Anti-bribery Policy for ISO 37001

ISO 37001 Clause 5.2

The anti-bribery policy. What it must say, who has to see it, and how it is approved.

ISO 37001 Clause 5.2 - Anti-bribery Policy

Clause 5.2 sets out the requirements for the anti-bribery policy itself. The policy is the most visible single document of the ABMS - it is how the organisation tells employees, business associates and the outside world how it deals with bribery.

What the Anti-bribery Policy Must Contain

The standard lists the content the policy must include. It must prohibit bribery. It must require compliance with anti-bribery laws applicable to the organisation. It must be appropriate to the purpose of the organisation. It must provide a framework for setting anti-bribery objectives. It must include a commitment to meet applicable requirements. It must encourage the raising of concerns in good faith or on the basis of reasonable belief, in confidence and without fear of reprisal. It must include a commitment to continual improvement. It must explain the authority and independence of the anti-bribery function. And it must explain the consequences of non-compliance with the policy.

Documentation, Approval and Communication

The policy must be documented, made available to interested parties as appropriate, and communicated to business associates that pose more than a low bribery risk. Top management establish and approve it - the standard does not require a board signature unless there is a governing body, but where one exists approval at that level is normal practice.

Communication runs in three directions. Internally, every employee should have ready access to the policy - typically via the staff handbook, intranet or induction process. Externally, the policy is shared with business associates whose bribery risk profile makes anti-bribery commitments material to the relationship - usually higher-risk suppliers, agents and intermediaries. Publicly, the policy is often classified as suitable for sharing with customers and as part of pre-qualification questionnaires.

Where P-10 Fits

The P-10 Anti-bribery and Corruption Policy template covers all the content required by Clause 5.2 and is information-classified as public so it can be shared openly. It works alongside the longer operational procedure PP-1-19 Anti-bribery, which provides the practical detail of how the policy is implemented.

You do not have to write the policy from scratch. A template like P-10 already includes the required content - the work is in adapting it to your organisation, getting it approved, and making sure it is actually communicated to the people who need to see it. The communication step is the one that fails most often in audit.

I check the policy content against the Clause 5.2 requirements line by line. I check the date and version. I look for evidence of communication - intranet, induction records, business associate distribution. A policy that exists but has not actually reached the workforce is a non-conformity.

Practical Compliance Guidance

The anti-bribery policy is the public-facing statement of the ABMS. P-10 provides the policy itself, while PP-1-19 sets out how the policy is implemented day to day.

The documents below establish and support the anti-bribery policy required by Clause 5.2.

alphaZ document	How to use it
ISO 37001 Toolkit	Complete documentation set for ISO 37001:2025 compliance, including the anti-bribery policy, the PP-1-19 Anti-bribery procedure, audit checklists, risk assessment and all supporting registers and forms.
P-10 Anti-bribery and Corruption Policy	Anti-bribery policy template covering all content required by Clause 5.2, suitable for public sharing.
PP-1-19 Anti-bribery Procedure	Operational procedure that implements the policy, including reporting routes, due diligence and investigation arrangements.
P-108 Hospitality and Gifts Policy	Companion policy setting the rules on giving and receiving hospitality and gifts.
P-14 Whistleblowing Policy	Whistleblowing policy supporting the policy commitment to confidential, no-retaliation reporting.

Note - all the above files can be downloaded with an alphaZ subscription.

Frequently Asked Questions

Does the anti-bribery policy need to be signed?

The standard requires the policy to be approved by top management. A signature is the usual way to evidence approval but other forms of formal approval - board minutes, an authorisation matrix entry - are also acceptable. The key point is that the approval is documented and traceable.

Can the anti-bribery policy be combined with other policies?

It can be referenced from a wider code of conduct or values document, but the specific content required by Clause 5.2 needs to be clearly identifiable. Most organisations find it cleaner to keep the anti-bribery policy as a standalone document so the required content is unambiguous.

How often does the policy need to be reviewed?

The standard does not specify a frequency, but the policy should be reviewed when significant changes occur and as part of management review. Annual review is common practice and gives a clear date for re-issue if changes are needed.

Do all employees need to acknowledge the policy in writing?

The standard does not require written acknowledgement of the policy, but Clause 7.2.2.1 does require employment conditions to require compliance with the policy and management system. Many organisations capture acknowledgement at induction through a signed declaration or training record.

UK Legislation

The following UK legislation creates the legal context the anti-bribery policy commits the organisation to comply with. The Bribery Act 2010 is the central instrument.

Further Resources