Contents
##
Overview and origin
| Item | Details |
|---|---|
| Vietnamese name | Hệ thống quản lý chống hối lộ – Các yêu cầu và hướng dẫn sử dụng |
| English name | ISO 37001:2025 – Anti-bribery management systems – Requirements with guidance for use |
| Issuer / administrator | International Organization for Standardization (ISO), Technical Committee ISO/TC 309 (Governance of organizations). Certification is by independent certification bodies. |
| Nature | A certifiable management-system standard. Certification shows reasonable, proportionate measures are in place; it does not guarantee that no bribery occurs. |
| Reference scope | Bribery in the public, private and non-profit sectors; by the organization, its personnel or business associates; offering and receiving, directly or indirectly. Fraud, cartels and money laundering are out of scope (may be added voluntarily). |
ISO 37001 was first published in 2016, based on the UK standard BS 10500. The second edition, ISO 37001:2025, was published in February 2025, replacing the 2016 edition. Certified organizations must transition by 28 February 2027. Key changes: climate change in clauses 4.1–4.2, a new clause 5.1.3 on anti-bribery culture, clause 6.3 on planning of changes, conflict-of-interest awareness in recruitment, and mergers and acquisitions named as a risk area.
Purpose and main structure
Purpose: to help organizations prevent, detect and respond to bribery and comply with anti-bribery laws and voluntary commitments. It follows the Harmonized Structure (HS) with 10 clauses; requirements sit in clauses 4–10. The core idea is proportionality: controls depend on the assessed bribery risk.
2.1. All clauses and key requirements
| Clause | Key requirements |
|---|---|
| Clause 4 – Context | |
| 4.1 – 4.4 | Context (incl. climate change – 2025 edition), interested parties, scope, the anti-bribery management system |
| 4.5 | Bribery risk assessment: identify, analyse and rank risks; criteria; periodically and on significant change (documented) |
| Clause 5 – Leadership | |
| 5.1.1 | Governing body: approves the policy, oversees implementation |
| 5.1.2 | Top management: resources, communication, no retaliation against reporters |
| 5.1.3 | Anti-bribery culture (new in the 2025 edition) |
| 5.2 | Anti-bribery policy: prohibits bribery, legal compliance, encourages reporting, consequences |
| 5.3.1 – 5.3.3 | Roles; an independent, empowered anti-bribery compliance function; delegated decision-making |
| Clause 6 – Planning | |
| 6.1 / 6.2 / 6.3 | Actions on risks and opportunities; measurable anti-bribery objectives; planning of changes (new 2025) |
| Clause 7 – Support | |
| 7.2.2 | Employment process: screening for risky roles, compliance declarations, conflict-of-interest awareness (added 2025), incentives that do not encourage bribery |
| 7.3 | Awareness and training for personnel; training for business associates (7.3.3) |
| 7.4 / 7.5 | Communication; documented information |
| Clause 8 – Operation: ten control groups | |
| 8.1 | Operational planning and control |
| 8.2 | Due diligence on higher-risk transactions, projects, associates and personnel |
| 8.3 | Financial controls: segregation of duties, dual signatures, limited cash, payment checks |
| 8.4 | Non-financial controls: procurement, sales, HR, legal; mergers and acquisitions (added 2025) |
| 8.5 | Controlled organizations and business associates implement proportionate controls |
| 8.6 | Anti-bribery commitments from associates (contract clauses, termination rights) |
| 8.7 | Gifts, hospitality, donations, sponsorships: thresholds, approval, register |
| 8.8 | Managing inadequate controls (pause, adjust, exit the transaction) |
| 8.9 | Raising concerns: anonymous, confidential, no retaliation |
| 8.10 | Investigating and dealing with bribery |
| Clauses 9 – 10 | |
| 9.1 – 9.4 | Monitoring; internal audit; review by top management and governing body; review by the compliance function |
| 10.1 / 10.2 | Continual improvement; nonconformity and corrective action (order swapped vs. 2016) |
2.2. Suggested tracking indicators
ISO 37001 sets no indicators, but clause 9.1 requires monitoring and measurement. The set proposed by FTS CSRA:
| Indicator | Suggested target |
|---|---|
| % of high-risk personnel trained on anti-bribery in the year | 100% |
| % of high-risk associates screened before contracting | 100% |
| Gifts/hospitality above threshold declared and approved | Theo dõi / Track |
| Reports via the speak-up channel; % closed on time | ≥ 90% |
| Confirmed bribery incidents; actions taken | 0 |
| % of contracts with anti-bribery clauses | ≥ 95% |
Who uses it and how
Users: any organization – private and state-owned companies, public bodies, non-profits – especially those bidding for public contracts, dealing with regulators, using many agents or intermediaries, or supplying multinational groups.
- The board and top management commit; appoint an anti-bribery compliance function with direct access to the board.
- Assess bribery risk by country, sector, transaction, business associate and job role.
- Issue an anti-bribery policy, rules on gifts, hospitality and sponsorships, and associate due-diligence procedures.
- Set financial and non-financial controls proportionate to risk; add anti-bribery clauses to contracts.
- Train high-risk personnel and associates; open a safe speak-up channel.
- Monitor, audit, run management reviews; invite a certification body if a certificate is needed.
Practical example
Hypothetical case: Construction Company H (Hanoi), 1,500 staff, regularly bids for public projects and hires intermediaries for permits.
| Risk | Controls applied | Results after 12 months |
|---|---|---|
| Permit intermediaries (very high risk) | Enhanced due diligence; contracts with anti-bribery and audit clauses; payment only by bank transfer against invoices | 3 of 14 non-transparent intermediaries terminated; 100% of contracts with clauses |
| Public tenders | Separate bid preparation from cost approval; no private hospitality with the tendering party | 0 concerns reported |
| Lunar New Year gifts to clients | VND 1 million/person threshold; gift register; prior approval | Gift spending down 40%, more transparent |
| Culture | Regular CEO messages; anonymous hotline run by a third party | 17 reports, 15 resolved; no retaliation |
Notes for use in Vietnam
- Legal framework: the 2018 Anti-Corruption Law has a dedicated chapter for non-state enterprises and organizations; the 2015 Criminal Code (amended 2017) covers receiving, giving and brokering bribes, including in non-state companies. ISO 37001 systematizes these duties; it does not replace the law.
- Gift culture: holiday gifts and “facilitation payments” need clear thresholds, recipients, approvals and a register – a frequent audit focus.
- Exporters and foreign-invested firms: partners often require compliance with extraterritorial laws such as the US FCPA and the UK Bribery Act 2010 – ISO 37001 is strong evidence of “adequate procedures”.
- Transition to 2025: organizations certified to the 2016 edition must update their systems before 28 February 2027.
- Integration: easy to combine with ISO 37301 (compliance), ISO 9001 and ISO 14001 thanks to the shared HS structure.
Sources and cross-references
- ISO 37001 – Anti-bribery management systems (official ISO page)
- DQS: Revision 2025 of ISO 37001
- Vietnam: Anti-Corruption Law 2018; Criminal Code 2015 (amended 2017)
- Cross-references: ISO 37301 (Compliance management); ISO 37009 (Conflicts of interest); UN Global Compact Principle 10; GRI 205
Method & scope
Content compiled and interpreted from FTS Impact Lab and documents of the issuing body; versions and sources should be verified before publication.
References
- ISO 37001 – Anti-bribery management systems (official ISO page) ↗ (accessed 2026-10-24)
- DQS: Revision 2025 of ISO 37001 ↗ (accessed 2026-10-24)
- Vietnam: Anti-Corruption Law 2018; Criminal Code 2015 (amended 2017) (accessed 2026-10-24)
- Cross-references: ISO 37301 (Compliance management); ISO 37009 (Conflicts of interest); UN Global Compact Principle 10; GRI 205 (accessed 2026-10-24)
