Common Mistakes in Preparing ISO 37001 Documents

ISO 37001, the Anti-Bribery Management System (ABMS) standard, is designed to help organizations prevent, detect, and address bribery in their operations. Achieving certification requires more than just implementing controls—it also involves preparing and maintaining proper documentation. ISO 37001 documents, such as policies, procedures, records, and reports, serve as the foundation for compliance, audits, and continuous improvement. However, many organizations struggle with documentation and often make avoidable mistakes. These errors can lead to delays in certification, nonconformities during audits, and even weakened anti-bribery practices.

Below are some of the most common mistakes organizations make when preparing ISO 37001 documents:

1. Treating Documentation as a Paperwork Exercise

One of the biggest mistakes is preparing documents simply to “tick the box” for certification. Organizations sometimes create policies and procedures without aligning them to their actual operations. When documents exist only for display, they lose their practical value and employees often ignore them. ISO 37001 requires documented information that reflects the organization’s real anti-bribery controls, not generic templates that no one uses.

2. Over-Complicating the Documentation

While ISO 37001 requires certain documents—such as anti-bribery policies, risk assessments, and due diligence records—many organizations make the mistake of creating overly detailed manuals. Too much complexity makes documents hard to understand and discourages employees from following them. Documentation should be simple, clear, and tailored to the organization’s size and risk exposure.

3. Missing Mandatory Documents

Another common error is failing to prepare mandatory ISO 37001 documents. For instance, an organization might overlook maintaining a bribery risk assessment report, or fail to keep training records. These omissions become major nonconformities during an audit. A clear checklist of required documents—policies, procedures, records of investigations, corrective actions, and whistleblowing mechanisms—can help avoid such gaps.

4. Ignoring Risk-Based Documentation

ISO 37001 emphasizes risk-based thinking, meaning documentation should reflect the bribery risks relevant to the organization. Some companies use a one-size-fits-all approach and fail to document risk assessments or due diligence on third parties. Without risk-based documentation, it is impossible to show how the organization identifies and mitigates bribery threats.

5. Lack of Version Control and Updates

Documents are not static—they must evolve as the organization changes. A common mistake is failing to keep editable ISO 37001 documents up to date. Old policies, outdated risk registers, or expired due diligence reports weaken the credibility of the system. Without proper version control, employees may use outdated procedures, leading to inconsistencies and compliance risks.

6. Inadequate Training Records

ISO 37001 requires evidence that employees are trained on anti-bribery policies and procedures. Organizations often provide training but forget to maintain attendance sheets, feedback forms, or competency evaluations. Missing training records can cause auditors to conclude that the workforce is unaware of the system, even if sessions were conducted.

7. Poorly Documented Investigations and Corrective Actions

When bribery-related incidents or complaints arise, organizations must document investigations, findings, and corrective actions. A frequent mistake is treating these records casually—sometimes keeping only verbal notes or incomplete reports. Without proper documentation, organizations cannot demonstrate compliance with ISO 37001 requirements for accountability and continuous improvement.

8. Ignoring Supplier and Third-Party Documentation

Bribery risks often arise from third parties such as suppliers, contractors, or agents. A common gap in ISO 37001 documentation is failing to record due diligence results, contracts with anti-bribery clauses, or monitoring reports of third-party behavior. This weakens the entire system since external risks remain undocumented and unchecked.

9. Failing to Demonstrate Top Management Commitment

ISO 37001 stresses leadership commitment, and this must be evident in documentation. A mistake many organizations make is preparing documents that show policies exist but fail to demonstrate active involvement from senior management. For example, if board meeting minutes, compliance reviews, or signed declarations of support are missing, auditors may question leadership’s role in the ABMS.       

Conclusion

Preparing ISO 37001 documents is not just about satisfying certification requirements—it is about building a transparent and accountable system that protects the organization from bribery risks. Common mistakes such as using generic templates, neglecting risk-based documentation, failing to update records, or overlooking third-party due diligence can significantly undermine compliance efforts. By focusing on clarity, accuracy, and alignment with actual practices, organizations can ensure that their documentation not only meets ISO 37001 requirements but also supports long-term ethical business operations.