Anti-Bribery Risk Assessment and Gifts Register (ISO 37001)

A practical kit for organisations building or checking an anti-bribery management system in line with ISO 37001. The checklist tells you which controls to look for and why each one matters; the registers give you somewhere to record the bribery risk assessment, gifts and hospitality, conflicts of interest and due diligence that those controls depend on.

What is inside

ISO 37001 Anti-Bribery System Checklist — 75 controls in nine sections, from leadership and policy to monitoring and review, each with a short explanation of why it matters and In place / Partial / Missing boxes.

Anti-Bribery Registers and Forms — a bribery risk rating guide, a bribery risk assessment register with two worked examples, a gifts and hospitality register, a conflict of interest declaration log and a due diligence record for business associates.

Both documents as a designed, print-ready PDF and as an editable Word file.

Who it is for

Compliance officers, company secretaries, legal and internal audit teams, quality and IMS managers asked to add anti-bribery to their system, consultants, and owners of businesses that use agents, bid for contracts or deal with public officials.

How to use it

Begin with the bribery risk assessment, because ISO 37001 scales many of its controls to the level of risk: where the risk is more than low you need due diligence, tighter approvals and deeper training. Then work through the checklist with the people who run sales, procurement, finance and logistics, marking each control and noting the evidence. Put the registers into use straight away — a gifts register with nothing in it after six months usually means people are not using it, not that nothing was given or received.

ISO 37001 has been revised, so check which edition of ISO 37001 applies to you; this kit does not quote clause numbers for that reason. It names no laws: check the anti-bribery legal requirements that apply to you in every country where you operate. Using these documents does not make an organisation compliant or certified.