Support for ISO 37001 Anti-Bribery
ISO 37001 Clause 7
- Resources, competence and training for anti-bribery
- Worker awareness of bribery risks and reporting routes
- Documented information that runs the anti-bribery system
ISO 37001 Clause 7 - Support
Clause 7 covers the support elements that make the ABMS workable. The clause has five parts. 7.1 requires resources to be provided. 7.2 covers competence including a detailed sub-clause on the employment process. 7.3 covers awareness and training, with two new sub-clauses added in 2025 for training of business associates and structured awareness programmes. 7.4 covers communication. 7.5 covers documented information.
Sub-clauses Covered by Clause 7
Clause 7.1 - Resources requires the organisation to determine and provide resources for the ABMS. The clause is short and high-level.
Clause 7.2 - Competence covers general competence (7.2.1) and the detailed employment process requirements (7.2.2) including conditions of employment, induction, due diligence on people in higher-risk roles and periodic compliance declarations.
Clause 7.3 - Awareness covers awareness for personnel (7.3.1) and training for personnel (7.3.2). The 2025 revision added 7.3.3 requiring training for business associates that pose more than a low bribery risk and act on behalf of the organisation, plus 7.3.4 requiring structured awareness and training programmes from the start of employment and at planned intervals.
Clause 7.4 - Communication covers internal and external communication relevant to the ABMS, including the requirement that the policy is made available in appropriate languages.
Clause 7.5 - Documented Information covers what documents must exist, how they are created and updated, and how they are controlled.
Clause 7 is where the system either becomes real or stays on paper. Staff who have been trained, business associates who know the rules, documents that are controlled and current - that is what makes the ABMS something the auditor can actually see working.
I spend a lot of audit time on Clause 7. Training records, induction records, declarations from people in higher-risk roles, business associate communications. The documents tell me whether the rest of the system is alive. A good policy with no training behind it is a non-conformity waiting to happen.
