Communication for ISO 37001 Anti-Bribery

ISO 37001 Clause 7.4

Communication relevant to the ABMS, with specific requirements around the anti-bribery policy and languages.

ISO 37001 Clause 7.4 - Communication

Clause 7.4 has two parts. 7.4.1 covers determination of internal and external communications. 7.4.2 covers specific requirements around communication of the anti-bribery policy.

ISO 37001 Clause 7.4.1 - Determining Communications

The organisation must determine the internal and external communications relevant to the ABMS, including what will be communicated, when, with whom, how, who will communicate and the languages used. The clause does not require documented information but most organisations capture this in a communications table within the IMS1 manual.

For the ABMS, the relevant communications usually include the anti-bribery policy itself, key bribery risk information, the procedures for reporting concerns, training notifications, management review outcomes, regulator communications and customer or supplier communications about the anti-bribery commitment.

ISO 37001 Clause 7.4.2 - Communicating the Anti-bribery Policy

The anti-bribery policy must be made available in appropriate languages and to all organisation personnel and business associates. It must be communicated directly to personnel and business associates where there is more than a low bribery risk. It must be shared through the organisation communication channels.

The language requirement matters where the organisation operates internationally. A policy only available in English does not satisfy the clause if material parts of the workforce or the higher-risk business associates speak other languages. The standard does not specify how many languages - it requires the languages to be appropriate to the audience.

The clause is short but the language point catches some organisations out. If you have a sales agent in a country where English is a second or third language, sending them a 12-page policy in English and assuming the message has landed is not enough. Translation, or a summary in the local language, is what the clause expects.

A communications table in the IMS1-3-3-1 covers Clause 7.4.1 cleanly. List the communication, the audience, the trigger, the channel and the responsible owner. The table also helps with management review because it shows whether the communications have actually happened.

Practical Compliance Guidance

ABMS communications are typically captured in a communications table within the IMS1-3-3-1 or IMS1 Manual covering each communication, audience, channel, owner and frequency.

The documents below support communication arrangements for the ABMS.

alphaZ document	How to use it
ISO 37001 Toolkit	Complete documentation set for ISO 37001:2025 compliance, including the anti-bribery policy, the PP-1-19 Anti-bribery procedure, audit checklist, risk assessment and all supporting registers and anti-bribery forms.
P-10 Anti-bribery and Corruption Policy	The policy itself - the central document that has to be made available to personnel and higher-risk business associates.
PP-1-19 Anti-bribery Procedure	Sets out internal communication routes including how concerns can be raised and to whom.
F-IMS35 Business Associate Register	Identifies which business associates the policy needs to be communicated to and records the communication.

Note - all the above files can be downloaded with an alphaZ subscription.

Frequently Asked Questions

Does Clause 7.4 require documented information?

The clause itself does not require specific documented information for the determination of communications. But evidence is usually captured in a communications table or in the IMS1 manual. The policy distribution records (who received it, when) are typically retained as part of evidencing 7.4.2.

How many languages does the policy need to be available in?

As many as are appropriate to the audience. There is no fixed number. An organisation operating only in the UK may only need English. An organisation with operations or business associates in Spanish-speaking, French-speaking or Arabic-speaking regions needs the policy available in those languages where the audience materially needs it.

Does every business associate need a copy of the policy?

No. The clause requires communication to personnel and business associates where there is more than a low bribery risk. Lower-risk associates do not need direct policy distribution. The higher-risk associates identified in the business associate register are the ones who need direct communication.

UK Legislation

The following UK legislation creates obligations that are typically reflected in ABMS communications - to staff, to suppliers and to customers.

Further Resources