The route from current posture to certified integrity is a sequence of stages, each consuming the results of the one before it. The program is drawn from what the opening audit finds: design and sequence take their shape from the firm's actual exposure.
The Diagnostic
The engagement opens with a gap analysis: a systematic mapping of the firm's bribery exposure — the jurisdictions it trades in, the counterparties and intermediaries it depends on, the commission structures it pays, the state-connected actors it encounters — measured against the requirements of ISO 37001:2025. The output is a documented baseline and risk profile that defines what the system must achieve, in the order the firm's actual exposure dictates.
The Design
From the audit's results, the program is drawn. The risk register, the controls engineered where the exposure lives — the onboarding of counterparties, the release of payments, the limits on gifts and hospitality, the delegation of commercial decisions — the anti-bribery function with its defined independence and access, and the ISO 37002 reporting channel. Where the firm already operates our ISO 37301 architecture, nothing parallel is built: the ABMS extends the existing system as one integrated design. The design is presented to the operator for review and approval before any implementation commences.
The Implementation
The system becomes operational. Controls execute inside the daily workflow of the trading floor, not beside it; personnel are trained in the responsibilities the system assigns to their role — and, where the risk demands it, the firm's business associates are trained with them. The reporting channel goes live with its protections documented. Evidence is produced by the work itself, from the first day of operation.
The Certification
The system is presented to an accredited certification body. Because the evidence has been generated continuously since implementation, the auditors examine records the firm has been producing all along. Where the integrated architecture applies, the two objects of certification are examined in the same audit cycle — one chain of evidence, two certificates. The objective of the stage is the ISO 37001:2025 certificate: the answer, in documented form, to the question every counterparty's due diligence file asks.
The Closure
The program closes when the firm passes the certification audit performed by the accredited body — ISO 37001:2025 certified, and where the integrated architecture applies, ISO 37301 in the same audit cycle. Continued advisory support is available where the operator requests it — a separate, optional phase after the objective has been reached.