ISO 37001 2025 transition decisions before the deadline

Global ACI sets 28 February 2027 as the end of the accredited certification transition. GCC organisations need a controlled change plan that reaches culture, conflicts and the anti-bribery function.

Global ACI-TECH-3-TR-2027-02-28 (M), version 1.0, now carries the transition requirements formerly published as IAF MD 30:2025. Issued on 10 July 2026 and implemented on 31 August 2026, it states that the transfer introduced no substantive changes. The accredited certification transition ends on 28 February 2027; initial certification and recertification were to use the 2025 edition only, beginning no later than 31 August 2026. Confirm the audit and certification-decision plan with your certification body. Current Global ACI transition document

The deadline governs the accredited certification transition described by Global ACI; IAF MD 30 is retained here as the historical source. It is not a universal legal deadline for every anti-bribery programme, and ISO certification itself does not prove that bribery cannot occur. GCC organisations should keep certification, legal obligations, contractual commitments and their own risk decisions clearly separated.

Source evidence: IAF MD 30 2025 transition requirements for ISO 37001 2025 and ISO 37001 2025 official standard page.

• Confirm the certificate scope, certification body, planned audit route and transition date against the current Global ACI transition document and the body’s approved arrangement.

• The current transition document identifies headline changes concerning compliance culture, climate change, conflicts of interest, the anti-bribery function and alignment with the harmonised management-system structure.

• Do not reproduce ISO clauses in an internal gap sheet. Use licensed copies and record evidence in the organisation’s own language.

• Treat the transition as a change to behaviour and decisions, not as a document-renaming exercise.

For compliance culture, ask what leaders reward, tolerate and challenge when commercial pressure conflicts with anti-bribery controls. Evidence may include decision records, escalation outcomes, incentive design, investigation lessons and consistent treatment of high performers. A values poster is not enough.

For conflicts of interest, test disclosure, review, mitigation, recusal, approval and follow-up using actual role and transaction scenarios. A register is an input; the governance outcome depends on whether the conflict changed who decided, what safeguards applied and how the rationale was retained.

For the anti-bribery function, confirm authority, competence, access to oversight, independence appropriate to risk and protection from inappropriate influence. Record which decisions the function owns, advises, challenges or escalates. Avoid copying protected clause text; use the official standard and the organisation’s controlled interpretation.

Keep a controlled file containing the licensed source version, change analysis, affected processes, accountable owners, training and competence needs, revised controls, implementation evidence, internal verification, management decision, certification-body correspondence, audit plan and open actions. Link each action to a risk or requirement change so the file remains usable after the certificate is issued.

For GCC groups, add the legal entity, country, language, business line, public-sector touchpoints, intermediaries and high-risk approvals within the certified scope. A group policy may be common while evidence differs by entity and transaction.

Select scenarios such as a rushed government permit, intermediary onboarding, charitable contribution, tender clarification, gift or hospitality request, joint-venture approval or urgent vendor payment. Trace the actual authority, due diligence, financial and non-financial controls, exception route and retained evidence.

Where approval authority is delegated, the decision must remain traceable. The QSE Advisory article on delegated approvals offers a practical evidence pattern. Sample audits should follow risk and consequence; the risk-led audit programme article explains how to avoid spending equal effort on low-risk paperwork and high-risk decisions.

Fictional transition record. A procurement manager assessing an intermediary discloses that a close relative owns part of the proposed firm. The existing conflict register records the relationship but contains no decision about the manager's participation.

A signed disclosure form closes the disclosure task, not the transaction-control gap. Equally, recusal by itself does not establish that the intermediary is suitable; due diligence and the other applicable approvals remain necessary. The fictional record makes the gap visible without prescribing the outcome for every family connection.

Keep the action open if the revised form exists but the selection can still be approved by the conflicted person. Record any permitted exception through the organisation's competent authority rather than quietly overriding the control. This is an implementation example for review against the licensed standard and actual circumstances, not a new ISO clause, a legal conclusion or evidence that certification will follow.

Ask which audit event will include the transition, whether additional time is expected, what information is needed beforehand, when the certification decision will occur, how certificate dates will be handled and what happens if open findings remain near the deadline. Record the response, owner and date.

Do not state that an internal gap assessment guarantees transition. The current Global ACI document requires the certification body to make its decision based on the transition audit. The organisation controls readiness and evidence, not the independent certification outcome.

The deadline remains 28 February 2027 under the current Global ACI document; that was also the date in IAF MD 30.

The current Global ACI document says accredited certifications to the previous edition are no longer valid after the transition end date.

No. Use a licensed copy of ISO 37001:2025 and competent review; this article covers official headline changes only.

No. The organisation should determine relevance in its context and record the reasoning.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.