What is the primary objective of ISO 37001?

ISO 37001 specifies requirements for establishing, implementing, maintaining, and improving an Anti-Bribery Management System (ABMS) to prevent, detect, and respond to bribery. It applies to organizations of any size or sector, covering direct/indirect bribery by personnel and business associates, while ensuring compliance with anti-bribery laws and voluntary commitments. The standard follows the PDCA cycle across Clauses 4–10, emphasizing proportionate, risk-based controls without guaranteeing bribery elimination.

Who is legally or professionally required to comply with ISO 37001?

ISO 37001 is voluntary and applicable to any public, private, or not-for-profit organization regardless of size, type, or sector. No legal mandates exist, but it is professionally required for high-risk entities like multinationals in extractives, construction, or public procurement facing FCPA/UK Bribery Act exposure, or those seeking certification for tenders and investor ESG demands.

Does ISO 37001 require an external audit or third-party certification?

ISO 37001 certification is optional but involves external audits by accredited bodies via Stage 1 (documentation) and Stage 2 (effectiveness) assessments. Certification is valid for three years, with annual surveillance audits (every 12 months) and recertification. Internal audits are mandatory under Clause 9.2, but third-party certification amplifies evidentiary value in investigations.

How often should an assessment for ISO 37001 be performed?

Bribery risk assessments under ISO 37001 Clause 4.5 and 6.1 must be performed periodically and whenever significant changes occur, such as new markets or M&A. Internal audits occur at planned intervals (Clause 9.2), management reviews at least annually (Clause 9.3), and surveillance audits annually post-certification. Mature programs reassess third-party risks at onboarding (99% adoption), renewal, and periodically (56% of firms).

What are the consequences of non-compliance with ISO 37001?

Non-conformance with ISO 37001 leads to audit findings, corrective actions, or certification suspension/revocation. It offers no legal immunity but demonstrates "reasonable steps," potentially reducing liability in jurisdictions recognizing ABMS evidence. Operationally, weak ABMS exposes organizations to fines, debarment, and reputational damage from bribery incidents, where 95% involve third parties.

Can ISO 37001 be mapped to other international frameworks?

Yes, ISO 37001 aligns with the Harmonized Structure (HS) for seamless integration with ISO management systems like quality or information security standards. Its PDCA architecture (Clauses 4–10) maps to broader risk frameworks, enabling unified audits, documentation, and reviews while focusing solely on bribery.

What is the first step to begin implementing ISO 37001?

The first step is determining organizational context, scope, and bribery risks under Clause 4, including internal/external issues and interested parties. Conduct a gap analysis against Clauses 4–10, secure leadership commitment (Clause 5), and appoint an anti-bribery compliance function to drive the PDCA-based ABMS design.

What is the primary objective of ISO 28000?

ISO 28000 specifies requirements for establishing, implementing, maintaining, and continually improving a security management system (SMS) with explicit relevance to supply chain security. It operationalizes security risks—including malicious acts, functional failures, and disruptions—through a Plan-Do-Check-Act (PDCA) cycle across Clauses 4–10. The standard requires understanding organizational context, interested parties, and supply chain interdependencies; top management leadership; risk assessment aligned with ISO 31000; operational controls; performance evaluation via monitoring, internal audits, and management reviews; and continual improvement.

Who is legally or professionally required to comply with ISO 28000?

ISO 28000 is voluntary and not legally mandatory but is professionally required for organizations influencing supply chain security to demonstrate due diligence. Applicable to all organization types and sizes—commercial enterprises, government agencies, non-profits—it targets logistics providers, manufacturers, retailers, ports, and warehouses handling goods transport, storage, or related activities. Compliance is driven by customer/partner requirements, insurance demands, trade facilitation programs, or contractual flow-down obligations in high-risk sectors.

Does ISO 28000 require an external audit or third-party certification?

ISO 28000 requires internal audits at planned intervals but supports optional third-party certification via external auditing. Conformity may be verified internally or externally; certification follows ISO/IEC 17021-1 guidelines for certification bodies, typically involving Stage 1 (design review) and Stage 2 (implementation) audits, plus surveillance. Internal audits (Clause 9.2) must be risk-based, objective, and ensure SMS effectiveness before pursuing external validation.

How often should an assessment for ISO 28000 be performed?

Risk assessments under ISO 28000 must be maintained as an ongoing process, with internal audits conducted at planned intervals per a risk-based program (Clause 9.2). Frequency considers process importance, prior results, and changes; management reviews occur at planned intervals (Clause 9.3). Security risk treatment (Clause 8.3) and continual improvement (Clause 10) demand regular updates, typically annually or upon significant context changes like new suppliers or threats.

What are the consequences of non-compliance with ISO 28000?

Non-compliance with ISO 28000 risks operational disruptions, financial losses, and loss of market access rather than direct legal penalties, as it is voluntary. Consequences include supply chain incidents (theft, sabotage), failure to meet contractual obligations, higher insurance premiums, exclusion from tenders, and reputational damage. Without SMS discipline, organizations face unaddressed vulnerabilities in externally provided processes and inadequate response to security events.

An ISO 28000 be mapped to other international frameworks?

Yes, ISO 28000 aligns with ISO management system standards via its Annex SL structure and PDCA cycle, enabling integrated audits. Clause structure matches ISO 9001, ISO 14001, ISO/IEC 27001, ISO 45001, and ISO 22301; risk processes follow ISO 31000; security plans enhance business continuity. This supports combined governance without duplication, though tailoring to supply chain specifics is required.

What is the first step to begin implementing ISO 28000?

The first step is determining the SMS scope, context of the organization, and interested party requirements (Clause 4). Map internal/external issues, supply chain boundaries, legal obligations, and externally provided processes; document as evidenced information. This foundation informs leadership policy (Clause 5) and risk planning (Clause 6), ensuring tailored, proportionate implementation.

Standards Comparison

ISO 37001 vs ISO 28000

ISO 37001

Voluntary

2025

International standard for anti-bribery management systems

ISO 28000

Voluntary

2022

International standard for supply chain security management systems

Quick Verdict

ISO 37001 provides anti-bribery management systems for all organizations worldwide, mitigating corruption risks through due diligence and controls. ISO 28000 establishes supply chain security frameworks for logistics-heavy sectors, enhancing resilience against theft and disruptions. Companies adopt them for compliance, risk reduction, and certification credibility.

Anti-Bribery/Compliance

ISO 37001

ISO 37001 Anti-Bribery Management Systems

Cost

€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Risk-based bribery risk assessment and controls
Third-party due diligence and monitoring requirements
Leadership commitment and anti-bribery policy mandates
PDCA cycle for continual improvement
Internationally certifiable management system standard

Supply Chain Security

ISO 28000

ISO 28000 Security management systems — Requirements

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Risk-based supply chain security assessment and treatment
PDCA cycle for continual SMS improvement
Controls for external providers and processes
Integration with ISO 31000 and 22301 standards
Documented security plans and incident response

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

ISO 37001 Details

What It Is

ISO 37001 is an international certifiable standard for Anti-Bribery Management Systems (ABMS). It provides requirements and guidance to prevent, detect, and respond to bribery risks. Scope covers direct/indirect bribery by/for organizations, personnel, and associates across sectors/sizes. Employs a risk-based, proportionate approach via PDCA (Plan-Do-Check-Act) harmonized structure.

Key Components

Clauses 4-10: context, leadership, planning, support, operation, evaluation, improvement.
Core controls: policy, risk assessment, due diligence, financial/non-financial controls, training, reporting/investigations.
Built on ISO Harmonized Structure for integration (e.g., ISO 9001).
Optional third-party certification with audits.

Why Organizations Use It

Mitigates legal risks (FCPA, UK Bribery Act), reduces liability via "reasonable steps" evidence. Drives efficiencies (15% compliance cost cuts), builds trust, enhances reputation/ESG. Addresses 95% third-party bribery cases.

Implementation Overview

Phased: gap analysis, risk assessment, controls/training, audits. Scalable for SMEs/multinationals; 6-12 months typical. Certification involves Stage 1/2 audits, annual surveillance.

ISO 28000 Details

What It Is

ISO 28000 is an international standard specifying requirements for security management systems (SMS) focused on supply chain security. It adopts a risk-based, PDCA (Plan-Do-Check-Act) approach to manage threats like theft, sabotage, and disruptions.

Key Components

Clauses 4-10 cover context, leadership, planning, support, operation, evaluation, and improvement.
Emphasizes risk assessment (aligned with ISO 31000), operational controls, and security plans.
Built on harmonized ISO structure for integration; supports third-party certification per ISO/IEC 17021-1.

Why Organizations Use It

Reduces supply chain risks and incidents.
Meets contractual, regulatory, and insurance needs.
Enhances resilience, market access, and partner trust.
Provides governance for compliance and continuity.

Implementation Overview

Phased: gap analysis, risk assessment, controls, audits.
Applicable to all sizes/industries; tailored proportionality.
Involves training, supplier controls, internal audits, management reviews; optional certification via Stage 1/2 audits.

Key Differences

Aspect	ISO 37001	ISO 28000
Scope	Anti-bribery management systems	Supply chain security management
Industry	All sectors worldwide	Logistics, manufacturing, transport
Nature	Voluntary certifiable standard	Voluntary certifiable standard
Testing	Internal audits, certification audits	Internal audits, certification audits
Penalties	No legal penalties, certification loss	No legal penalties, certification loss

Scope

ISO 37001

Anti-bribery management systems

ISO 28000

Supply chain security management

Industry

ISO 37001

All sectors worldwide

ISO 28000

Logistics, manufacturing, transport

Nature

ISO 37001

Voluntary certifiable standard

ISO 28000

Voluntary certifiable standard

Testing

ISO 37001

Internal audits, certification audits

ISO 28000

Internal audits, certification audits

Penalties

ISO 37001

No legal penalties, certification loss

ISO 28000

No legal penalties, certification loss

Frequently Asked Questions

Common questions about ISO 37001 and ISO 28000

ISO 37001 FAQ

ISO 28000 FAQ

You Might also be Interested in These Articles...

Beyond the Boardroom: 5 Ways Modern Compliance Software Elevates Every Department

Discover 5 ways modern compliance software boosts HR, IT, finance & more: automate risks, enhance efficiency, ensure data integrity, stay audit-ready. Elevate y

Decoding Tomorrow's Regulations: How Advanced Compliance Tools Predict and Prepare for Future Shifts

Advanced compliance tools use AI, analytics & real-time monitoring to predict regulatory shifts, cut non-compliance costs 3x, and ensure audit readiness. Stay p

Asset-Backed Issuers and SEC Cybersecurity Rules: Applicability, Disclosures, and Compliance Roadmap

How SEC cybersecurity rules apply to asset-backed issuers (ABS): Form 10-D disclosures, ABS-EE risk management, Inline XBRL tagging, exemptions. Roadmap for tru

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how ISO 37001 and ISO 28000 compare against other standards

Other ISO 37001 Comparisons

Other ISO 28000 Comparisons

Quick Verdict

What It Is

Key Components

Clauses 4-10: context, leadership, planning, support, operation, evaluation, improvement.

Core controls: policy, risk assessment, due diligence, financial/non-financial controls, training, reporting/investigations.

Built on ISO Harmonized Structure for integration (e.g., ISO 9001).

Optional third-party certification with audits.

Key Components

Clauses 4-10 cover context, leadership, planning, support, operation, evaluation, and improvement.

Emphasizes risk assessment (aligned with ISO 31000), operational controls, and security plans.

Built on harmonized ISO structure for integration; supports third-party certification per ISO/IEC 17021-1.

Aspect

ISO 37001

ISO 28000

Scope

Anti-bribery management systems

Supply chain security management

Industry

All sectors worldwide

Logistics, manufacturing, transport

Nature

Voluntary certifiable standard

Testing

Internal audits, certification audits

Penalties

No legal penalties, certification loss