What the New Anti-Bribery Culture Requirement in ISO 37001:2025 Means for Your ABMS
Quick answer: ISO 37001:2025, published in February 2025, adds a new subclause 5.1.3, Anti-Bribery Culture that makes building and demonstrating an anti-bribery culture a certifiable requirement, not just a policy. Auditors now assess leadership behavior and employee conduct, not only documentation.
Here's an uncomfortable question for anyone who owns compliance at their company
For almost ten years, ISO 37001 let organizations answer that question with a document. Build an Anti-Bribery Management System (ABMS), tick the boxes policies, due diligence, financial controls, training, investigations, audits and you had yourself a certification.
Policies don't stop corruption. People do. Or they don't. That gap is exactly what ISO 37001:2025 was built to close.
What Is ISO 37001:2025?
ISO 37001:2025 is the current revision of the international anti-bribery management system standard, published in February 2025. It replaces the 2016 edition and introduces a formal requirement for organizations to build, sustain, and evidence an anti-bribery culture not just implement anti-bribery controls.
What Changed in ISO 37001:2025?
The 2016 version of the standard treated culture as a side effect of good controls something that would presumably show up if the paperwork was solid enough.
The 2025 revision throws that assumption out. It adds a brand-new subclause 5.1.3, Anti-Bribery Culturethat makes culture an explicit, standalone requirement. Organizations must now:
-
Actively build an anti-bribery culture at every level, not just at the compliance-team level
-
Prove leadership is walking the talk — the governing body, top management, and middle management all need to show visible, consistent, sustained commitment to shared ethical standards
-
Reward the right behavior and refuse to look away from the wrong kind conduct that undermines the ABMS can no longer be quietly tolerated because someone hit their numbers
Translation: leadership behavior is now part of the audit trail.
A well-written policy sitting in a shared drive is no longer enough. Auditors, regulators, customers, and partners will increasingly want proof that the tone set in the boardroom actually reaches the shop floor.
Why Does the Anti-Bribery Culture Clause Matter?
Anyone who's worked in compliance for more than a few years already knows this truth: controls without culture are fragile.
Picture a finance team with a flawless approval matrix segregation of duties, layered sign-offs, airtight due diligence procedures.
Now picture a regional manager who quietly believes facilitation payments are "just how things get done here," and a leadership team that doesn't challenge that belief because the region keeps hitting target.
The control still exists on paper. It's just decorative.
ISO 37001:2025 is effectively taking "tone at the top" out of the leadership-offsite slide deck and turning it into something measurable and auditable.
What Will Auditors Check Under ISO 37001:2025?
Expect the conversation to shift from "show me the manual" to "show me the behavior." Under the new standard, auditors are likely to probe:
-
Whether leadership's actual decisions reflect ethical behavior not just their memos
-
How management responds when someone raises a concern or reports misconduct
-
Whether employees genuinely understand what's expected of them, not just whether they clicked through a training module
-
Whether stated values line up with how business actually gets done
-
Whether ethical conduct is visibly recognized and rewarded — or just assumed
In short: the question is moving from "Do you have a system?" to "Is the system actually changing behavior?"
Is It Difficult to Comply With the New Culture Requirement?
Updating procedures for ISO 37001:2025 will be the easy part for most organizations. Legal and compliance teams do this kind of document refresh all the time.
Building a genuine anti-bribery culture is a different order of difficulty.You can't manufacture it with one training session, one policy memo, or one all-hands announcement from the CEO. It takes sustained, repeated, visible commitment consistent messaging, leaders who model the standard even when it's inconvenient, and accountability that applies to everyone, not just the people without the power to push back.
FAQ: ISO 37001:2025 Anti-Bribery Culture
When was ISO 37001:2025 published?
ISO 37001:2025 was published in February 2025, replacing the 2016 edition of the standard.
What is subclause 5.1.3 in ISO 37001:2025?
Subclause 5.1.3, "Anti-Bribery Culture," is a new requirement that obligates organizations to develop, maintain, and promote an anti-bribery culture across all levels, with visible and sustained commitment from leadership.
Does ISO 37001:2025 require leadership training?
The standard doesn't mandate a specific training format, but it does require the governing body and management to demonstrate active, consistent commitment to ethical standards — which in practice means leadership behavior, not just training completion, becomes part of what auditors assess.
How is ISO 37001:2025 different from the 2016 version?
The core ABMS elements i.e. policies, due diligence, controls, training, investigations, audits — remain, but the 2025 version adds an explicit, standalone requirement to build and evidence an anti-bribery culture, shifting audits from "do you have a system" to "does the system influence behavior."
How can organizations prepare for the ISO 37001:2025 culture requirement? Organizations should assess whether leadership decisions and everyday employee conduct genuinely reflect their anti-bribery policy, not just whether the policy document itself is up to date since that consistency is what auditors will now be looking to verify.
The Question Worth Asking Before Your Next Audit
If ISO 37001:2025 is on your organization's radar or should be start with this:
If an auditor watched how your people actually make decisions every day, would they find evidence of a real anti-bribery commitment, or just evidence that someone wrote a good policy?
Your answer won't just decide whether you pass certification. It will decide whether your anti-bribery program actually works.