ISO 37001:2025 Anti-Bribery Management System Requirements and Guidance: Foundation Concepts
This domain tests foundation-level understanding of ISO 37001:2025 as an anti-bribery management system (ABMS) standard: what it requires, how its clauses fit the harmonized structure, and how terms such as bribery, business associate and compliance function are applied. Transition questions often ask you to separate auditable requirements from guidance and to choose proportionate, risk-based controls.
Core rules and concepts
- ISO 37001 specifies requirements for an ABMS and provides guidance. Requirements are auditable; guidance explains ways to meet them but does not create extra requirements unless the organization adopts it.
- The standard follows the harmonized structure: context of the organization, leadership, planning, support, operation, performance evaluation and improvement.
- Bribery is defined around a financial or other advantage offered, promised, given, authorized, solicited, agreed to be received or accepted, directly or indirectly, in breach of applicable law. It covers public and private bribery, active and passive sides.
- The ABMS addresses bribery involving the organization, its personnel and business associates. It does not replace legal compliance or cover every integrity risk (for example, pure fraud or theft) unless bribery is involved.
- Controls must be reasonable and proportionate to the bribery risk identified, not copied generically from another organization.
- Leadership includes top management and the governing body; the anti-bribery compliance function and compliance officer need authority, independence and access to the governing body.
Worked example
A logistics firm appoints agents in three countries and has a one-page anti-bribery policy. The exam asks what else the ABMS needs. Reasoning: a policy alone does not satisfy planning and operation. The firm should assess bribery risk by country, agent type and payment route; conduct risk-based due diligence before appointment; set proportionate controls such as commission limits, payment approvals, contract clauses and training; then monitor and review. The answer should link each action to a clause, not list controls randomly.
Traps that cost marks
- Treating all guidance annexes as auditable requirements.
- Defining bribery as only cash to public officials.
- Assuming certification proves that no bribery occurs.
- Designing controls without a documented risk rationale.
- Forgetting that business associates can create bribery risk for the organization.