ISO 37001 LA cheat sheet

Bribery is defined in ISO 37001 as directly or indirectly offering, promising, giving, accepting, or soliciting an undue advantage of any value, whether financial or non-financial, regardless of location, and whether to or from a public or private sector person.

The standard is built on a Plan-Do-Check-Act cycle: bribery risk assessment and policy setting (Plan), controls and due diligence (Do), monitoring and audit (Check), and management review with corrective action (Act).

ISO 37001 is certifiable and auditable; ISO 37001 is a management system standard, not a list of prohibited transactions, so conformity means the organization has implemented reasonable and proportionate controls, not that bribery has been eliminated.

The ABMS follows the ISO High-Level Structure (Annex SL), sharing clause numbering with ISO 9001, ISO 14001, and ISO 27001: clauses 4 through 10 cover context, leadership, planning, support, operation, performance evaluation, and improvement.

Reasonable and proportionate is a core concept: controls are calibrated to the size, structure, and bribery risk profile of the organization, so a small low-risk entity may apply simpler controls than a multinational operating in high-corruption markets.

An undue advantage includes cash, gifts, hospitality, travel, entertainment, employment, scholarships, political or charitable donations, and non-financial benefits such as information or influence.

Top management must demonstrate leadership by establishing and reviewing the anti-bribery policy, appointing an anti-bribery compliance function, and ensuring resources are available; leadership is auditable through records of decisions and reviews.

The standard is designed to be integrated with existing management systems (quality, compliance, risk, internal control) rather than run as a stand-alone program, and integration reduces duplication of assessment and monitoring activity.

Bribery risk is assessed by evaluating likelihood and impact across categories such as country, sector, transaction type, business partner, and intermediary relationships, then prioritizing controls to the highest residual risk.

Clause 4 requires the organization to determine external and internal issues, identify interested parties and their bribery-related requirements, define the ABMS scope, and establish the ABMS processes needed.

Clause 5 requires a documented anti-bribery policy, top management commitment and accountability, and assignment of authority to an anti-bribery compliance function (ABC function) that has direct access to top management and independence from commercial pressure.

Clause 6 requires bribery risk assessment at planned intervals and when significant changes occur; the assessment must identify bribery risks, analyze and evaluate them, and be retained as documented information.

Clause 7 covers support: resources, competence of personnel whose work affects anti-bribery performance, awareness, communication, and documented information control including retention and protection.

Clause 8 covers operational controls: due diligence on business associates and projects, financial and non-financial controls, gifts and hospitality controls, managing inadequacy of controls, raising concerns (whistleblowing), and investigating bribery incidents.

Due diligence under Clause 8.2 is risk-based and proportionate, applies to business associates, and must be repeated at planned intervals or when changes occur; the organization must evaluate the results and take action where risk is unacceptable.

Clause 9 requires monitoring, measurement, analysis and evaluation, internal audit at planned intervals, and management review covering the status of actions, changes in context and risk, and opportunities for improvement.

Clause 10 requires the organization to react to nonconformities, take corrective action to eliminate causes, review the effectiveness of corrective action, and continually improve the suitability, adequacy, and effectiveness of the ABMS.

Gifts, hospitality, and donations must be controlled by documented rules setting thresholds, approval levels, and recording requirements; the organization must not offer or accept them where they could be perceived as bribery.

Audit evidence is defined as records, statements of fact, or other information that are relevant to the audit criteria and verifiable; the auditor evaluates evidence against criteria to reach audit findings.

Audit criteria are the set of policies, procedures, standards, or requirements used as a reference against which audit evidence is compared - for ISO 37001, criteria include ISO 37001 clauses, the organization's own ABMS documents, and applicable legal requirements.

ISO 19011 principles of auditing include integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach, and a risk-based approach.

Findings are classified by severity: a nonconformity is a failure to meet a requirement, an observation or opportunity for improvement is a suggestion, and a conformity is evidence that a requirement is met.

A major nonconformity typically indicates a systemic failure, absence of a required process, or a failure that would cause the ABMS to fail its intended outcome; a minor nonconformity is an isolated lapse that does not undermine the system as a whole.

Independence means auditors must not audit their own work; auditors should be free from bias and conflict of interest, and internal auditors should not have operational responsibility for the activity being audited.

Sampling is used because full population review is impractical; the auditor selects a sample sufficient to provide confidence in the conclusion and documents the sampling rationale and results.

An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which criteria are fulfilled; audits are not inspections or consulting engagements.

Auditor competence includes knowledge of ISO 37001 requirements, bribery risk and anti-bribery controls, audit principles and methods, and the sector and legal context of the auditee.

The audit program defines the audit scope, objectives, criteria, schedule, and resources; individual audits are planned from the program and consider the importance of processes and prior audit results.

A documented audit plan should specify audit objectives, scope, criteria, dates, locations, auditee functions, time allocation, and the roles of audit team members.

Document review before fieldwork typically covers the anti-bribery policy, risk assessment, due diligence records, gifts and hospitality registers, training records, internal audit reports, management review minutes, and incident logs.

A checklist or audit guide is prepared from the criteria and the identified risks, not copied from prior audits, so that the audit tests the current risk profile and the specific processes in scope.

The opening meeting confirms scope, criteria, schedule, communication channels, confidentiality, and the method for reporting findings; it also confirms the auditee's responsibilities and the escalation route for critical issues.

Audit team selection considers competence, independence, language, and sector knowledge; where the audit team lacks technical competence, technical experts may be used but they remain subject to the same independence requirements.

The audit plan allocates time according to process importance and risk, so high-risk areas such as third-party due diligence and high-value procurement receive more audit time than low-risk support processes.

Audit criteria should be confirmed with the auditee before fieldwork to prevent disputes about the standard applied; criteria may include contractual anti-bribery requirements and host-country legislation.

Interviewing is a primary evidence-gathering technique: the auditor asks open questions, follows up on inconsistencies, and corroborates verbal statements with records rather than relying on interviews alone.

Observation of activities and review of records provide objective evidence; the auditor traces transactions from initiation to approval to payment to test whether controls actually operate as described.

Testing controls includes selecting samples of due diligence files, gift approvals, invoice approvals, and training completions, and comparing the results to the documented procedure and thresholds.

When evidence indicates a possible bribery incident, the auditor records the facts and escalates according to the audit plan; the auditor does not investigate the incident or direct corrective action.

Findings must be supported by evidence and stated against the specific requirement: the auditor records the criterion, the evidence, and the gap, so the finding is verifiable and actionable.

Interviews should be conducted at appropriate levels, including top management and the anti-bribery compliance function, to verify leadership commitment and the authority and independence of the ABC function.

The auditor verifies that the risk assessment is current, covers the organization's actual operations, and drives the control set; a risk assessment that is generic or not updated after significant change is a finding.

Audit conclusions are reached by aggregating findings and evaluating whether the ABMS as a whole conforms and is effectively implemented and maintained.

The closing meeting presents findings, conclusions, and the audit team's recommendation; the auditee has the opportunity to ask questions and to clarify factual accuracy, but not to negotiate away evidence-based findings.

The audit report should include audit objectives, scope, criteria, dates, team, a summary of findings with evidence, conclusions on conformity and effectiveness, and any areas of good practice.

Nonconformities require corrective action: the auditee analyzes the root cause, plans action, implements it, and the auditor verifies effectiveness, typically through follow-up or the next audit.

The audit report is issued within the agreed timeframe, and distribution is controlled for confidentiality; findings should be traceable to evidence and to the specific clause or criterion.

Follow-up verifies that corrective actions were implemented and effective; closing a nonconformity without verifying effectiveness leaves the finding open.

Records of the audit - plan, checklist, evidence, report, and corrective action records - are retained as documented information to demonstrate the audit was performed as planned.

The audit conclusion distinguishes conformity of the management system from effectiveness of controls; an ABMS can conform to ISO 37001 while still having opportunities for improvement noted as observations.

Lessons learned from the audit feed the audit program and the ABMS improvement process, and recurring findings should trigger a review of the underlying process design.

The audit program is the set of one or more audits planned for a specific time frame and directed toward a specific purpose; it is managed by a competent person with authority over audit resources.

Program planning considers the size and complexity of the organization, the bribery risk profile, the results of prior audits, and the requirements of interested parties such as customers, regulators, and certification bodies.

The program establishes audit frequency and scope so that all clauses and high-risk processes are audited within the program cycle; risk-based scheduling increases frequency where risk is higher.

Program resources include auditor competence, time, budget, and access; resource constraints must be resolved before audits are scheduled, not during fieldwork.

Program monitoring and review evaluates whether audits achieved their objectives, whether schedules were met, and whether auditor performance and independence were maintained.

The program should define the process for selecting and evaluating auditors, maintaining competence records, and rotating auditors to preserve independence and objectivity.

The audit program links to management review: program results, recurring findings, and resource needs are reported to top management as part of the ABMS performance evaluation.

Certification audits are conducted by external certification bodies against ISO 37001, while internal audit programs are managed by the organization; the two must not be conflated, and internal audit results inform certification readiness.

Program records - schedules, audit reports, competence records, and corrective action status - are retained as documented information to demonstrate the program operates effectively.