ISO 37001 Anti-Bribery Management Systems in Practice
21 October 2026 · ACSINTE & PARTNERS
ISO 37001 is the international standard for anti-bribery management systems. It sets out requirements, with guidance, for establishing, implementing, maintaining and improving a system designed to help an organization prevent, detect and respond to bribery, whether in the public, private or not-for-profit sector. The second edition, ISO 37001:2025, was published in February 2025 and replaced the 2016 edition.
What an implementation involves
The standard does not prescribe a single model. It requires controls that are proportionate to the bribery risks the organization actually faces. In practice, an implementation in a Romanian company usually covers:
- a bribery risk assessment by business line, market and process (sales, public procurement, permits, customs, sponsorships, hiring);
- an anti-bribery policy approved by top management and a designated anti-bribery compliance function with adequate authority and independence;
- due diligence on business associates and higher-risk personnel, together with contractual anti-bribery clauses;
- financial and non-financial controls, including rules on gifts, hospitality, donations and conflicts of interest;
- training, internal communication and a channel for raising concerns;
- investigation procedures, internal audit, management review and continual improvement.
The 2025 edition places more emphasis on leadership and anti-bribery culture, clarifies requirements on conflicts of interest and the compliance function, and aligns the standard with the harmonized structure used by other ISO management system standards. This makes integration with existing ISO 9001, ISO 27001 or ISO 37301 systems easier.
Relation to compliance programs and whistleblowing
ISO 37001 is not a legal requirement in Romania, and certification does not by itself demonstrate compliance with criminal law. However, it gives a structured, auditable form to measures many companies already need: codes of conduct, third-party checks, approval workflows and internal investigations.
Whistleblowing is a clear point of overlap. Law no. 361/2022 on the protection of public interest whistleblowers requires, among others, private legal entities with at least 50 employees to set up internal reporting channels and procedures. Under the law, receipt of a report must be acknowledged within 7 days and feedback provided within a reasonable period, generally not exceeding 3 months. An ISO 37001 system can rely on the same channel, provided that confidentiality, protection against retaliation and the statutory deadlines are respected.
What certification means
Certification is granted by an independent certification body following an audit of the management system, followed by periodic surveillance audits. It attests that the system meets the standard's requirements at the time of the audit; it is not a guarantee that bribery cannot occur. For organizations certified under the 2016 edition, certification bodies have communicated a transition period ending on 28 February 2027, after which 2016 certificates are no longer valid.
Certification can be useful in tenders, in relations with multinational groups that require it from suppliers, and as evidence of the measures taken by management. Its value depends on the system being applied in day-to-day decisions, not only documented.
ACSINTE & PARTNERS assists companies with ISO 37001 implementation, gap analyses and related internal procedures.
This article provides general information and does not constitute legal advice.