ISO 37001:2025 addresses prevention, detection and response to bribery. Certification is not immunity from investigation or proof that no bribery has occurred.

01

Map the actual exposure and boundaries

Define entities, activities, locations and relevant business associates. Assess exposure from transactions, projects and relationships rather than declaring every party the same risk. Include relevant direct and indirect bribery risks. The system does not automatically cover all fraud, money laundering or every legal compliance matter.

02

Connect due diligence and approval controls

In a hypothetical intermediary arrangement, examine the role, payment rationale, ownership information, conflicts and required approvals before engagement. A signed anti-bribery clause alone does not resolve unexplained fees. Use financial and non-financial controls, training and appropriate reporting routes with clear responsibilities.

03

Prepare the scope and edition evidence

Provide boundaries, risk assessment, due diligence, control implementation and oversight status. The catalogue publishes ISO 37001:2025; check an earlier certificate’s edition, current status and transition with its issuer. A new edition does not automatically extend accreditation. Ask what activity and edition the proposed body can assess and who makes the independent decision.

04

Preparation and independent decision

ISO does not issue certificates. Verify the proposed issuer, standard and activity against any claimed accreditation scope. Consultancy cannot guarantee approval; the competent body evaluates evidence and makes the independent decision. The applicant implements the system and prepares procedures specific to its own operations and operating records. A certification enquiry to Kayra concerns actual activities, sites, application information, authority and impartiality risks; this role does not include designing or implementing the client’s system. A management-system certification body, other parts of the same legal entity and controlled entities cannot offer or provide management-system consultancy; separate contracts do not remove this restriction.

Sources and application limits

The intermediary is hypothetical. Applicable laws and competent authorities retain their powers; no customer event, legal immunity or universal acceptance is claimed.