PECB ISO 37001 Transition cheat sheet

ISO 37001 is a certifiable management system standard for an anti-bribery management system (ABMS); it specifies requirements plus guidance and is usable by organizations of any size, sector, or jurisdiction.

Core logic follows the harmonized management system structure: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement.

Key defined terms: bribery (offering, promising, giving, accepting, or soliciting an undue advantage of any value, directly or indirectly, in violation of applicable law); bribery risk; and public official.

The standard covers bribery in the public, private, and non-profit sectors, and addresses bribery by, for, or against the organization, its personnel, and its business associates.

Bribery risk assessment is a recurring requirement: risks are identified, analyzed, evaluated, and treated, and the assessment is reviewed when significant changes occur.

Due diligence on personnel and business associates is risk-based: the depth of checks is proportionate to the assessed bribery risk, not uniform for everyone.

Anti-bribery policy is set at top level, communicated internally and, where appropriate, to business associates, and supported by controls such as gifts, hospitality, and donations rules.

Certification is against the requirements clauses only; guidance content is informative and cannot itself be audited for conformity.

An ABMS is expected to be integrated into the organization's existing management processes rather than operated as a standalone parallel system.

Leadership requirements are reinforced: top management must demonstrate visible, active commitment to the ABMS, not merely approve the policy and delegate execution.

The governing body (board or equivalent) has explicit obligations to oversee the ABMS, ensure adequate resourcing, and be informed about bribery risk and incidents.

Roles, responsibilities, and authorities for anti-bribery are assigned, documented, and communicated, including who owns the compliance function and its independence.

The revised standard places greater emphasis on anti-bribery culture as an outcome of governance, assessed through behavior, incentives, and reporting willingness.

Performance evaluation is strengthened: monitoring, measurement, internal audit, and management review must explicitly consider bribery risk performance and control effectiveness.

Governance expectations extend to aligning remuneration, promotion, and disciplinary systems so they do not reward or tolerate bribery-related outcomes.

Management review inputs and outputs are more specific about decisions and actions on bribery risk, resourcing, and improvement priorities.

The revision aligns with the harmonized structure used by other ISO management system standards, which affects clause numbering and cross-references.

Top management accountability cannot be delegated away: delegation of tasks is permitted, but responsibility for ABMS effectiveness remains at the top.

Due diligence is risk-based and applies before committing to a relationship: the higher the assessed bribery risk, the deeper and more independent the checks.

Scope covers business associates such as agents, consultants, intermediaries, joint venture partners, suppliers, contractors, and subcontractors, plus personnel in risk-exposed roles.

Due diligence on transactions includes mergers, acquisitions, joint ventures, and investments, with bribery risk assessed before completion and addressed in integration.

Checks typically examine ownership and beneficial ownership, reputation, litigation and enforcement history, sanctions and debarment status, and the business rationale for the relationship.

Red flags include unusual payment routes or offshore accounts, commissions disproportionate to services, reluctance to accept anti-bribery terms, and opaque ownership structures.

Outcomes are documented and drive a decision: proceed, proceed with conditions and controls, or decline; the decision and rationale are retained as information.

Due diligence is not a one-time gate: it is refreshed periodically and when risk-relevant changes occur, such as new ownership, new markets, or adverse media.

Contractual controls complement due diligence, including anti-bribery representations, audit or access rights, and termination rights for breach.

Where due diligence cannot be completed to a sufficient standard, the organization is expected to apply compensating controls or not proceed.

Reporting channels must allow concerns to be raised confidentially and, where permitted by law, anonymously, and must be accessible to personnel and business associates.

Raising a concern in good faith must not result in retaliation; prohibition of retaliation and victimization is an explicit expectation, not an optional courtesy.

Protection covers a broader set of reporters, including employees, contractors, and third parties acting in good faith, even if the concern is later unsubstantiated.

The organization must have a documented process for receiving, assessing, investigating, and closing reports, with records retained as documented information.

Independence matters: those investigating a report should not be implicated in the matter, and the compliance function must be able to escalate to the governing body.

Confidentiality of the reporter's identity is protected to the extent permitted by law and consistent with a fair investigation for the accused.

The organization communicates how to report, what happens after reporting, and the protections available, so channels are actually used.

Retaliation is itself treated as a disciplinary matter, and outcomes of investigations feed into corrective action and management review.

Channel effectiveness is monitored through indicators such as reports received, substantiation rates, and resolution times, rather than assumed from having a policy.