Awareness for ISO 37001 Anti-Bribery
ISO 37001 Clause 7.3
Awareness and training for personnel and business associates, with new requirements in 2025 around business associate training and structured programmes.
ISO 37001 Clause 7.3 - Awareness
Clause 7.3 has four parts. 7.3.1 covers awareness of personnel. 7.3.2 covers training of personnel. 7.3.3 is new in 2025 and requires training for business associates that pose more than a low bribery risk. 7.3.4 is also new in 2025 and requires structured awareness and training programmes.
ISO 37001 Clause 7.3.1 - Awareness of Personnel
The organisation must make sure personnel are aware of the anti-bribery policy, procedures and management system, their duty to comply with them, their individual contribution to ABMS effectiveness, the implications of non-conformance, the benefits of reporting suspected bribery, how to report concerns and to whom. Documented information about the awareness programme and who has received it is required.
ISO 37001 Clause 7.3.2 - Training for Personnel
Anti-bribery training has to address the applicable policies and procedures, the bribery risk and damage that can result from bribery, the circumstances in which bribery can occur in connection with the role and how to recognise them, how to recognise and respond to solicitations and offers of bribes, how the individual can help prevent and avoid bribery and recognise key risk indicators, and the available training and resources. Training procedures, content and delivery records have to be retained as documented information.
The training is shaped by the bribery risk assessment - higher-risk roles get deeper training, lower-risk roles get awareness-level material. The 2025 revision tightened the link between the bribery risk assessment and the training content.
ISO 37001 Clause 7.3.3 - Training for Business Associates (New for 2025)
This sub-clause was added in 2025. Where bribery risks have been identified involving business associates that act on behalf of or for the benefit of the organisation and pose more than a low bribery risk, the organisation must implement procedures for anti-bribery training of those associates. The procedures must identify which associates need training, what the content is and how the training will be provided.
This is one of the more practically demanding additions to the standard. It does not require every business associate to be trained - only those acting on the organisation behalf with greater than low bribery risk. In practice this typically applies to sales agents, intermediaries acting in relation to public officials, and key suppliers in higher-risk regions or sectors. Training is usually delivered as a briefing, a written summary of the relevant rules, or a structured online module - the format matches the relationship and the risk.
ISO 37001 Clause 7.3.4 - Awareness and Training Programmes (New for 2025)
Personnel must receive awareness and training from the start of employment and at planned periods, appropriate to their role, the bribery risk they are exposed to and any changing circumstances. Awareness and training programmes must be updated at planned periods to reflect new information.
The clause formalises what was implicit in the previous version - training is not a one-off event at induction. It runs continuously, gets refreshed when circumstances change and is reviewed periodically to confirm it is still fit for purpose.
The structure that works for most organisations is induction training for everyone covering the policy and reporting routes, role-specific training for higher-risk positions, an annual refresh for everyone with content updated when circumstances change, and a separate briefing track for business associates that need training under 7.3.3. The training matrix records all of it.
The trap with this clause is treating it as an annual tickbox exercise. The standard wants people to actually know what to do when they encounter bribery risk, not just to have clicked through a course in 2024. Training that is too generic, never updated and never tested produces records but not awareness.
I check three things on training. The matrix shows everyone has had appropriate training to their role. The content evidences what was actually covered. The dates show recent training and a planned interval for refresh. For 7.3.3 I check the business associate register identifies which associates need training and the records show that training has been delivered.
Practical Compliance Guidance
Awareness and training is centred on the staff training matrix, supported by induction records and the central anti-bribery procedure. Business associate training is tracked through the business associate register.
The documents below support the awareness and training requirements of Clause 7.3.
| alphaZ document | How to use it |
|---|---|
| ISO 37001 Toolkit | Complete documentation set for ISO 37001:2025 compliance, including the anti-bribery policy, the PP-1-19 Anti-bribery procedure, audit checklists, risk assessment and all supporting registers and anti-bribery forms. |
| ER2 Staff Training Competency Matrix | Records anti-bribery training completed by every member of staff, including refresh dates and competence evidence. |
| F-Q4 Staff Induction | Induction record confirming the policy and training have been received at the start of employment. |
| PP-1-19 Anti-bribery Procedure | Central operational reference covering the awareness content required by Clause 7.3.1. |
| GEN1-1 General Staff Handbook | Reference handbook covering anti-bribery awareness alongside other staff guidance. |
| F-IMS35 Business Associate Register | Identifies business associates requiring training under Clause 7.3.3 and records training delivered. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
UK Legislation
The following UK legislation provides the legal context for anti-bribery awareness. The Bribery Act 2010 makes training a key element of adequate procedures.
