When ISO 37001:2016 was introduced, it gave organizations a structured way to address bribery risks and strengthen their anti-bribery practices. Many organizations adopted the standard to establish an Anti-Bribery Management System (ABMS) covering policies, risk assessments, due diligence, financial and non-financial controls, and continual improvement.
However, the standard has since been revised. ISO 37001:2025 was published on 28 February 2025, replacing ISO 37001:2016 and incorporating the climate-action provisions introduced through the 2024 amendment. This means organizations previously certified to the 2016 edition need to understand the changes and check the transition requirements applicable to their certificates.
This guide looks back at ISO 37001:2016, explains its Clauses 4–10 and the 2024 climate amendment, and discusses certificate status, the main changes introduced in ISO 37001:2025, and the transition process.
For information about certification to the current edition, visit Guardian Assessment’s ISO 37001 certification page.
What Was ISO 37001:2016?
ISO 37001:2016 was the first edition of the international standard for Anti-Bribery Management Systems (ABMS). It provided guidelines for organizations to prevent, detect and address bribery risks.
The standard applied to organizations of all sizes and types, including private businesses, government bodies and non-profit organizations. It covered bribery risks involving employees, business partners, agents and other third parties. It helped organizations establish anti-bribery policies, assess risks, conduct due diligence, train employees and implement controls to prevent bribery.
ISO 37001:2016 has been withdrawn and replaced by ISO 37001:2025 . Understanding the earlier edition helps organizations review their existing systems and prepare for the transition.
What Changed in the 2024 Climate Amendment?
ISO published ISO 37001:2016/Amd 1:2024, Climate action changes, on 23 February 2024. The amendment introduced explicit climate-change considerations into the existing management-system requirements. It addressed two areas:
- Clause 4.1 — Understanding the organization and its context: Organizations needed to determine whether climate change was a relevant issue in their context.
- Clause 4.2 — Understanding the needs and expectations of interested parties: A note clarified that relevant interested parties can have climate-related requirements.
For an organization, this could involve considering whether climate-related issues affect its operations, supply chain, infrastructure, business continuity, or the expectations of relevant interested parties. The organization should determine whether climate change is relevant to its context and consider any applicable requirements of interested parties.
The amendment has since been withdrawn as part of the replacement of the 2016 edition by ISO 37001:2025. See the official ISO amendment record.
ISO 37001:2016 Requirements: Clauses 4 to 10
ISO 37001:2016 followed the common high-level structure used by many ISO management-system standards, with requirements specifically designed for managing bribery risks.
Clause | Main subject | What the organization needed to do |
Clause 4 | Context of the organization | Understand relevant internal and external issues, identify interested parties and their requirements, define the ABMS scope, and assess bribery risks. |
Clause 5 | Leadership | Demonstrate leadership commitment, establish an anti-bribery policy, assign responsibilities, and ensure appropriate authority and resources for the anti-bribery function. |
Clause 6 | Planning | Address risks and opportunities, establish anti-bribery objectives, and plan actions to achieve them. |
Clause 7 | Support | Provide resources, competence, awareness and training, communication, and controlled documented information. |
Clause 8 | Operation | Implement operational controls, due diligence, financial and non-financial controls, business-associate controls, reporting channels, and procedures for investigating bribery concerns. |
Clause 9 | Performance evaluation | Monitor and evaluate the ABMS, conduct internal audits, and carry out management reviews. |
Clause 10 | Improvement | Address nonconformities, take corrective action, and continually improve the ABMS. |
This table summarizes the clause structure rather than replacing the full standard. Organizations need to consider the requirements together because risk assessment, leadership, due diligence, operational controls, reporting, and improvement are interconnected.
Request Quotation
Sample Certificate
Request Quotation
Other Standards
Recognition
Sample Certificate
How the requirements worked together
Consider a construction company that regularly bids for government contracts and works with external agents, subcontractors, and suppliers.
The company would identify relevant bribery risks, establish the ABMS scope, define responsibilities, and set objectives for managing those risks. It might conduct risk-based due diligence on agents, establish approval procedures for gifts and hospitality, introduce financial controls, and provide anti-bribery training to relevant personnel. During operations, the company would monitor whether controls were followed, review third-party relationships, maintain appropriate records, and provide ways for personnel to raise concerns. Internal audits and management reviews would help determine whether the system was operating as intended.
If a review identified inadequate checks on an intermediary, the company could investigate the cause, strengthen its due diligence and approval procedures, train relevant employees, and evaluate whether the revised controls were effective. This illustrates how an ABMS connects risk assessment, leadership, operational controls, performance evaluation, and improvement.
Key Features of ISO 37001:2016 Certification
ISO 37001:2016 established a framework for managing bribery risks systematically. Its main features include the following.
- A common management-system structure: The standard used a structure aligned with other ISO management-system standards. This helped organizations integrate anti-bribery management with systems such as ISO 9001 for quality management or ISO 37301 for compliance management, where appropriate.
- Leadership commitment and an anti-bribery policy: Top management needed to demonstrate commitment to preventing bribery and establish an anti-bribery policy appropriate to the organization. Responsibilities, authority, and resources had to support the operation of the ABMS.
- Bribery risk assessment: Organizations needed to assess bribery risks relevant to their activities, business relationships, locations, and operating circumstances. The results helped determine the nature and extent of controls required.
- Due diligence and business-associate controls: The standard addressed risk-based due diligence involving relevant projects, transactions, personnel, and business associates. The depth of review depended on the bribery risks and the circumstances of the relationship.
- Financial and non-financial controls: Organizations needed appropriate controls to manage bribery risks. These could include financial approvals, transaction records, procurement procedures, contract controls, and checks on other business activities.
- Gifts, hospitality, donations, and similar benefits: The standard addressed gifts, hospitality, donations, and similar benefits that could create or appear to create bribery risks. Organizations needed appropriate measures based on their circumstances and risk exposure.
- Reporting concerns and investigating suspected bribery: The ABMS needed suitable arrangements for raising concerns and dealing with suspected bribery. Reporting and investigation processes helped organizations respond to potential misconduct and identify weaknesses in their controls.
- Monitoring and continual improvement: Monitoring, internal audits, management reviews, corrective action, and continual improvement helped organizations evaluate whether their anti-bribery controls remained suitable and effective.
Certification did not guarantee that bribery would never occur or that an organization complied with every law applicable to its activities. It assessed conformity of the management system within its defined scope.
What Are the Main Changes in ISO 37001:2025?
ISO 37001:2025 retains the focus on preventing, detecting, and responding to bribery but revises and strengthens several aspects of the Anti-Bribery Management System. The main changes include:
- Climate change considerations: The revised edition includes requirements addressing climate change within the organization’s context and relevant interested-party requirements.
- Compliance culture: New subclauses emphasize the importance of a culture that supports compliance and anti-bribery practices.
- Conflicts of interest: The revised edition addresses conflicts of interest more explicitly within the anti-bribery management framework.
- Anti-bribery function: The concept and role of the anti-bribery function have been clarified.
- Harmonized management-system structure: The revised edition adopts the latest harmonized structure and aligns terminology with other ISO management-system standards where appropriate.
Organizations transitioning from ISO 37001:2016 should review the official 2025 edition, identify the changes relevant to their existing system, and plan the necessary updates. This summary is an overview, not a substitute for reviewing the standard’s complete requirements.
Can Organizations Still Get ISO 37001:2016 Certification?
Organizations should not assume that a new ISO 37001:2016 certificate can still be issued simply because existing certificates may remain within a transition period. ISO 37001:2016 is withdrawn, and the applicable certification and accreditation arrangements determine which edition may be used for new applications and certification activities.
Under IAF Mandatory Document MD 30:2025, certification bodies were required to begin conducting initial certification and recertification only against ISO 37001:2025 by 31 August 2026. That date has passed. Organizations seeking initial certification should plan for ISO 37001:2025 and confirm the applicable scope and arrangements with their chosen certification body.
For the official current-edition record and transition requirements, consult the ISO 37001:2025 page and the IAF transition requirements document.
Is an ISO 37001:2016 Certificate Still Valid?
The publication of ISO 37001:2025 on 28 February 2025 did not automatically make all ISO 37001:2016 certificates invalid. A transition period was provided for organizations to move to the updated edition. Under IAF MD 30:2025, organizations covered by the transition requirements must complete their transition by 28 February 2027. If your organization holds an ISO 37001:2016 certificate, you should:
- Check your certificate’s current status and expiry date.
- Contact your certification body to confirm the applicable transition deadline.
- Understand the changes required to meet ISO 37001:2025.
- Plan your transition audit and complete any necessary corrective actions before the deadline.
Note: The validity of an individual certificate depends on the applicable certification and accreditation arrangements. Do not rely on its printed expiry date alone to determine whether it remains valid. For details, refer to the IAF transition requirements for ISO 37001:2025.
How to Transition from ISO 37001:2016 to ISO 37001:2025
Organizations should work with their certification body to establish a transition plan that reflects their certificate status, audit schedule, and applicable deadline.
- Confirm the applicable deadline. Ask your certification body which transition requirements apply and when the transition must be completed.
- Review the 2025 edition. Obtain the official standard and identify the requirements relevant to your ABMS.
- Conduct a gap assessment. Compare the existing system with ISO 37001:2025 and document the changes needed.
- Update the ABMS. Revise relevant policies, risk assessments, responsibilities, due diligence processes, operational controls, and documented information.
- Inform and train relevant personnel. Ensure employees, management, and other relevant personnel understand changes affecting their responsibilities.
- Verify implementation. Conduct internal audits and management review as appropriate, and address identified issues.
- Coordinate the transition audit. Agree on audit arrangements with the certification body, complete the required activities, and address nonconformities within the applicable timeframe.
Depending on the organization, the review may involve bribery risk assessment, business-associate due diligence, conflicts of interest, gifts and hospitality, financial and non-financial controls, reporting channels, investigation procedures, and the responsibilities of the anti-bribery function. Start early enough to allow time for implementation and corrective action. A gap assessment is useful, but it does not replace the official standard or the certification body’s applicable requirements.
Why ISO 37001:2016 Is Still Important
ISO 37001:2016 established a framework that organizations used to assess bribery risks, strengthen controls, and evaluate their anti-bribery management systems. Understanding the earlier requirements can help certificate holders review historical audit findings, retain relevant records, and identify areas to assess during transition. Organizations should use this historical understanding to prepare for the applicable current requirements rather than treat the withdrawn edition as the basis for new certification.
Why Choose Guardian as Your ISO 37001 Certification Body?
- Accredited by UAF and IAS. UAF (United Accreditation Foundation) and IAS (International Accreditation Service) accredit Guardian for applicable management system certification activities. Confirm that ISO 37001:2016 is included in the current accreditation scopes.
- Auditors who understand your industry. We assign auditors based on your organization’s activities, size and bribery-related risks.
- Impartial certification. We audit and certify management systems without providing consultancy on the systems we certify. Certification decisions are reviewed independently.
- Combined audits. Organizations can combine ISO 37001 audits with other applicable management system standards, helping reduce duplicated audit activities.
- Based in India. Our head office is in Lucknow, Uttar Pradesh, and we provide certification services to organizations across India.
- Certificate transfer support. Organizations holding an eligible accredited ISO 37001:2016 certificate from another certification body can explore transferring it to Guardian, subject to applicable transfer requirements.
Need ISO 37001:2025 Certification or Transition?
If your organization holds an ISO 37001:2016 certificate, you should review the applicable transition requirements and plan the move to ISO 37001:2025 before the transition deadline. For new certification, visit Guardian Assessment’s ISO 37001 certification page to know in detail about the standard and certification process. For questions about your organization’s certification requirements, contact Guardian Assessment.
Apply for ISO 37001:2016 Certification
ISO 37001:2016 has been replaced by ISO 37001:2025. Organizations with existing certificates should check the applicable transition arrangements before applying for certification to the earlier edition.
Planning your transition to ISO 37001:2025? Visit our ISO 37001:2025 certification page to know more about the updated requirements and certification process.
Frequently Asked Questions
No. ISO 37001:2025 was published on 28 February 2025 and replaced ISO 37001:2016 and its 2024 climate amendment.
Organizations should not assume that certification to the withdrawn edition remains available. Under the IAF transition arrangements, initial certification and recertification must now use ISO 37001:2025.
Contact the certification body that issued the existing certificate, confirm the applicable deadline, obtain ISO 37001:2025, and conduct a gap assessment against the new edition.