Might also be Interested in These Articles...

Beyond the Burden: How Intuitive Compliance Software Transforms Daily Workflows

Explore intuitive compliance software that automates workflows, simplifies onboarding, and reduces stress. Cut non-compliance costs 3x and boost efficiency for

Thailand PDPA Implementation Guide: Subordinate Regulations for 72-Hour Breach Reporting and Cross-Border Transfers (2022-2024 Rules)

Step-by-step Thailand PDPA guide: 72-hour breach notifications, cross-border transfers (2022-2024 rules). Risk checklists, GDPR templates avoid THB 5M fines. Mu

DORA Third-Party Risk Management: A Consultant’s Guide to Mapping Critical ICT Service Providers in 2026

Navigate DORA's complex third-party risk pillar. Step-by-step consultant guide to identify critical ICT providers, remediate Article 30 contracts, and build the

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how ISO 37001 and ISO 13485 compare against other standards

Other ISO 37001 Comparisons

Other ISO 13485 Comparisons

What It Is

Key Components

Clauses 4-10 cover context, leadership, planning, support, operations, evaluation, improvement.

Core elements: anti-bribery policy, risk assessments, due diligence, financial/non-financial controls, training, reporting, audits.

Built on proportionality; certifiable with third-party audits (3-year cycle, surveillance).

What It Is

Key Components

Organized into Clauses 4–8 covering QMS, management responsibility, resources, product realization, and measurement/improvement.

Requires documented processes, medical device files, validation, traceability, and post-market surveillance.

Built on process approach with regulatory integration; certification via accredited bodies.

Aspect

ISO 37001

ISO 13485

Scope

Anti-bribery management systems only

Medical device quality management lifecycle

Industry

All sectors, global applicability

Medical devices and related services

Nature

Voluntary certifiable management standard

Regulatory-purpose QMS standard

Testing

Third-party certification audits, surveillance

Internal audits, process validation, calibration

Penalties

Certification loss, no direct legal penalties

Regulatory enforcement, market access denial