Anti-Bribery (ISO 37001) Certification

ISO 37001 defines management-system requirements for preventing, detecting and addressing bribery. Its scope covers not only the organisation's own personnel but also its business associates, intermediaries and suppliers. The certificate does not show bribery has never occurred, but that reasonable measures to prevent it have been established — this distinction also matters in a legal defence.

• Organisations bidding on public tenders and in contact with public officials
• Exporters working with agents and intermediaries abroad
• Group companies subject to international anti-corruption legislation (FCPA, UK Bribery Act)
• High-risk-profile sectors such as construction, energy, defence and pharmaceuticals

The certificate is not mandatory; complying with anti-bribery legislation is mandatory. In some legal systems, an organisation showing it has 'adequate procedures' in place is taken into account in liability assessment, and ISO 37001 can be used as evidence of these procedures.

• Clause 4 — Context of the organisation: internal and external issues, requirements of interested parties, determining the scope of the anti-bribery management system
• Clause 5 — Leadership: top management commitment, policy, roles and authorities
• Clause 6 — Planning: risks and opportunities, objectives and plans to achieve them
• Clause 7 — Support: resources, competence, awareness, communication, documented information
• Clause 8 — Operation: operational planning and control
• Clause 9 — Performance evaluation: monitoring and measurement, internal audit, management review
• Clause 10 — Improvement: nonconformity, corrective action and continual improvement
• Bribery risk assessment and controls proportionate to the risk profile
• The anti-bribery policy and the independence of the compliance function
• Compliance controls in personnel recruitment, promotion and performance processes
• Due diligence for business associates, intermediaries and suppliers
• Controls on gifts, hospitality, donations and sponsorship
• Facilitation payments and conflict-of-interest management
• Financial and non-financial controls
• Raising concerns (whistleblowing) and protection against retaliation
• Investigating and addressing suspected bribery

1. 1ApplicationThe organisation's field of activity, headcount, number of sites and scope boundaries are determined. The number of audit days is calculated from this information.
2. 2Document Review (Stage 1)The management system documentation, scope definition, risk assessment and internal-audit/management-review records are examined; readiness for the on-site audit is assessed.
3. 3Certification Audit (Stage 2)It is verified on site that the system is implemented and effective. Findings are classified as major/minor nonconformity or observation.
4. 4Closing NonconformitiesThe organisation submits a root-cause analysis and corrective action plan. The certificate is not issued until major nonconformities are closed.
5. 5Issuing the CertificateThe certificate is issued after review by an independent decision-maker. The audit team cannot make the certification decision.
6. 6Surveillance AuditsA surveillance audit is carried out at least once a year during the certificate's validity. The first surveillance cannot exceed 12 months from the last day of Stage 2.
7. 7RecertificationAt the end of three years, the entire system is re-audited; it must be completed before the certificate expires.

Management system certificates are valid for three years. At least one surveillance audit is carried out per year during this period; the certificate is suspended if surveillance is not carried out. A recertification audit is completed at the end of the third year.

• Trade registry record and operating licence
• The organisation's organisation chart and headcount
• The list of sites/branches within scope
• The management system manual or process documentation
• Internal audit and management review records
• Legal permits, licences and operating documents, if any

There is no fixed list price; the cost is calculated based on the following variables and provided in writing in the quote.

• The headcount within scope (directly determines the number of audit days)
• The number of sites and branches; whether multi-site sampling applies
• The activity's risk level and process complexity
• The number of standards to be certified — an integrated audit reduces the number of days
• The three-year cycle: certification + two surveillance audits

Management system certification is carried out within the scope of ISO/IEC 17021-1. The certification body is accredited by an accreditation body party to the IAF multilateral recognition agreement (IAF MLA); This agreement establishes a chain of international recognition that ensures that a document issued in one country is accepted in other countries. EUROLAB has internationally recognized accreditation from IAF member accreditation bodies within the scope of ISO/IEC 17021-1.

The scope under which this scheme can be offered varies according to your product and activity; it is confirmed in writing at the quote stage.

• ISO 37301Compliance Management
• ISO 31000Risk Management
• ISO 37000Corporate Governance
• ISO 37002Whistleblowing Management
• ISO 9001Quality Management System
• ISO 10002Customer Satisfaction and Complaint Management
• ISO 10004Customer Satisfaction Monitoring and Measurement
• ISO 10012Measurement Management System