How long will an ISO 37001:2016 certificate remain valid?

UKAS in the UK and SCC in Canada have announced that certified organisations must transition to ISO 37001:2025 by 28 February 2027, after which 2016 certificates are no longer valid. Confirm the transition arrangements with your certification body.

Does ISO 37001 certification protect us under the UK Bribery Act?

Not automatically. Section 7(2) lets an organisation prove it had adequate procedures in place as a defence, but adequacy is decided by the courts case by case, and the Ministry of Justice guidance sets out six principles without prescribing a particular management system. An ISO 37001 system and its records can be one basis for explaining your anti-bribery procedures.

Can a Taiwanese company fall under the US FCPA?

It has to be assessed entity by entity. The FCPA applies to issuers with securities registered in the US or with US reporting obligations (including foreign issuers), US domestic concerns (including the US-incorporated subsidiaries of Taiwanese groups), the officers, directors, employees and agents of either, and anyone acting while in US territory. Simply doing business with US companies does not by itself bring a company within its scope, but acting as their agent can.

How is ISO 37001 different from ISO 37301?

ISO 37001 focuses on anti-bribery; ISO 37301 covers compliance management more broadly. ISO 37001 can be implemented on its own or integrated into an existing management system; they are separate standards with separate certification.

We already have ethical corporate management rules. Why get certified?

Rules set a policy; certification means a certification body audits whether the management system actually operates, with evidence such as risk assessment, due diligence and concern-handling records. ISO 37001 itself states that conformity cannot assure that no bribery will occur, so certification shows that the system operates, not that the risk is zero.

How long does ISO 37001 implementation take?

It depends on the organisation's size and risk exposure; the typical experience listed on Winners Consulting's service page is one to two quarters to build the system and complete an internal audit before certification.

How to choose an ISO 37001 consultant in Taiwan: ten criteria

Direct answer: the first question to ask an ISO 37001 consultant is "which edition is the work based on?" ISO 37001 is a certifiable anti-bribery management system standard. The current edition is ISO 37001:2025, the second edition, published in February 2025 to replace the 2016 edition. Accreditation bodies including UKAS in the UK and SCC in Canada have announced that certified organisations must transition by 28 February 2027, after which 2016 certificates are no longer valid. The second question is which real situations the bribery risk assessment (clause 4.5) covers: hospitality and gifts, commissions, agents and distributors, dealings with government, donations and sponsorship. Companies in Taiwan also need to cover overseas markets. Under Article 11 of Taiwan's Anti-Corruption Act, bribing a public official of a foreign country, mainland China, Hong Kong or Macau in matters related to cross-region trade, investment or other commercial activities is punishable in the same way as bribing a domestic official, and the offence is punishable even when committed outside the Republic of China (Taiwan), whatever the local law says. The third question is whether the consultant is honest about the limits of certification. ISO 37001 itself states that conformity cannot assure that no bribery will occur, and whether the "adequate procedures" defence under section 7 of the UK Bribery Act 2010 succeeds is decided by the courts case by case, so a certificate is not a defence in itself.

How ISO 37001 relates to laws and other frameworks

Law or framework	Key points	How it relates to ISO 37001
Taiwan Anti-Corruption Act, Article 11	Bribing a public official of a foreign country, mainland China, Hong Kong or Macau in matters related to cross-region trade, investment or other commercial activities is punished under paragraphs 1 and 2 of the same article; this applies equally to people who are not public servants; an offence committed outside the Republic of China (Taiwan) is punishable whatever the local law says	Bribery risk in overseas markets, through agents and in dealings with government belongs in the bribery risk assessment and due diligence
US Foreign Corrupt Practices Act (FCPA)	Applies to issuers with securities registered in the US or with US reporting obligations (including foreign issuers), US domestic concerns (including the US-incorporated subsidiaries of Taiwanese groups), the officers, directors, employees and agents of either, and anyone acting while in US territory; the US Department of Justice issued new FCPA investigation and enforcement guidelines in June 2025, and in July 2026 a company entered into a deferred prosecution agreement with the Department over FCPA bribery	Due diligence, financial controls and approval records are the evidence for explaining anti-bribery controls
UK Bribery Act 2010, section 7	Applies to UK-incorporated bodies and to other bodies that carry on a business, or part of a business, in the UK; the organisation can be guilty when a person associated with it (someone performing services for or on its behalf, such as an employee, agent or subsidiary) bribes to obtain or retain business, or a business advantage, for it; proving it had adequate procedures in place is a defence, and adequacy is decided by the courts	The Ministry of Justice guidance explains adequate procedures through six principles and does not prescribe a particular management system; ISO 37001 can be one basis for explaining anti-bribery procedures, but certification is not in itself a defence
ISO 37301	Compliance management system standard covering a broader range of compliance	ISO 37001 focuses on anti-bribery and can be implemented on its own or integrated into an existing management system; they are separate standards with separate certification
Ethical corporate management principles for TWSE/TPEx listed companies	The corporate governance section of a public company's annual report must disclose how it practises ethical corporate management and how it departs from these principles, with reasons (Article 10 of the regulation on annual report disclosures by public companies)	ISO 37001 policies, risk assessments, training and audit records can support that disclosure
ESG Evaluation (formerly the Corporate Governance Evaluation)	From 2026, the Corporate Governance Evaluation of listed companies has been transformed and renamed the ESG Evaluation, with three dimensions and 75 indicators	ISO 37001 records can serve as supporting evidence; whether they meet a given indicator has to be checked against that year's indicator wording

Ten criteria

Criterion	Question you can ask any consultant
2025 edition and transition	Is the work based on ISO 37001:2025? Can you explain the main changes in the 2025 edition (more weight on compliance culture, conflicts of interest addressed, a clarified anti-bribery function, new subclauses on climate change)? If we hold a 2016 certificate, how do we complete the transition by 28 February 2027?
Bribery risk assessment	Which situations does the risk assessment (clause 4.5) cover (hospitality and gifts, commissions, agents and distributors, dealings with government, donations and sponsorship, overseas markets)? What criteria are used to grade risks?
Due diligence	How is due diligence on projects, business associates and personnel (clause 8.2) graded, and how deep does it go?
Financial and non-financial controls	How are control points for approvals, payments, hospitality and gifts, and procurement (clauses 8.3, 8.4 and 8.7) designed? Where is the evidence kept?
Raising concerns and investigation	How does the channel for raising concerns (clause 8.9) protect the people who use it? Who investigates (clause 8.10), and how are conflicts of interest avoided?
Anti-bribery function	Who performs the anti-bribery function (clause 5.3.2)? Does it have enough authority and independence?
Legal exposure, entity by entity	Can you assess, for each legal entity in the group, how Taiwan's Anti-Corruption Act, the FCPA and the UK Bribery Act apply, rather than just saying they have extraterritorial reach?
The limits of certification	Do you state plainly that certification does not guarantee that no bribery will occur, is not in itself a legal defence, and does not guarantee an evaluation result?
Integration with existing systems	Can it share documents with our ethical management policy, internal control and enterprise risk management instead of building a separate set?
Who leads, and is work subcontracted	Who actually runs the engagement, with what qualifications? Will any of it be subcontracted?

When you may not need a consultant

If your business does not involve overseas markets, agents or dealings with government, and no customer asks for certification, a self-review against your internal control and ethical management policy is usually enough to start. When you need a judgment on specific legal liability, such as whether one of your entities falls under the FCPA or the UK Bribery Act, consult a lawyer.

How Winners Consulting addresses these criteria

What follows is Winners Consulting's own description. Test us with the questions above, just as you test other consultants.

Bribery risk assessment: covers situations such as business hospitality, commissions, agents and dealings with government
Due diligence: set up a third-party due diligence procedure
Financial controls: design financial controls and approvals
Raising concerns and investigation: set up a reporting channel and an investigation procedure
Anti-bribery function: establish top management commitment and the anti-bribery function
Integration with existing systems: built on the risk language of enterprise risk management, sharing one document system with existing internal control
How the work is done: interviews and workshops fitted into your existing meeting rhythm, to keep disruption to operations low
Who leads: vice-president and director-level consultants run the whole engagement; nothing is subcontracted

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.