ISO 37001 Anti-Bribery Management Systems Explained

ISO 37001 is the international standard for anti-bribery management systems. For a manufacturer already certified to ISO 9001 or AS9100, it is less of a leap than it looks: the structure is familiar, and much of the machinery is already in place. The real question is whether certification earns its keep for your business, or whether well-run proportionate procedures will do.

Same structure, different risk

ISO 37001 follows the same high-level structure as ISO 9001 and the other ISO management system standards. You will recognise the clauses: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement.

That matters in practice. Your document control, competence and training records, internal audit programme, management review and corrective action process can all carry anti-bribery requirements without a parallel system. AS9100 is built on ISO 9001, so the same applies to aerospace suppliers.

What changes is the risk being managed. A quality system manages the risk that product or service does not meet requirements. An anti-bribery system manages the risk that someone acting for the business offers, gives, requests or accepts a bribe. The controls look different because the failure modes are different.

What ISO 37001 adds

Several requirements have no real equivalent in a quality system.

Bribery risk assessment. You identify where bribery could realistically occur in your business: which markets, which customers, which transactions, which roles and which third parties. The assessment is documented, reviewed periodically and drives everything else. A business selling only to UK private customers will reach a very different answer from one using agents to win work overseas.

Due diligence on business associates. Business associates include agents, distributors, joint venture partners, consultants and some suppliers and subcontractors. The standard expects due diligence proportionate to the risk each one presents, before engaging them and at intervals afterwards. For a low-risk supplier that may be a short questionnaire. For an overseas sales agent paid on commission it means understanding who owns them, what they actually do for the money and whether their fee is reasonable.

Financial controls. These are controls over money leaving the business: separation of duties, approval levels, checks on payments to third parties, scrutiny of commissions and unusual payment routes. Most firms have some of this through their accountants and auditors. The standard asks you to look at it through a bribery lens.

Non-financial controls. These cover the decisions that can be bought: procurement, sales, contract award, approvals. Examples include requiring more than one person to approve a supplier, rotating staff in sensitive roles where that is practical, and controlling who can commit the business to terms.

Gifts, hospitality, donations and similar benefits. Clear rules, approval routes and a register.

An anti-bribery compliance function. One or more people with the authority, independence and access to the board needed to oversee the system. In a smaller firm this is usually a role given to an existing manager rather than a new post, but it must be someone who can raise problems with the top of the business without being overruled quietly.

Raising concerns and investigation. A route for staff and others to report suspected bribery in good faith, protection for those who do, and a procedure for investigating and dealing with what is reported.

When certification is worth it

Certification is worth considering when someone outside the business needs to see independent evidence of your controls. In our experience that usually means one of three situations:

• Prime contractors and large customers in aerospace, defence and infrastructure, who increasingly ask suppliers about anti-bribery controls in their supplier approval questionnaires. A certificate can answer the question once rather than repeatedly.
• Public sector contracts, where tender documents may ask what anti-bribery procedures you operate and how you demonstrate them.
• Overseas sales through agents or distributors, particularly in markets with a higher perceived risk of corruption. Here the risk is real, the controls need to be strong, and external audit gives the board some assurance that they are being followed.

Certification is not, by itself, a legal defence. Under the Bribery Act 2010, whether a company had adequate procedures is a matter for the courts on the facts of the case. A well-implemented system will help show that you did. Your lawyers should advise on your own position.

When proportionate procedures are enough

Many owner-managed businesses do not need certification. If you sell mainly in the UK, do not use intermediaries to win work, and your customers are not asking for it, a proportionate approach based on the Ministry of Justice guidance is likely to fit better: a documented risk assessment, a clear policy, a gifts and hospitality register, sensible checks on third parties, training for the people most exposed, and periodic review.

That approach can still borrow from ISO 37001. Using the standard as a checklist, without the external audit, is a reasonable way to test whether your procedures have gaps. If a customer later asks for certification, you will be most of the way there. See our guide to the AS9100 certification process for how a certification project typically runs; the stages are much the same.

We help manufacturers decide what level of anti-bribery control fits their risk, build it into their existing system and train the people who operate it. See our quality management services and training, or get in touch.