ISO 37001:2016 specifies an anti-bribery management system: risk assessment, due diligence on third parties, financial and non-financial controls, gifts and hospitality rules, whistle-blowing, investigation and top-management oversight. Since the 2018 amendment to the Prevention of Corruption Act made commercial organisations liable for bribery by anyone acting on their behalf, with a defence only for companies that had adequate procedures in place, a certified system has become the practical way for Indian companies, especially those dealing with government, to demonstrate those procedures to boards, lenders, multinational partners and investigators.
Legal basis: ISO 37001:2016 (voluntary international standard); Sections 9 and 10 of the Prevention of Corruption Act, 1988 as amended in 2018 (corporate liability and the adequate-procedures defence); vigil mechanism under the Companies Act, 2013; UK Bribery Act and US FCPA for groups with foreign parents or listings
Who needs it
- Companies that deal regularly with government departments, PSUs and regulators for licences, tenders and approvals
- Indian subsidiaries and suppliers of multinationals subject to the FCPA or UK Bribery Act that require certified controls down the chain
- Infrastructure, real estate, mining, defence and pharma companies in sectors with elevated bribery risk
- Listed companies strengthening governance after SEBI, board or auditor findings
- Businesses using agents, intermediaries and distributors in high-risk markets
- Companies pursuing lender, DFI or export credit financing with integrity due diligence
Documents required
- 1Code of conduct, anti-corruption policy, gifts and hospitality policy and whistle-blower policy
- 2Organisation chart, business segments and list of government touchpoints
- 3List of agents, intermediaries, distributors, consultants and major suppliers with contracts
- 4Delegation of authority, procurement and payment approval procedures
- 5Internal audit reports, vigil mechanism complaints and investigation records
- 6Board and audit committee minutes on compliance and ethics
- 7Training records on ethics and anti-corruption
- 8Due diligence records on third parties and employees in sensitive roles
Missing something? We help you obtain or regularise supporting documents before filing.
How we get it done
- 1
Scoping and bribery risk assessment
Day 1–15We map every government, intermediary and high-value transaction touchpoint and rate bribery risk by function, geography and counterparty.
- 2
Policy and control design
Day 10–30Anti-bribery policy, gifts and hospitality rules, approval thresholds, financial controls and the compliance function's mandate are designed with top management.
- 3
Third-party due diligence and procedures
Day 25–50Due diligence, contractual clauses and monitoring for agents, suppliers and partners are set up, together with reporting and investigation procedures.
- 4
Training, implementation and internal audit
Day 45–70Exposed staff are trained, controls operate, the reporting channel is tested and our auditor conducts the internal audit and management review.
- 5
Certification audit
Day 65–90We attend the Stage 1 and Stage 2 audits, close findings and the ISO 37001 certificate is issued.
If you skip certification
Under the Prevention of Corruption Act as amended in 2018, a commercial organisation whose employee, agent or associated person bribes a public servant is liable to a fine, and the directors, managers or officers who consented or connived face three to seven years' imprisonment. The only defence is proof of adequate procedures to prevent bribery. Without a documented and tested system that defence is unavailable, and groups subject to the FCPA or UK Bribery Act face parallel enforcement abroad.
Why MYDA Group
Specialists, not generalists
Environmental compliance is our only practice, so your file is handled by people who do this every day.
Fixed fee, written scope
You know the professional fee and the statutory fees before we start. No surprise add-ons.
Inspection and audit-ready
We prepare your site and team for the board visit or certification audit and attend it with you.
Lifetime reminders
Every condition, return and renewal goes into your compliance calendar with alerts.
Frequently asked questions
Does ISO 37001 certification guarantee the adequate-procedures defence?
No standard can guarantee how a court will rule, but the Act's defence turns on whether the organisation had adequate procedures in place, and ISO 37001 is the only international benchmark of what adequate procedures look like. A certified, audited system is strong evidence; a policy on the intranet is not.
We already have a code of conduct. Why is this different?
A code states the rule. ISO 37001 requires the organisation to assess where bribery risk actually arises, control it with due diligence, approvals and financial controls, train the people exposed, provide a reporting channel, investigate and keep top management accountable. The certification audit tests whether all of that is operating, not whether the policy exists.
Does it cover facilitation payments and gifts?
Yes. The standard requires controls over gifts, hospitality, donations, sponsorships and facilitation payments, which are the most common bribery exposures in Indian government interactions.
Can it be combined with other standards?
Yes. The common structure allows a combined audit, and many companies pair ISO 37001 with ISO 31000 or ISO 27001 within a single governance programme.