Working through agents, clearers and local partners? That is exactly the situation ISO 37001 was designed for. Talk to IAS about scoping an audit around the parts of your operation you cannot watch directly.
Most organisations that ask us about ISO 37001 certification in Iraq are not worried about their own head office. They are worried about the twelve or fifteen other companies that move their cargo, clear their paperwork, guard their sites and hire their day labour. Those companies sit outside the org chart. They are not on the payroll, they never attend the induction, and nobody from finance has visited their office.
That is the honest starting point. You are being asked — usually by a buyer, a parent company, a lender or a tender committee — to demonstrate control over conduct you cannot supervise in person. ISO 37001 gives you a structured way to do that. It does not give you certainty, and it never claimed to.
- Certification issued by IAS under UQAS accreditation
- Current edition ISO 37001:2025
- Scope built around your intermediary chain
- Training delivered separately by EAS
Why is ISO 37001 certification in Iraq being asked for?
The pressure is commercial, not legal. It usually arrives by one of four routes.
A parent company or joint venture partner rolls out a group anti-bribery standard and asks every operating entity to certify. A tender committee adds an anti-bribery management system to the prequalification pack. A lender or insurer asks what sits behind your third-party spend. Or a major buyer pushes its own compliance obligations down to suppliers, and you are the supplier.
None of these are legal obligations. They are conditions of doing business with a particular counterparty, and that shapes your scope. If one buyer is driving the request, the audit should cover the entities and activities that serve that buyer. A group mandate is usually wider. More on that in the ISO certification process overview. Scope by what you are being asked to prove, not by what sounds impressive on a certificate.
Which part of the chain do you actually control?
Draw your operation as a line from order to delivery, then mark honestly which steps happen under your direct supervision.
For most operators here the supervised portion is smaller than expected. Head office, finance, procurement and perhaps a base camp are yours. Everything between the port and the site — customs brokerage, haulage, escort and security, permits and access, local hiring, fuel supply — is frequently sub-contracted, sometimes twice over.
That unsupervised portion is where bribery risk concentrates, and where the standard puts most of its weight. An auditor will spend far more time on your business associate controls than on your policy document.
Two things follow. Your risk assessment must be built around functions and touchpoints, not departments. And you need to know who your intermediaries sub-contract to, because a broker who quietly hands the job on has moved your exposure somewhere you have never looked.
What are the four directions of bribery risk?
ISO 37001 addresses bribery in four directions: by the organisation, by its own personnel acting on its behalf, by business associates acting for it, and directed at the organisation. For an operator working through intermediaries, three of those sit outside your walls.
The business-associate direction is the obvious one — the clearing agent who settles a delay with a payment and rolls it into a line item called "expediting". The personnel direction matters more than people expect, because your own site staff authorise those invoices under pressure. The inbound direction covers the tender agent who offers your procurement lead a share of the margin.
Controls need to face all four. Applicants routinely build a strong outbound programme and forget the inbound one entirely. That gap gets written up.
What does the standard require of you?
ISO 37001 is the international standard that sets out what an anti-bribery management system, or ABMS, has to contain. Its requirement areas are:
- A bribery risk assessment that is specific, documented and revisited when things change.
- An anti-bribery policy people can actually apply.
- An anti-bribery function with real authority and independence from the operations it oversees.
- Leadership and culture — not a signed statement, but visible behaviour.
- Due diligence on transactions, projects, personnel and business associates, proportionate to risk.
- Financial controls and non-financial controls, the latter now explicitly including mergers and acquisitions.
- Rules and records for gifts, hospitality and donations.
- A way to raise concerns, with protection for the person who raises them.
- An investigation process that runs when something is reported.
- Training matched to role and risk, including conflicts of interest.
- Monitoring, internal audit and management review.
Read that list against your intermediary chain, not your head office. Most of it only gets difficult where a third party is involved.
How do you run due diligence when public information is thin?
Here is the problem every applicant in this market meets. Company registries are not always searchable online. Beneficial ownership is often unpublished. Coverage of small trading and logistics firms is sparse. Screening tools return little, and what they return may be in a language your platform indexes poorly. Many counterparties are family businesses with no website and no audited accounts.
Applicants react in one of two unhelpful ways. Either they run a screen, find nothing, and record "no adverse findings" — which is not a finding, it is an absence of data. Or they decide due diligence is impossible here and skip it.
Neither survives an audit. The standard asks for risk-based due diligence: depth scales with assessed risk, method adapts to what is obtainable. It does not require a particular database or report format.
What works is triangulation — several weak signals rather than one strong one.
- Documentary basics. Registration papers, tax identification, bank details in the company's own name, a physical address someone has actually seen.
- Ownership questions asked directly. A signed declaration naming owners, directors and any public-official connections. Self-declared, and still evidence, because a false declaration is a contract breach you can act on.
- A site or office visit. Photographs, a meeting note, confirmation that premises and equipment match claimed capacity. This step alone catches most shell intermediaries.
- Reference checks. Two or three named counterparties, contacted directly rather than through the intermediary.
- Commercial-terms review. Success fees, round-number retainers and payments to a third country all deserve questioning on paper.
- Ongoing monitoring. Invoice pattern review, unexplained variations, a documented refresh cycle.
Record what you looked for, what you found, what you could not obtain, and what you did about the gap. Applicants skip that last element, and it is the one auditors ask about first.
How deep should due diligence go for each tier of intermediary?
You cannot apply the full pack to every counterparty, and should not try. Proportionality is a requirement, not a shortcut.
| Intermediary type | Why it carries risk | Depth | Evidence an auditor expects |
|---|---|---|---|
| Customs and clearing agents | Repeated official contact; time pressure supplies the excuse | Highest | Ownership declaration, visit note, fee breakdown, review of "expediting" charges, annual refresh |
| Permits and access facilitators | Their value proposition is influence over a process you cannot see | Highest | Written scope of what they do and do not do, no success fees, named individuals, termination clause |
| Security and escort providers | Cash-intensive, frequent checkpoint contact, sub-contracting common | High | Sub-contractor list, cash handling rules, incident reporting route, training records |
| Haulage and freight forwarders | Payments at weighbridges and crossings; drivers act alone | High | Driver instructions, receipt policy, route incident log, spot-check records |
| Recruitment and manpower agencies | Fees paid by workers; hiring-favour exposure | Medium-high | Fee-source declaration, hiring approval trail, conflict disclosures |
| Rental, fuel and general suppliers | Standard procurement and kickback exposure | Medium | Competitive-quote record, ownership screening, invoice anomaly checks |
| Low-value, low-contact vendors | Little contact with decision-makers | Low | Standard onboarding plus an anti-bribery contract clause |
That illustrates the reasoning; it is not a template, and your tiers must come from your own risk assessment. The low tier is legitimate — no auditor criticises a light touch on a stationery supplier. They criticise it on a clearing agent, and a tiering model with nothing behind it.
What does an auditor accept as reasonable effort?
This is the question we get asked most, so here is the plain answer.
An auditor is not testing whether your third parties are clean. That is unknowable, and the standard does not pretend otherwise. The auditor is testing whether your system is designed sensibly, applied consistently, and honest about its own limits.
Reasonable effort looks like this. You identified the gap, and the file says which checks you could not complete and why. You compensated for it — a contractual warranty, a capped payment, dual approval, a shorter review cycle. You escalated proportionately, so higher residual risk went to a named decision-maker who accepted it in writing. You applied your own rules, so if the procedure says a top-tier agent needs a site visit, the sampled files contain visit notes. And you acted when something surfaced.
Unreasonable effort is a folder of screenshots showing empty database results, a policy mandating checks nobody performs, an approval matrix where every approval came from the requester, and a risk assessment untouched since it was written.
The same logic covers cash. Field operations here often need cash floats, and cash is not prohibited. What is expected is control: issue limits, receipts, reconciliation, an approver who is not the holder, and a rule that any payment made under duress is reported afterwards rather than absorbed into a general expense line. If people believe reporting an unavoidable payment will get them disciplined, you will never hear about one, and your management review will be reading fiction.
What changed in ISO 37001:2025, and what should you do?
The current edition is ISO 37001:2025, published in February 2025, replacing ISO 37001:2016. Holders of a 2016 certificate must transition by 28 February 2027. First-time applicants go straight to the 2025 edition, so that deadline does not apply.
| Change in ISO 37001:2025 | What it means | What to do when you work through intermediaries |
|---|---|---|
| Harmonized common ISO structure | Clause layout now matches other management system standards | Map shared elements onto any existing ISO 9001 system rather than building a parallel one |
| "Stakeholders" became "interested parties" | Terminology alignment | Update at next revision; list buyers, partners and your intermediary chain |
| Clauses 4.1 and 4.2 require climate change to be considered | Carried in from the 2024 amendment | Record the consideration honestly; if climate is not material to bribery risk, state that conclusion |
| Clause 5.1.3 makes anti-bribery culture an explicit requirement | Culture is auditable now, not implied | Evidence it where it is hardest — at remote sites and among staff who deal with intermediaries daily |
| Clause 7.2.2 adds conflict-of-interest awareness to employment processes | Hiring and appointment must address conflicts | Extend disclosure to anyone who selects, approves or supervises third parties |
| The anti-bribery function's role and independence stated more clearly | Less room for a nominal appointment | Make sure it can stop a payment or suspend an intermediary without operations overruling it |
| Clause 8.4 adds mergers and acquisitions as a non-financial control area | M&A explicitly in scope | Apply it to acquisitions of local partners and to contracts taken over with an inherited agent list |
| Clause 10 reordered: continual improvement at 10.1, nonconformity and corrective action at 10.2 | Structural change | Renumber references in your procedures; the substance is unchanged |
If you hold a 2016 certificate, do not wait for your final surveillance visit to begin. Gap analysis, document revision and a round of internal audit take longer than teams plan for, especially when third-party files need rebuilding.
What does ISO 37001 certification in Iraq not prove?
Better said early than discovered late. Certification does not prove that no bribery has occurred in your organisation, and it does not prove that none will occur. The standard states this limitation about itself. An audit is a sample taken at a point in time by people who were not at your checkpoints or in your agents' offices.
What the certificate says is narrower and still useful: an independent certification body examined your anti-bribery management system against ISO 37001 and found it conforming. You have identified your risks, put proportionate controls in place, and can show they operate. Anyone who tells you a certificate makes your supply chain clean is selling you something. Anyone who calls it worthless has misunderstood what a management system standard is for.
How long is the certification cycle, and where does training sit?
The route to certification with IAS follows the pattern used across system certification.
Stage 1 is a readiness review of your documented system, risk assessment, scope definition and internal audit results. For an intermediary-heavy operation, this is where scope arguments get settled — which entities, which sites, which contracts. Expect findings; that is the point.
Stage 2 is the implementation audit. The auditor samples records, interviews people at several levels, and tests whether the system described at Stage 1 actually runs. Third-party due diligence files, gift registers, cash reconciliations and reporting-channel records get real attention.
Certification follows once nonconformities are closed. Annual surveillance audits then check the system still operates and corrective actions held. Recertification reviews the whole system again at the end of the cycle.
Sampling and reporting mechanics are set out in the ISO audit procedure pages. IAS issues certification under its UQAS accreditation, described on the accreditation page and the group accreditation page. One point of language trips people up: accreditation belongs to IAS as the certification body. Your organisation becomes certified, not accredited.
Training is delivered by IAS with EAS, under the same UQAS accreditation, through a team separate from the audit team. That separation is not negotiable — the people who train you cannot be the people who assess you. Options include ISO training in Iraq, internal auditor training, lead auditor training and the EAS online course platform. Training builds competence; certification is a separate assessment.
What drives the cost of ISO 37001 certification in Iraq?
We do not publish prices, because a number without a scope attached is meaningless. What we can do is name the variables, so you can gauge your own position before asking for a quotation.
| Cost driver | Why it matters for an operator here | Direction |
|---|---|---|
| Sites in scope, headcount and shift patterns | Dispersed camps and yards need separate sampling and more interviews | Up |
| Number of top-tier intermediaries | Each high-risk agent adds file review time | Up |
| Depth of sub-contracting | Layers below your direct contract take longer to trace | Up |
| Site accessibility | Restricted or remote locations affect how the audit is arranged | Up |
| Readiness of third-party files | Complete, indexed files cut Stage 2 sampling time | Down |
| Quality of the risk assessment | A specific, evidenced assessment shortens Stage 1 | Down |
| Existing certified systems | Shared processes with ISO 45001 or ISO 22301 reduce duplication | Down |
| Transition versus first certification | A 2016 transition is usually the narrower job | Down |
The largest controllable item there is the state of your third-party files. Applicants who arrive with a tiering model, completed files and a written explanation for every gap move through Stage 2 far faster than those assembling files during the audit week. Send your site count, headcount and intermediary numbers through contact us for a scoped answer rather than a range.
Where do applicants lose time?
Five patterns account for most of the delay we see.
A risk assessment written about bribery in general. It describes global typologies and never names one of your agents, routes or payment points. Rewrite it around your real touchpoints — this port, this crossing, this permit, this hiring channel.
Files that record absence as assurance. "Screening completed, no results" is not a conclusion. State what was searched, the limits of that search, and what you did instead.
An anti-bribery function that cannot say no. If the appointed person reports to the operations director who owns the delivery deadline, independence fails on inspection. Fix the reporting line before Stage 1.
Policies that never reached the field. Drivers, site supervisors, expeditors and security team leaders often have no training record and have never seen the reporting channel. Role-appropriate training means the people in the risk, not just head office.
Contracts with no anti-bribery terms. Long-standing intermediary agreements often predate the programme. Renewal is the natural point to fix this, and auditors will ask about the ones not yet renewed.
None of these are hard. They are just slow if you find them during the audit rather than three months before it.
How this page was checked
This page describes ISO 37001:2025 and the certification process operated by IAS. It was written against the published structure of the standard and reviewed against IAS process documentation.
It makes no claim about local law in Iraq. Nothing here states or implies that certification is legally required, that any authority mandates it, or that a certificate satisfies any legal obligation. Every driver described on this page is commercial — buyers, tender committees, lenders, parent companies and partners. For legal questions, take qualified advice in the relevant jurisdiction.
References to market conditions are operational observations about information availability and supervision distance, not assessments of any country, institution or individual.
No client names, prices, audit durations or statistics appear here, because we do not publish figures we cannot attribute. Certificates issued by IAS can be verified through the IAS certification search. Rules for displaying marks are on the logo usage guideline page.
Frequently asked questions
Can we certify if most of our operational risk sits with sub-contractors?
Yes, and that is the normal case. Your scope covers your organisation; your controls cover how you select, contract with, monitor and if necessary exit those sub-contractors. You are not certifying them.
Our clearing agent will not disclose its ownership. What do we do?
Record the refusal, treat it as a risk indicator, and apply compensating controls — dual approval on invoices, a warranty with a termination right, a payment cap, a shorter review cycle. Then decide whether the relationship is worth keeping. An auditor accepts a documented, mitigated gap, not an undocumented one.
Screening returns nothing for our local suppliers. Is that a problem?
Only if you treat it as a clean result. An empty search where public reporting is thin tells you almost nothing. Note the limitation and build assurance from other sources — visits, references, ownership declarations, commercial-terms review.
How do we handle payments made at checkpoints under time or safety pressure?
Set the rule in advance: safety first, then report afterwards through a channel that does not punish the reporter. Log it, review the pattern, feed it back into the risk assessment. Systems that quietly absorb such payments fail on both records and culture.
Do auditors visit our remote sites, or can it all be done from head office?
Scope determines sampling. Where sites carry materially different risk — and a border yard usually does — the audit needs to reach them in some form. Arrangements are agreed during scoping, taking access and security into account.
Can we certify one entity or one contract instead of the whole group?
Yes, provided the scope statement is accurate and not misleading. A single legal entity, a business line or a named project can be certified, and the certificate must say clearly what it covers.
We hold a 2016 certificate. What is our deadline?
28 February 2027. Plan gap analysis, document updates and an internal audit round well ahead of it, especially if third-party files need rebuilding.
Does certification prove there is no bribery in our supply chain?
No. It proves an independent body assessed your management system against ISO 37001 and found it conforming. The standard is explicit that certification is not evidence bribery has not occurred or will not occur.
How does the climate change requirement apply to an anti-bribery system?
Clauses 4.1 and 4.2 require you to consider whether climate change is relevant to your context. For many operators it will not be material to bribery risk. Record the consideration and the conclusion.
What does clause 8.4 mean if we acquire a local partner?
Pre-deal work should cover bribery risk, and integration should bring the acquired entity's intermediaries into your own tiering and review process.
Can ISO 37001 be audited alongside our other management systems?
Where can we read more before deciding?
Start with the ISO certification overview, the general FAQ page and the blog.
Your next step
If you are being asked for ISO 37001 certification in Iraq, work through this order.
1. Confirm who is asking and why. Their requirement sets your scope.
2. Map your intermediary chain, including who your direct contractors sub-contract to.
3. Tier those intermediaries and write down the reasoning.
4. Rebuild the due diligence files for the top tier first, recording gaps honestly.
5. Fix the independence of the anti-bribery function.
6. Run one internal audit and let it find things.
7. Then request a quotation, with site count, headcount and intermediary numbers ready.
Steps two to four are where the real work sits.
Ready to scope it properly? Send your site count, headcount and intermediary list to IAS and ask for a scoped quotation — or read the certification process first if you would rather prepare before you call.
