What is the primary objective of ISO 37001?

ISO 37001 specifies requirements for establishing, implementing, maintaining, and improving an Anti-Bribery Management System (ABMS) to prevent, detect, and respond to bribery. It enables organizations to demonstrate reasonable, proportionate measures aligned with anti-bribery laws and voluntary commitments, following the PDCA cycle across Clauses 4–10. Certification provides auditable evidence of effectiveness, though it does not guarantee bribery will never occur.

Who is legally or professionally required to comply with ISO 37001?

ISO 37001 applies voluntarily to any organization—public, private, or not-for-profit—regardless of size, type, or sector. It is not legally mandatory but is professionally essential for high-risk entities like multinationals in extractives, construction, or public procurement, where regulators (e.g., under FCPA or UK Bribery Act) expect demonstrable ABMS controls. Third-party due diligence covers 95% of bribery cases.

Does ISO 37001 require an external audit or third-party certification?

ISO 37001 certification is optional but involves accredited third-party audits in two stages: Stage 1 (documentation review) and Stage 2 (effectiveness verification). Certificates are issued for 3 years, with annual surveillance audits. Internal audits are mandatory under Clause 9.2, but external certification amplifies evidentiary value for liability mitigation.

How often should an assessment for ISO 37001 be performed?

Bribery risk assessments under ISO 37001 Clause 4.5 must be conducted initially, then periodically and when significant changes occur, such as new markets or M&A. Mature programs perform onboarding due diligence (99% of firms), periodic reviews (56% independent of contracts), and internal audits at planned intervals per Clause 9.2, feeding annual management reviews (Clause 9.3).

What are the consequences of non-compliance with ISO 37001?

Non-conformance with ISO 37001 leads to audit nonconformities, potential certification denial or withdrawal, and heightened bribery liability exposure. It offers no absolute legal immunity but certification may reduce penalties as evidence of "reasonable steps." Broader risks include fines, debarment, reputational damage, and up to 15% higher compliance costs without structured ABMS controls.

Can ISO 37001 be mapped to other international frameworks?

Yes, ISO 37001 aligns with the ISO Harmonized Structure (HS), enabling seamless integration with standards like ISO 9001, ISO 14001, and ISO/IEC 27001. Its PDCA architecture (Clauses 4–10) supports combined management systems, reducing duplication in audits, reviews, and documentation while addressing bribery within broader governance, risk, and compliance programs.

What is the first step to begin implementing ISO 37001?

The first step is determining organizational context and scope (Clause 4), including bribery risk assessment (Clause 4.5). Secure leadership commitment (Clause 5), appoint an anti-bribery compliance function, and conduct a gap analysis against Clauses 4–10 to produce a risk-based implementation plan.

What is the primary objective of ISO 37301?

ISO 37301:2021 specifies requirements for establishing, implementing, maintaining, and improving an effective Compliance Management System (CMS). Published on 13 April 2021, it replaces the guidance-only ISO 19600 by introducing certifiable 'shall' requirements, following the High-Level Structure (HLS) and Plan-Do-Check-Act (PDCA) cycle to systematically identify compliance obligations, assess risks, and foster a culture of integrity.

Who is legally or professionally required to comply with ISO 37301?

No organizations are legally required to comply with ISO 37301, as it is a voluntary certifiable standard applicable to all sizes and sectors. It is professionally adopted by entities seeking third-party assurance, such as large corporates like Kingspan with multi-site certifications, to demonstrate systematic management of legal, regulatory, contractual, and voluntary compliance obligations.

Does ISO 37301 require an external audit or third-party certification?

ISO 37301 enables but does not require external audits or third-party certification. Certification is issued by accredited bodies (e.g., ANAB-accredited), involving initial conformity assessment and surveillance audits in a typical three-year cycle, providing verifiable evidence of CMS effectiveness to stakeholders.

How often should an assessment for ISO 37301 be performed?

ISO 37301 requires continual performance evaluation through monitoring, measurement, internal audits at planned intervals, and management reviews. Internal audits are risk-based (frequent for high-risk areas); external surveillance audits occur annually within a three-year certification cycle; continual improvement addresses nonconformities via root-cause analysis.

What are the consequences of non-compliance with ISO 37301?

Non-compliance with ISO 37301 results in loss of certification, reputational damage, and potential regulatory fines from unmet obligations, but no direct penalties from the standard itself. Certification withdrawal follows failed audits; poor CMS exposes organizations to legal breaches, litigation, and stakeholder distrust, as it lacks mandatory enforcement.

Can ISO 37301 be mapped to other international frameworks?

Yes, ISO 37301 follows the High-Level Structure (HLS), enabling seamless mapping and integration with other ISO management system standards. It aligns with ISO 37302 (effectiveness), ISO 37303 (competence), and ISO 37002 (whistleblowing), supporting Integrated Management Systems (IMS) for efficient joint audits and holistic risk management.

What is the first step to begin implementing ISO 37301?

The first step is to secure top management commitment and perform contextual analysis per Clause 4. Identify internal/external issues, interested parties' expectations, and define CMS scope, leading to a centralized compliance obligations register and prioritized risk assessment.

Standards Comparison

ISO 37001 vs ISO 37301

ISO 37001

Voluntary

2025

International standard for anti-bribery management systems

ISO 37301

Voluntary

2021

International standard for certifiable compliance management systems

Quick Verdict

ISO 37001 targets anti-bribery management for all organizations, emphasizing due diligence and controls to mitigate corruption risks. ISO 37301 provides broader compliance system requirements. Companies adopt them for certification, risk reduction, and stakeholder trust in ethical governance.

Anti-Bribery/Compliance

ISO 37001

ISO 37001:2016 Anti-Bribery Management Systems

Cost

€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Risk-based anti-bribery management system framework
Third-party due diligence and monitoring requirements
Leadership commitment and compliance function mandate
PDCA cycle for continual improvement and audits
Integrates with ISO Harmonized Structure standards

Compliance Management

ISO 37301

ISO 37301:2021 Compliance management systems requirements

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Certifiable CMS requirements replacing guidance-only ISO 19600
HLS alignment for integration with other ISO standards
Risk-based planning with compliance obligation registers
Mandatory whistleblowing channels and anti-retaliation protections
Leadership commitment fostering compliance culture and continual improvement

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

ISO 37001 Details

What It Is

ISO 37001:2016 is an international certifiable standard for Anti-Bribery Management Systems (ABMS). It provides requirements to prevent, detect, and respond to bribery risks across organizations. Scope covers direct/indirect bribery by/for the organization, personnel, and associates. Employs a risk-based, proportionate approach via PDCA cycle and Harmonized Structure (HS).

Key Components

Clauses 4-10: context, leadership, planning, support, operation, evaluation, improvement.
Core controls: policy, risk assessment, due diligence, financial/non-financial controls, training, reporting/investigations.
Built on leadership accountability, third-party focus, continual improvement.
Optional third-party certification with audits.

Why Organizations Use It

Mitigates legal risks (FCPA, UK Bribery Act), reduces liability via "reasonable steps" evidence. Drives efficiencies (15% compliance cost cuts), boosts reputation/ESG trust, enables market access. Addresses 95% third-party bribery cases.

Implementation Overview

Phased: gap analysis, risk assessment, controls design, training, audits. Scalable for all sizes/sectors; 6-12 months typical. Involves leadership commitment, documentation, internal audits; certification via Stage 1/2 audits.

ISO 37301 Details

What It Is

ISO 37301:2021 – Compliance management systems – Requirements with guidance for use is a certifiable international standard specifying requirements for establishing, implementing, maintaining, and improving a Compliance Management System (CMS). It applies to all organization sizes and sectors, using a risk-based approach and Plan-Do-Check-Act (PDCA) cycle aligned with ISO High-Level Structure (HLS).

Key Components

Core pillars: context analysis, leadership commitment, risk planning, support/resources, operations, performance evaluation, improvement.
Built on HLS for integration with ISO 9001, 14001, 27001.
Emphasizes whistleblowing, culture, competence (ISO 37303), measurement (ISO 37302).
Certifiable via accredited bodies like ANAB.

Why Organizations Use It

Drives regulatory compliance, reduces risks/fines, builds integrity culture.
Meets investor/ESG demands, enhances reputation.
Provides third-party assurance, supports UN SDGs.

Implementation Overview

Phased: initiation, design, implementation, audit, sustain.
Activities: obligation register, training, KPIs, internal audits.
Universal applicability; certification involves 3-year cycles.

Key Differences

Aspect	ISO 37001	ISO 37301
Scope	Bribery prevention, detection, response	All compliance obligations, risks
Industry	All sectors, high-risk like extractives	All sectors, regulated industries
Nature	Certifiable anti-bribery standard	Certifiable compliance system standard
Testing	Annual certification audits, surveillance	Internal audits, management reviews
Penalties	Certification loss, no legal penalties	Certification loss, no legal penalties

Scope

ISO 37001

Bribery prevention, detection, response

ISO 37301

All compliance obligations, risks

Industry

ISO 37001

All sectors, high-risk like extractives

ISO 37301

All sectors, regulated industries

Nature

ISO 37001

Certifiable anti-bribery standard

ISO 37301

Certifiable compliance system standard

Testing

ISO 37001

Annual certification audits, surveillance

ISO 37301

Internal audits, management reviews

Penalties

ISO 37001

Certification loss, no legal penalties

ISO 37301

Certification loss, no legal penalties

Frequently Asked Questions

Common questions about ISO 37001 and ISO 37301

ISO 37001 FAQ

ISO 37301 FAQ

You Might also be Interested in These Articles...

CIS Controls v8.1, Operationalized: Top 10 Reasons Compliance Monitoring Software Accelerates Real-World Implementation

Operationalize CIS Controls v8.1 with compliance monitoring software. Turn checklists into dashboards, tickets, and audit-proof workflows. Top 10 reasons it acc

The NIS2 "FTE Trap": Why 5 Analysts for 24/7 Security is Actually 8 (and Why the Board Needs to Know)

Exposed: NIS2 FTE Trap math shows 5 analysts fail 24/7 coverage due to sickness, training, leave & 2026 churn. Line-by-line breakdown for compliance. Alert your

ISO 27701 Standalone Certification in 2025: Debunking Myths and Navigating the New Reality

Debunk myths on ISO 27701 standalone certification post-2025. Clarify viability, accreditation bodies, ISO 27001 audit differences & procurement benefits. Guide

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how ISO 37001 and ISO 37301 compare against other standards

Other ISO 37001 Comparisons

Other ISO 37301 Comparisons

What It Is

Key Components

Clauses 4-10: context, leadership, planning, support, operation, evaluation, improvement.

Core controls: policy, risk assessment, due diligence, financial/non-financial controls, training, reporting/investigations.

Built on leadership accountability, third-party focus, continual improvement.

Optional third-party certification with audits.

What It Is

Key Components

Core pillars: context analysis, leadership commitment, risk planning, support/resources, operations, performance evaluation, improvement.

Built on HLS for integration with ISO 9001, 14001, 27001.

Emphasizes whistleblowing, culture, competence (ISO 37303), measurement (ISO 37302).

Certifiable via accredited bodies like ANAB.

Aspect

ISO 37001

ISO 37301

Scope

Bribery prevention, detection, response

All compliance obligations, risks

Industry

All sectors, high-risk like extractives

All sectors, regulated industries

Nature

Certifiable anti-bribery standard

Certifiable compliance system standard

Testing

Annual certification audits, surveillance

Internal audits, management reviews

Penalties

Certification loss, no legal penalties