ISO 37001:2016 - Supplementary Appendix

Supplementary appendix to the

Rules for the Certification of Management Systems

Standard: ISO 37001

Edition: May 2025

Supplementary appendix – Reference standard: ISO 37001

Edition: May 2025

CHAPTER 1 GENERAL

These Rules define the additional and/or substitutive procedures applied by RINA for the certification of Anti-

bribery Management Systems in relation to what is already defined in the Document General Rules for the

Certification of Management Systems RC/40.

RINA issues certification in accordance with the requirements of the ISO/IEC 17021-1:2015 Standard to

organizations whose Management System has been recognized as fully conforming to all the requirements of

the Standard:

ISO 37001:2016

ISO 37001certification may be requested by any type of organization, of any size and/or nature.

The certification is issued to a single legal entity and includes all the sites, branches, secondary offices, activities

and processes actually carried out by the organization.

There is no possibility of exclusion for any site or process within the same Country.

It is possible, however, to limit the application to specific countries, but the scope must always include sensitive

processes and activities carried out abroad when carried out under the responsibility and direct control of the

organization (eg representative offices or secondary offices brokers).

In any case, it may however be necessary to evaluate some aspects related to the Head Office, despite not

being included in the scope of the certificate.

CHAPTER 2 - REFERENCE STANDARD / CERTIFICATION REQUIREMENTS

In addition to what is already defined in the Document General Rules for the Certification of Management

Systems RC/C 40, to obtain certification by RINA, an Anti-bribery Management System must initially and over

time satisfy the requirements of the ISO 37001: 2016 Standard and the additional ones provided by the

Accreditation Bodies for the ISO 37001 scheme.

To be fully operational, an Anti-Bribery Management System, as well as complying with what is stated in the

Document General Rules for the Certification of Management Systems RC/C 40, is to ensure that:

• The dimension, structure and authorities of the organization have been determined;

• The context in which the organization operates has been determined;

• The nature, size and complexity of the activities carried out by the organization have been determined;

• The business line of the organization have been determined;

• the relevant interested parties for the Anti-bribery Management System, and their requirements, have

Supplementary appendix to the

Rules for the Certification of Management Systems

Standard: ISO 37001

Edition: May 2025

been determined;

• The subjects over which the organization has control and the entities exercising control over the

organization;

• The business partners of the organization have been determined;

• The nature and extent of the organization’s relationship with public officials has been determined;

• The applicable legal, regulation, contractual and professional obligations and duties have been

determined;

• The Antibribery Risk Assessment has been carried out on all processes and activities.

The Organization shall be in possess of a document in which its scope is determined, by considering the

requirements indicated at paragraphs 4.1, 4.2 and 4.5 of standard ISO 37001:2016 and the documented

information as after paragraph 7.5 of the reference standard.

CHAPTER 3 - INITIAL CERTIFICATION

In addition to what is indicated at paragraph 3.1 of the Document General Rules for the Certification of

Management Systems RC/C 40, the organization shall provide to RINA information related to:

• Antibribery risk assessment carried out, highlighting the sensitive processes carried out at each site subject

to certification and the relevant number of employees involved;

• Application of measures for preventing and controlling the risks of bribery;

• Detalis related to the turnouts, in case of reception of contribution, compensations or public funds;

• Reception from Public Entities or Public Companies or International Organization any kind of

compensation or retribution, including those coming from the subscription of public contracts;

• Involvement in the last 5 years in at least one judicial proceeding for corruption phenomena;

• Participation to national or international tenders;

• Possession of the requirements of a public law body;

• Quotation on the Stock Market, if any.

The above documentation is analyzed by RINA in order to verify if it’s compliant to the standard and the

requirements of these Regulations.

CHAPTER 4 - MAINTENANCE OF CERTIFICATION

The requirements of the RINA Rules for the certification of management systems (RC/C 40) apply.

Supplementary appendix to the

Rules for the Certification of Management Systems

Standard: ISO 37001

Edition: May 2025

CHAPTER 5 – RECERTIFICATION

The requirements of the RINA Rules for the certification of management systems (RC/C 40) apply.

CHAPTER 6 - CONDUCTION OF AUDITS

The requirements of the RINA Rules for the certification of management systems (RC/C 40) apply.

CHAPTER 7 - MANAGEMENT OF CERTIFICATES OF CONFORMITY

The requirements of the RINA Rules for the certification of management systems (RC/C 40) apply.

CHAPTER 8 - MODIFICATION OF CERTIFICATION AND COMMUNICATION OF CHANGES

In addition to what indicated on the General Rules for the Certification of Management Systems RC/40 and the

provisions of the “GENERAL CONTRACT CONDITIONS FOR CONFORMITY ASSESSMENT ACTIVITIES”, an

organization which is certified or under certification shall timely inform RINA of any critical situation in which it is

involved that may compromise the guarantee of the management system certification (e.g. scandals, crisis of

involvement in any legal process for bribery or similar situations).

In the same way, the organization shall timely inform the CB of any event related to bribery events that may

have involved one or more of its Human Resources, and the consequent actions undertaken to contain the

effect of that event, the root-cause analysis and the related corrective actions.

RINA, after these notifications, should they come directly from the organization or from any other source, will

carry out the necessary verifications and specific detailed studies and will be able to adopt the related

measures such as: filing of the notification, financial penalties, strengthening of the inspection activities,

determined after the adequacy of the response and the strategies adopted by the organization.

CHAPTER 9 - SPECIAL REQUIREMENTS FOR MULTI-SITE ORGANISATIONS

The requirements of the RINA Rules for the certification of management systems (RC/C 40) apply.

CHAPTER 10 - TRANSFER OF ACCREDITED CERTIFICATES

The requirements of the RINA Rules for the certification of management systems (RC/C 40) apply.

CHAPTER 11 - SUSPENSION, REINSTATEMENT AND WITHDRAWAL OF CERTIFICATION

The requirements of the RINA Rules for the certification of management systems (RC/C 40) and of the

“GENERAL CONTRACT CONDITIONS FOR CONFORMITY ASSESSMENT ACTIVITIES” apply.

CHAPTER 12 - RENUNCIATION OF CERTIFICATION

The requirements of the RINA Rules for the certification of management systems (RC/C 40) apply.

CHAPTER 13 - CONTRACTUAL CONDITIONS

The requirements of the RINA Rules for the certification of management systems (RC/C 40) and of the

“GENERAL CONTRACT CONDITIONS FOR CONFORMITY ASSESSMENT ACTIVITIES” apply.

FAQs of ISO 37001:2016 – Supplementary appendix

What are the key requirements for ISO 37001:2016 certification?

ISO 37001:2016 certification requires organizations to establish an Anti-Bribery Management System that meets specific criteria. These include conducting a thorough anti-bribery risk assessment, defining the organization's structure and context, and ensuring compliance with applicable legal and regulatory obligations. Organizations must also implement measures to prevent and control bribery risks and maintain documentation of their processes. Continuous monitoring and improvement of the management system are essential for maintaining certification.

How does the ISO 37001:2016 appendix assist organizations?

The ISO 37001:2016 appendix provides organizations with detailed guidelines and procedures for achieving certification in anti-bribery management. It outlines the steps necessary for conducting risk assessments, identifying sensitive processes, and ensuring compliance with legal obligations. This resource is particularly beneficial for compliance officers and management teams, as it highlights the importance of transparency and accountability in organizational practices. By following these guidelines, organizations can effectively mitigate bribery risks and enhance their ethical standards.

What is the significance of conducting an Anti-Bribery Risk Assessment?

Conducting an Anti-Bribery Risk Assessment is crucial for identifying potential vulnerabilities within an organization's processes and activities. This assessment helps organizations understand the nature and extent of their exposure to bribery risks, particularly in dealings with public officials and business partners. By evaluating these risks, organizations can implement targeted measures to prevent bribery and ensure compliance with ISO 37001:2016 standards. This proactive approach not only protects the organization from legal repercussions but also enhances its reputation and trustworthiness in the marketplace.

What types of organizations can apply for ISO 37001:2016 certification?

ISO 37001:2016 certification can be requested by any type of organization, regardless of size or nature. This includes private companies, public sector entities, non-profit organizations, and multinational corporations. The certification process is designed to be inclusive, ensuring that all organizations can implement effective anti-bribery measures tailored to their specific contexts and operational environments. By obtaining this certification, organizations demonstrate their commitment to ethical business practices and compliance with international standards.

ISO 37001:2016 – Supplementary appendix

Key Points

FAQs of ISO 37001:2016 – Supplementary appendix

Related of ISO 37001:2016 – Supplementary appendix