CFO implementing ISO 37001: financial controls, integrity disclosure and cross-border bribery exposure

Which financial controls does ISO 37001 touch, and how do they map to the purchasing and payment cycle?

A typical implementation covers financial controls and approval design, third-party due diligence, bribery risk assessment (including hospitality, commissions, agents and dealings with government) and reporting channels and investigation procedures; the control points for approvals, payments, hospitality and gifts, and procurement sit in clauses 8.3, 8.4 and 8.7.

The purchasing and payment cycle in Article 7 of the internal control regulations already includes supplier management. ISO 37001 financial controls, approvals and supplier due diligence should map to the existing control points of that cycle rather than form a second system. The internal control regulations apply to public companies; companies that are not public companies are not covered and can use them voluntarily.

What integrity information must the annual report and the ESG evaluation disclose?

• Annual report regulations, Article 10: the corporate governance report must disclose how integrity management is carried out, and any differences from the Ethical Corporate Management Best Practice Principles for listed companies and the reasons
• ESG indicator S-7 (2027 edition): a board-approved integrity policy, a full- or part-time responsible unit, and reporting to the board at least once a year; the 2026 edition splits this into S-7 and S-8
• ESG indicator S-9: detailed disclosure on the company website of the whistleblowing system for insiders and outsiders on illegal (including corruption) and unethical conduct

ISO 37001 policies, risk assessments, training and audit records can support the disclosure; whether they match a given indicator must be checked against that year's wording. Companies that are not public companies are not covered by these rules and can use them voluntarily.

Financial exposure in cross-border business: which anti-bribery laws may apply to group entities?

Assess entity by entity:

• Taiwan's Anti-Corruption Act, Article 11: bribing officials of foreign countries, mainland China, Hong Kong or Macau in connection with cross-border trade, investment or other business is punishable in the same way, and offences committed outside the Republic of China are also punished under the Act
• US FCPA: applies to US securities issuers (including foreign issuers), US domestic concerns (including US subsidiaries of Taiwanese groups) and their directors, employees and agents
• UK Bribery Act, section 7: applies to bodies incorporated in the UK or carrying on business or part of a business there, and an offence can arise from bribery by associated persons such as agents and subsidiaries

Specific legal liability should be reviewed with a lawyer.

Does ISO 37001 certification reduce the company's legal liability?

That cannot be said. ISO 37001 itself states that conformity cannot guarantee that no bribery occurs; certification shows that the system operates, not that the risk is zero.

Section 7(2) of the UK Bribery Act lets a company show it had "adequate procedures" as a defence, but adequacy is decided by the court case by case, and the UK Ministry of Justice guidance does not name any particular management system; certification does not automatically amount to a legal defence, nor does it guarantee evaluation results. When reporting to the board, the CFO should present certification as evidence of prevention, detection and response, not as a guarantee against liability.

Budget and timeline: how long does it take, and in which year should the transition be budgeted?

As listed on the service page, building the system and running the internal audit typically takes one to two quarters, followed by certification; the actual time depends on the organisation's size and risk exposure.

• Holders of 2016 certificates: UKAS and SCC announced that the transition to ISO 37001:2025 must be completed by 28 February 2027, after which 2016 certificates are no longer valid; confirm the actual arrangements with your certification body
• Budget consulting and certification separately: under ISO/IEC 17021-1 clause 5.2.5, a certification body and the same legal entity may not provide management system consultancy

This page lists no fees; Winners Consulting provides an estimate after the free mechanism diagnosis.

How does Winners Consulting help a CFO with the ISO 37001 anti-bribery management system?

• VP- and director-level consultants lead the work end to end, never outsourced
• ERM risk language is the backbone, and the documentation is shared with the existing internal control system to avoid duplication
• Interviews and workshops are built into existing meeting rhythms to minimise disruption
• The application of Article 11 of the Anti-Corruption Act, the US FCPA and the UK Bribery Act is assessed entity by entity
• Winners is a consultant and does not certify

Read more: ISO 37001 consulting, Choosing an ISO 37001 consultant, CRO role page, CFO role page. Request a free mechanism diagnosis