Thinking about certifying? Send IAS the outline of your business — entities, offices, service lines and introducer network — and ask for a scope discussion. Start at contact us, or read the certification process first.
- Certification issued by IAS under UQAS accreditation
- Two-stage initial audit, then annual surveillance
- Auditors read your onboarding and commission files
- Lead auditor and internal auditor training with EAS
Most bribery risk in a financial or professional services firm does not look like bribery. It looks like a fee. Someone introduces a client. The firm pays a share of the revenue for the introduction. The paperwork is thin, the introducer is a company nobody has met, and the payment leaves every quarter without a second look. That arrangement may be entirely clean. It may also be the route by which money reaches the person who decided your firm would win the mandate.
ISO 37001 is the international standard that sets out what an anti-bribery management system, or ABMS, has to contain. It sets out what an organisation needs in place to prevent, detect and respond to bribery. This page explains what the standard asks of a firm that earns fees — advisory, legal, insurance, asset management, brokerage, corporate services — and what an audit team will open when it arrives. For general background, try the what is ISO certification explainer.
What does ISO 37001 ask for, and which four directions does it cover?
The standard is built around a management system, not a policy document. You assess your bribery risk, set controls proportionate to that risk, check the controls work, and fix them when they don't.
The current edition is ISO 37001:2025, published in February 2025, replacing ISO 37001:2016. Certificates issued against the 2016 edition run out of road on 28 February 2027. Any firm holding one needs a transition plan now, not in the final quarter.
ISO 37001 addresses bribery in four directions, and a fee-earning business is exposed in all of them:
- By the organisation itself — a payment from firm funds to secure a mandate.
- By your own personnel acting for the firm, including partners and relationship managers carrying revenue targets.
- By business associates acting on your behalf. For a professional firm this is the big one: introducers, agents, correspondents, sub-advisers, local partners, outsourced providers.
- At the organisation — someone offering an inducement to your staff. A client offering a private benefit for a favourable valuation, or for a faster onboarding decision.
The requirement areas follow from that. A documented bribery risk assessment. An anti-bribery policy. An anti-bribery function with real authority and independence. Leadership and culture. Due diligence on transactions, projects, personnel and business associates. Financial and non-financial controls. Rules and records for gifts, hospitality and donations. A route for raising concerns, with protection for whoever uses it. An investigation process. Role-appropriate training, including conflicts of interest. Monitoring, internal audit and management review.
Who is asking your firm for ISO 37001 certification in Bahrain?
Nobody certifies for pleasure. A request for ISO 37001 certification in Bahrain usually arrives from one of a handful of commercial directions, and it is worth being honest about which applies, because it shapes the scope.
A parent company decides its subsidiaries will all hold the certificate, and gives you a date. An institutional client puts anti-bribery controls into its supplier questionnaire and scores your answer. A tender lists a certified ABMS as a condition or a weighted criterion. A counterparty in another market wants comfort before routing business through you. A prospective joint venture partner asks how you handle introducers before signing.
Those are commercial pressures — buyers, partners, parent companies, tender panels. This page claims nothing beyond that, and you should treat any page that does with suspicion.
The practical consequence is that scope matters more than the certificate. If the group wants the Bahrain entity covered, the audit will examine how that entity accepts clients and pays introducers. Certifying a back-office function and hoping the certificate reads as firm-wide wastes the fee. Standards you may already hold — ISO 9001, ISO 27001, ISO 22301 — share the same clause skeleton, which shortens the documentation work.
Where does the risk sit with introducers, referrals and commissions?
If an auditor has one hour with your firm, this is where the hour goes. An introducer arrangement combines the three things that make a risk assessment nervous: a third party acting in your commercial interest, a payment that scales with what they win, and limited visibility of what they actually did.
Clause 8 expects due diligence on business associates, proportionate to the risk they carry. For introducers that means answering plain questions and keeping the answers on file:
- Who owns and controls the introducer? Not the name on the invoice — the people behind it.
- Is anyone connected to the introducer also connected to the client introduced, or to the decision to appoint you?
- What are they paid, on what basis, and is the rate defensible against what the market pays?
- What did they actually do? A services description reading "business development support" and nothing else will not survive stage two.
- Who approved the arrangement, and was that person independent of the revenue it produces?
Commission structures deserve their own look. A flat introduction fee is easier to defend than an open-ended share of client revenue for the life of the relationship. Success fees payable only on award carry more risk than retainers. Payments to a jurisdiction unconnected with the introducer's stated place of business are a standing question mark. None of this is prohibited. The standard asks you to identify the risk, apply a matching control, and show you did both.
The failure mode auditors see most is a firm with good policy language about third parties and a spreadsheet of introducer payments nobody has reconciled to a signed agreement. The policy is not the control. The reconciliation is.
How do client acceptance, fee structures and hospitality come into it?
Client and counterparty acceptance is the mirror image. You are deciding whether to take a relationship on, and the standard wants that decision to include bribery risk, not only credit risk and reputational feel.
A workable acceptance process covers a few points. Beneficial ownership, identified rather than asserted. The source of the mandate — who brought it and what they were paid. Whether the engagement involves acting for the client in front of a third party that awards contracts. Whether the fee arrangement itself creates an incentive to influence an outcome. And a clear rule for when the decision escalates away from the person who owns the relationship.
That last point causes the most argument. Relationship managers are measured on revenue. If they also sign off the bribery risk of their own clients, the control has no independence. The 2025 edition answers this by stating the anti-bribery function's role and independence more clearly, with authority to say no and access to the top of the house.
Gifts, hospitality and donations run on the same logic. The risk in professional services is rarely a cash payment. It is a season of corporate box tickets for the person who renews your mandate, a conference invitation with a companion flight attached, or a donation to a cause a client's chairman happens to chair. ISO 37001 does not ban hospitality. It requires thresholds, approval and — the part firms forget — a register that is genuinely kept. An empty gifts register in a firm with a busy entertainment budget tells an auditor exactly one thing.
What did the 2025 edition change, and what should you do about it?
The 2025 edition is a tidy-up with a handful of substantive additions, several landing squarely on fee-earning firms.
| Change in ISO 37001:2025 | What a fee-earning firm should do about it |
|---|---|
| Harmonized common ISO structure applied throughout | Re-map existing documents to the new clause numbering before the audit, not during it |
| "Stakeholders" replaced by "interested parties" | A terminology sweep across policy, procedures and training slides; no change of substance |
| Clauses 4.1 and 4.2 require climate change to be considered | Record the consideration and its conclusion honestly; for most advisory firms it is brief, but it must exist |
| Clause 5.1.3 makes anti-bribery culture an explicit requirement | Show what leadership actually does — how fee-earners are challenged, what happens to someone who hits target the wrong way |
| Clause 7.2.2 adds conflict-of-interest awareness to employment processes | Build conflicts declarations into hiring, promotion and the annual review, and keep the records |
| The anti-bribery function's role and independence stated more clearly | Write down who holds the function, what they may block, and who they report to |
| Clause 8.4 adds mergers and acquisitions as a non-financial control area | Put bribery due diligence into the acquisition checklist, including books of business and adviser teams bought in |
| Clause 10 reordered: continual improvement 10.1, nonconformity and corrective action 10.2 | Update internal audit and management review templates to follow the new order |
Clause 8.4 deserves a line on its own. Professional firms grow by acquiring teams and client books. When you buy a book of business, you buy its introducer arrangements and its past acceptance decisions with it.
Which controls hold the risk areas in a fee-earning firm?
This is not a checklist to copy. It is the shape of the risk assessment an auditor expects you to have done for yourself, with your own ratings and evidence.
| Risk area | Control the standard expects | Evidence an auditor asks for |
|---|---|---|
| Introducer and referral payments | Risk-based due diligence, written agreement, defined services, independent approval | Signed agreements, ownership checks, payment reconciliation, approvals |
| Client and counterparty acceptance | Bribery risk considered at acceptance, escalation away from the fee owner | Acceptance files, escalation log, decisions to decline |
| Success and contingent fees | Assessment of whether the structure creates an incentive to influence | Fee approval records, exceptions register |
| Gifts and hospitality | Thresholds, prior approval above them, maintained register | The register itself, approvals, sample tested against expense claims |
| Charitable and community donations | Rules on recipients, checks on connections to clients or decision-makers | Donation approvals, due diligence notes |
| Hiring and promotion | Conflict-of-interest awareness in employment processes (7.2.2) | Declarations at hire, screening for higher-risk roles, training records |
| Acquisitions and team lift-outs | Bribery due diligence as a non-financial control (8.4) | Deal checklists, findings, post-completion actions |
| Raising concerns | A usable channel plus protection for the person who uses it | Procedure, evidence it is reachable, case handling records |
| Investigations | A defined process owned independently of the business line | Investigation procedure, closed case files, outcomes |
| Oversight | Monitoring, internal audit and management review | Audit programme, findings, minuted review with decisions |
The third column catches firms out. Almost everyone can produce a procedure. Fewer can produce the record showing the procedure ran on a real transaction last quarter.
What does the certificate not say about your firm?
Settle this internally before a client asks. A certificate does not prove that bribery has not happened at your firm, and it does not promise that none will happen. The standard says as much about itself. What certification supports is a reasonable claim that you run a management system designed to prevent, detect and respond to bribery, and that an independent team examined it against published requirements and found it conforming.
A client who reads the certificate as a warranty of clean hands has misread it, and a firm that encourages the misreading is storing up a problem. The honest sentence is short: we run a certified anti-bribery management system, here is its scope, here is who audited it. Rules on using the mark sit in the logo usage guideline.
How does the audit cycle run, from application to recertification?
Application and scope. You describe the entities, sites, service lines and headcount to be covered, and the wording is agreed in writing. A scope omitting your introducer-driven business line makes the certificate far less useful in a tender.
Stage one. A documentation and readiness review. The team checks your risk assessment, policy, function, controls and internal audit programme exist and connect to each other. Stage one commonly produces findings. That is its job.
Stage two. The implementation audit — sampling, interviews and record testing across the scope. Expect fee-earners to be interviewed, not only compliance staff, and expect the team to trace a live introducer payment from agreement to bank.
Certification decision. Made independently of the audit team, once nonconformities are closed. IAS then issues the certificate under its UQAS accreditation.
Surveillance. Annual visits confirm the system still runs. Registers, training records, concerns raised and review minutes are standing items.
Recertification. A fuller audit before expiry, covering the whole system again.
The mechanics are set out in the ISO audit procedure and system certification pages. Issued certificates can be checked through the IAS certification search.
Where do firms lose time on ISO 37001 certification in Bahrain?
Delays on ISO 37001 certification in Bahrain are rarely caused by the audit. They are caused by work the firm could have finished months earlier. The recurring ones in professional services:
Introducer agreements that don't exist. Long-standing arrangements running on a handshake and an email from 2019. Papering them takes weeks, because the counterparty must now agree terms it never signed.
A risk assessment written by someone with no view of the client book. If it lists procurement corruption and never mentions referral fees, it came from a template. Auditors notice immediately.
An anti-bribery function reporting to the person who owns revenue. This fails the independence requirement, and fixing it means changing reporting lines, which means a partner conversation.
Registers started for the audit. A hospitality register whose first entry is six weeks old, in a firm with a decade of client entertainment, is not evidence of a control.
Internal audit not yet run. Internal audit and management review are required before certification, yet firms book stage two before either has happened. Training someone early avoids it — see internal auditor training.
Payment data nobody can extract. You will be asked for all introducer payments in a period, reconciled to agreements. If finance cannot produce that list, build it now.
What drives the cost and the calendar?
IAS quotes on what has to be audited, so the honest answer is that the number depends on your firm rather than a price list. The factors are predictable.
Headcount, and how much of it is client-facing. The number of legal entities and locations. How many service lines you run, since each carries its own fee model. The size and geography of your introducer network — usually the single biggest driver for a professional firm. Whether you already hold other certified systems, since shared clauses cut duplicated effort. Whether you are transitioning a 2016 certificate or starting fresh.
Timing follows the same logic. A firm with clean documentation, a finished risk assessment, a live register and one completed internal audit moves quickly. A firm still tracing three years of commission payments does not. For a quotation, use contact us and give the entity structure up front.
Which training does your team need?
Training is delivered by IAS together with EAS, under the same UQAS accreditation, which covers training schemes alongside certification.
Internal auditor training equips someone in your firm to run the internal audit programme the standard requires. Pick a person who can read an engagement file and a commission schedule, not only a procedure. Lead auditor training goes further, covering audit planning, team leadership and reporting, and suits the compliance or risk head who will own the system. See lead auditor training, the wider ISO training listing, or the EAS online course platform for remote delivery.
Two things to hold on to. The team that trains is kept separate from the team that audits; that separation is an impartiality requirement, and it means your trainer cannot smooth your audit. And training is not certification — sending four people on a course does not certify your firm.
Why is your firm certified rather than accredited?
IAS is the certification body. Its accreditation is held with UQAS and applies to IAS, covering its competence and impartiality as a certifier. When the certificate issues, your firm becomes certified. It does not become accredited. That is not pedantry — "accredited to ISO 37001" in a tender response is an error a well-briefed procurement team will spot.
Background sits on the accreditation page for this section, with further detail at IAS accreditation and about IAS.
How this page was checked
This page was written against the published requirements of ISO 37001:2025 and the certification process IAS operates. Facts about the standard — edition date, transition deadline, clause changes, the four directions of bribery, the requirement areas — come from the standard itself and are stated in plain terms rather than quoted.
No part of this page addresses legal requirements. Nothing here says or implies that ISO 37001 is required by any statute, decree, regulator, ministry or government body in Bahrain, and no such body is named. Every reason given for certifying is commercial: a client asked, a tender scored it, a parent mandated it, a counterparty wanted comfort. If your firm needs a legal position on anti-bribery obligations, take that from a qualified adviser.
No prices, audit durations, client counts, case studies or credentials appear here, because those depend on scope and would be invented if quoted.
Your next step
If you are being asked for ISO 37001 certification in Bahrain, do three things before requesting a quotation. Write down the scope you actually need — entities, offices, service lines. Pull a complete list of introducer and referral arrangements with what each was paid last year. Identify who will hold the anti-bribery function, and confirm they are independent of the revenue.
With those in hand, a scoping conversation takes minutes rather than weeks. Reach IAS through contact us, or browse the wider ISO certification range.
Get a scope and a quotation. Send your entity structure, service lines and introducer list to IAS and ask for an ISO 37001 audit plan — contact the team or review the certification process.
Frequently asked questions
Does ISO 37001 certification prove our firm has never paid a bribe?
No, and don't present it that way. It supports a claim that you have a designed, audited anti-bribery management system. It says nothing about whether an incident has occurred or will.
Do we have to stop paying introducer commissions to certify?
No. The standard does not prohibit introducer arrangements. It requires you to assess their bribery risk, apply proportionate due diligence and controls, document the services paid for, and keep records someone independent can check.
How far back will auditors look at our referral payments?
Sampling depends on scope and risk, and the audit team sets it. Assume they will trace live arrangements end to end: agreement, services described, approval, invoice, payment. Prepare to produce that trail on request.
Our relationship partners approve their own client acceptance. Is that a problem?
Usually yes. Where the person benefiting from the revenue also clears the bribery risk, the control lacks independence. The 2025 edition is explicit about the anti-bribery function's authority, so expect this to be tested.
Are success fees and contingent fees acceptable?
They are not banned. They do carry a higher inherent risk of creating an incentive to influence a decision, so assess them, control them, and record why each structure is acceptable.
We're buying a small advisory practice. Does that touch the standard?
It does. Clause 8.4 adds mergers and acquisitions as a non-financial control area. Bribery due diligence belongs in the deal checklist, covering the target's introducer arrangements and acceptance history.
Can we certify only the Bahrain entity if the group is larger?
Yes. Scope is agreed at application and stated on the certificate. Make sure it covers the activity clients care about — usually the client-facing business, not a support function.
Is ISO 37001 certification in Bahrain a legal requirement?
This page makes no claim about local law and names no authority. The reasons firms certify here are commercial: client questionnaires, tender criteria, group policy, counterparty expectations.