Changes Introduced by ISO 37001:2025: Strengthened Governance Requirements
Transition exams test whether you can explain what changed in ISO 37001:2025 and why the changes matter in practice. The strongest emphasis is on governance: the 2025 edition makes board-level accountability and oversight more explicit, rather than leaving the ABMS as a compliance-function project.
Strengthened governance expectations
- The governing body and top management both have roles. Top management runs the ABMS; the governing body oversees it, ensures resources and receives performance information. Candidates should not treat the two as interchangeable.
- Governance is demonstrated through anti-bribery culture, tone at the top, clear accountability, and a compliance function with authority, independence and a reporting line to the governing body.
- Management review is more than a meeting: inputs, decisions and actions should show that performance and bribery risk are actually overseen.
- The 2025 edition follows the harmonized structure, so integration with other management systems is expected, but bribery-specific risks and controls must remain visible. It also reflects the climate-change consideration now common across ISO management system standards: the organization determines whether climate change is a relevant issue for the ABMS context.
- Governance extends to how risk assessment, due diligence and reporting channels are resourced and monitored, not just how policy is signed.
Worked example
A board delegates the ABMS entirely to a compliance officer, meets once a year and reviews only the policy. Under the 2025 governance expectations, this is weak. Reasoning: delegation is acceptable, but oversight is not. The governing body should receive regular ABMS performance and bribery-risk reports, ensure the compliance function has access and resources, and act on significant issues. The exam answer should identify the oversight gap, not simply say “the board should be committed”.
Traps that cost marks
- Equating governance with a signed policy.
- Confusing top management with the governing body.
- Assuming 2015 documents need no review against 2025 governance expectations.
- Treating climate change as a direct bribery control rather than a context issue.
- Ignoring evidence of oversight in management review records.