As demands for transparent and accountable business governance intensify across Southeast Asia, one international standard has emerged as the leading benchmark: ISO 37001 — the Anti-Bribery Management System (ABMS) standard. For organizations in Indonesia looking to strengthen credibility, win high-value contracts, or meet the requirements of international business partners, implementing and certifying to ISO 37001 has become a strategic imperative.
This article covers everything you need to know: what ISO 37001 is, why it is increasingly relevant in Indonesia, how the implementation process works, and what measurable benefits your organization can expect.
What Is ISO 37001? Understanding the Anti-Bribery Management System Standard
ISO 37001 is an international standard that specifies requirements and provides guidance for establishing, implementing, maintaining, reviewing, and improving an Anti-Bribery Management System (ABMS). First published in 2016 by the International Organization for Standardization (ISO), it has been updated to ISO 37001:2025, incorporating the latest developments in anti-corruption governance.
In Indonesia, the standard has been formally adopted by the National Standardization Body (BSN) as SNI ISO 37001, giving it official status as an Indonesian National Standard.
Unlike a declarative anti-corruption policy, ISO 37001 requires a systematic, documented, and auditable approach — meaning your organization's anti-bribery commitment can be independently verified by an accredited third party, not just declared internally.
Scope and Key Requirements of ISO 37001
ISO 37001 applies to all types of organizations — public, private, and non-profit — regardless of size or industry. The standard covers requirements across several critical areas:
1. Leadership Commitment
Top management must demonstrate genuine, active commitment to the anti-bribery management system. This goes beyond signing a policy document — it requires direct involvement in setting policy direction, allocating adequate resources, and actively monitoring the effectiveness of the ABMS.
2. Bribery Risk Assessment
Organizations must identify and evaluate bribery risks thoroughly — covering which business functions are most exposed (procurement, sales, third-party payments, licensing, etc.), which jurisdictions carry higher risk, and what transaction characteristics increase exposure. This risk assessment forms the foundation for all subsequent controls.
3. Third-Party Due Diligence
One of the most important requirements in ISO 37001 is the conduct of due diligence on business partners, agents, distributors, consultants, and other third parties who interact with government officials or operate in high-risk contexts. This includes background checks, risk scoring, and ongoing monitoring — not a one-time exercise.
4. Anti-Bribery Financial Controls
ISO 37001 requires financial controls specifically designed to prevent bribery: payment approval workflows, cash transaction limits, controls on facilitation payments, and audit procedures covering high-risk expenditures such as gifts, hospitality, and third-party commissions.
5. Reporting and Investigation Mechanisms
Organizations must maintain secure, trustworthy reporting channels — including whistleblowing mechanisms that protect reporters from retaliation. Independent, documented investigation procedures are a mandatory requirement, not optional additions to the system.
6. Training and Awareness
All personnel associated with bribery risk — from procurement staff and sales teams to senior management — must receive adequate, documented anti-bribery training. Training records must be maintained as evidence of the organization's commitment.
7. Internal ABMS Audit
The anti-bribery management system must be audited internally on a regular basis by competent, independent internal auditors — to verify system effectiveness and compliance with the standard's requirements before and between external certification audits.
Why ISO 37001 Is Increasingly Relevant in Indonesia
Several Indonesia-specific factors are driving the accelerating adoption of ISO 37001:
State-Owned Enterprises Leading the Way
Indonesia's largest state-owned enterprises have taken the lead in adopting ISO 37001. Among them:
- PT Pertamina Hulu Indonesia — has implemented SNI ISO 37001:2016 as part of its corporate anti-bribery commitment
- PGN (Perusahaan Gas Negara) — actively expanding its ISO 37001-based Anti-Bribery Management System scope
- BNI — strengthening corporate governance and anti-bribery systems as part of its Asta Cita program
- WIKA Beton — implementing ISO 37001:2025 as an ABMS enhancement
- BPK (Supreme Audit Board) — committed to ISO 37001:2016 certification with full leadership support
This movement by state-owned enterprises creates real supply chain pressure: vendors, suppliers, and business partners of these organizations are increasingly expected to demonstrate equivalent governance standards.
Requirements from International Investors and Business Partners
Foreign investors, international financial institutions, and global business partners now routinely include anti-bribery verification as a standard element of their due diligence process. ISO 37001 certification from an accredited body provides independent evidence that is significantly more credible than self-declarations or internal company audits.
Alignment with Anti-Corruption Regulations
Indonesia has a range of relevant anti-corruption regulations — from the Corruption Eradication Law to sector-specific requirements. While ISO 37001 is not a universal legal mandate, its implementation demonstrates clear alignment with the spirit of these regulations and can serve as a meaningful mitigating factor in legal proceedings.
Growing ESG Governance Requirements
ISO 37001 certification directly strengthens the Governance pillar in the ESG (Environmental, Social, Governance) framework. As investor, regulatory, and consumer expectations for corporate governance standards continue to rise, having a certified anti-bribery management system has become a measurable competitive differentiator.
ISO 37001 Implementation and Certification Process
Achieving ISO 37001 certification follows a structured journey. Here are the typical stages organizations go through:
| Stage | Key Activities | Output |
|---|---|---|
| 1. Gap Analysis | Assess current anti-bribery practices against ISO 37001 requirements | Gap report & action plan |
| 2. ABMS Planning | Define scope, policy, and governance structure | Anti-bribery policy & ABMS framework |
| 3. Risk Assessment | Identify & evaluate bribery risks across all business processes | Bribery risk register |
| 4. Control Implementation | Deploy procedures, financial controls, due diligence, reporting mechanisms | Documented controls & procedures |
| 5. Personnel Training | Anti-bribery training for all relevant functions | Documented training records |
| 6. Internal Audit | Independent assessment of ABMS effectiveness by trained internal auditors | Internal audit report & findings |
| 7. Management Review | Leadership review of ABMS performance & improvement decisions | Management review minutes |
| 8. Certification Audit | Audit by accredited certification body (Stage 1 + Stage 2) | ISO 37001 Certificate |
For mid-sized organizations, the full process from gap analysis to certificate typically takes 6–12 months, depending on the maturity of existing governance practices and the complexity of business operations.
Who Needs to Be Involved in ISO 37001 Implementation?
ISO 37001 is not just a compliance team responsibility — it requires cross-functional involvement across the organization:
- Top Management — set policy direction, demonstrate commitment, provide resources
- Compliance Officer / Anti-Bribery Function — manage and monitor the ABMS on an ongoing basis
- Legal Team — ensure alignment with applicable regulations and support investigations
- Procurement Team — apply due diligence to vendors, contractors, and third parties
- Finance & Accounting Team — manage anti-bribery financial controls and approval workflows
- Sales & Business Development — understand boundaries in interactions with public officials and clients
- HR & People Development — ensure anti-bribery training is delivered and documented across the organization
- Internal Auditors — conduct regular ABMS audits and support continuous improvement
Measurable Benefits of ISO 37001 Certification
Investment in ISO 37001 implementation and certification delivers tangible, measurable benefits for organizations:
Competitive Advantage in Tenders and Procurement
An increasing number of government tenders and large corporate contracts require demonstrated anti-bribery governance. ISO 37001 certification provides a directly measurable competitive advantage in vendor selection and business partner evaluation processes.
Reputational and Legal Protection
If bribery allegations or investigations arise, comprehensive documentation of ISO 37001 implementation can serve as significant evidence of good faith — demonstrating that your organization took systematic, reasonable steps to prevent bribery rather than allowing it to occur.
Trust from Investors and Business Partners
An ISO 37001 certificate from an accredited certification body is an independently verifiable statement of governance quality. It builds confidence with foreign investors, international financing institutions, and strategic partners who prioritize anti-corruption standards in their due diligence and partnership decisions.
A Healthier Organizational Culture
Well-implemented anti-bribery management does not just produce paperwork — it transforms how organizations operate. Transparency, accountability, and integrity become embedded in daily working practices, not just values written on office walls.
ISO 37001 vs. A Standard Internal Anti-Corruption Policy
| Aspect | Standard Internal Policy | ISO 37001 Certified ABMS |
|---|---|---|
| Basis | Declarative policy document | Structured system with measurable requirements |
| Verification | Self-declaration only | Independent audit by accredited body |
| Risk assessment | Ad-hoc or absent | Systematic, documented, and periodic |
| Third-party due diligence | Inconsistent | Mandatory procedure for all at-risk partners |
| Training | May exist, not standardized | Mandatory, documented, and periodic |
| Value to clients/investors | Limited | Internationally recognized |
Frequently Asked Questions about ISO 37001
Is ISO 37001 legally mandatory in Indonesia?
ISO 37001 is not currently a universal legal requirement. However, across multiple sectors — particularly state-owned enterprises, construction, and government procurement — the standard is increasingly becoming a de facto requirement. This trend is expected to continue strengthening.
Is ISO 37001 suitable for small and medium businesses?
Yes. The standard is inherently scalable — the scope and complexity of implementation are adjusted to match the organization's size and context. SMEs supplying to state-owned enterprises or international clients can be especially well-positioned to benefit from certification.
How long is an ISO 37001 certificate valid?
The certificate is valid for 3 years, with annual surveillance audits to confirm the system remains effective and maintained. A full recertification audit takes place in the third year.
Does having ISO 9001 make ISO 37001 implementation easier?
Yes — ISO 37001 uses the same High Level Structure (HLS) as other ISO management system standards. Organizations familiar with ISO 9001 or ISO 14001 will find many parallel elements in documentation, internal auditing, and management review — although the anti-bribery-specific content remains unique to ISO 37001.
How different is ISO 37001:2025 from the 2016 version?
ISO 37001:2025 is an update that retains the foundational framework of the 2016 standard while aligning it with the latest developments in anti-bribery governance. Organizations certified to ISO 37001:2016 will need to transition within the defined transition period.
Ready to Implement ISO 37001 in Your Organization?
Arafar Nusa supports Indonesian organizations through the full ISO 37001 implementation and certification journey — from gap analysis and ABMS design, to internal audit training and certification audit preparation with an accredited certification body.
Contact via WhatsApp