ISO 37001 LA common mistakes
ISO 37001 LA · Understand the traps and how to avoid them.
Treating ISO 37001 as a document-and-policy exercise, so when asked what an organisation must actually demonstrate, the candidate lists having an anti-bribery policy, a manual and signed declarations instead of describing the risk-based due diligence, controls, monitoring and continual improvement the standard requires.
Candidates often study the standard by skimming its clause headings and memorising the list of 'documented information', which makes the standard look like a paperwork checklist. Many also carry over habits from compliance-officer training, where the policy document is the centrepiece, rather than from management-system auditing, where the process and its effectiveness are the centrepiece.
What to do instead
For each clause of ISO 37001, write two columns: 'what must exist' and 'what must be shown to be effective'. Drill yourself so that any requirement answer includes an evidence-of-implementation statement, for example that bribery risk is assessed, that due diligence is proportionate to that risk, and that controls are monitored and reviewed. Practise answering 'what would you expect to see?' rather than 'what document is required?'.
Confusing bribery with other financial-crime concepts and answering questions about the definition of bribery with references to fraud, theft, money laundering, extortion or facilitation payments as if they were the same thing, or asserting that facilitation payments are permitted under ISO 37001.
The vocabulary of anti-corruption overlaps heavily with fraud and AML terminology, and news coverage mixes them. Candidates also remember that some national laws (such as the US FCPA) historically carved out facilitation payments and assume the standard does the same, when ISO 37001 treats them as a bribery risk to be prohibited or tightly controlled.
What to do instead
Learn the standard's own definitions verbatim in substance: bribery as offering, promising, giving, accepting or soliciting an undue advantage of any value, directly or indirectly, in violation of applicable law, as an inducement or reward for action or omission. Then build a short comparison table separating bribery, extortion (coercion), fraud (deception for gain) and facilitation payments, noting that ISO 37001 expects facilitation payments to be prohibited or, at minimum, tightly controlled and progressively eliminated.
Answering due-diligence questions with a single generic statement such as 'the organisation shall conduct due diligence on all business associates' and omitting the risk-based, proportionate, graded nature of the requirement and the need to re-run due diligence periodically or on trigger events.
The word 'due diligence' is so familiar from other contexts that candidates stop reading the clause carefully. They also tend to memorise the list of parties to be covered (business associates, personnel, projects, activities) without capturing the qualifier that the depth of diligence must be proportionate to the bribery risk.
What to do instead
Memorise the requirement as a formula: identify the risk, then apply diligence proportionate to that risk, then act on the findings (approve, approve with conditions, or decline), then keep it current through periodic review and trigger events such as ownership change, new country of operation, or a red flag. When practising, always add 'proportionate to risk' and 'kept up to date' to any due-diligence answer, because exam distractors usually remove one of these qualifiers.
Treating top management's role as 'approve the anti-bribery policy and receive reports', and missing the standard's expectation that top management leads, provides resources, exercises oversight of the anti-bribery management system, and that a specific governing body or top manager is assigned responsibility for the system.
Candidates map ISO 37001 onto a generic 'management commitment' clause from other standards and assume the same wording applies. They also confuse the role of the compliance function (which operates the programme) with the role of top management (which leads and oversees it), so they attribute operational duties to the wrong level.
What to do instead
Draw an accountability map with three rows: top management, the governing body or assigned top manager responsible for the system, and the anti-bribery compliance function. Under each, list the specific duties the standard assigns (policy, resources, oversight, advice and guidance, reporting to the governing body, independence and authority of the compliance function). Test yourself by asking 'who does this?' for each duty rather than reciting clauses in order.
Describing audit evidence as 'checking documents' and proposing to audit the anti-bribery management system by reviewing the policy manual and completed forms, without sampling transactions, interviewing personnel, observing controls in operation, or tracing a payment through the approval chain.
Document review is the easiest evidence to plan and the most familiar to candidates from compliance roles. Auditors trained in other disciplines also underestimate how much of an anti-bribery system lives in behaviour (tone, escalation, gift registers, third-party approvals) rather than in documents, so they default to what can be read rather than what must be verified.
What to do instead
For every planned audit, force yourself to name at least three evidence types from different sources: document review, interview, and observation or transaction testing. Practise writing an evidence plan that starts from a control (for example, third-party onboarding approval) and traces a sample end to end, including who approved it, on what risk basis, and what happened when a red flag appeared.
Planning an ISO 37001 audit without a documented risk-based audit plan, or producing a plan that lists clauses to be checked but omits audit criteria, scope, objectives, sampling rationale, roles, schedule and the organisation-specific bribery risks that drive where to spend audit time.
Candidates revise clause content of the standard far more than audit-process content, so planning feels like administration and gets minimal attention. Under exam time pressure, they also write a generic plan template rather than tailoring it to the auditee's bribery risk profile, which is exactly what the exam is testing.
What to do instead
Build a reusable planning skeleton with fixed headings: objectives, scope and boundaries, criteria, audit team and competences, schedule, sampling approach, and risk justification. Then practise tailoring it to a short scenario by naming the two or three highest bribery risks (for example, high-risk country operations, agent commissions, government licensing) and explaining why audit effort is concentrated there.
Writing nonconformities that state a conclusion without evidence, such as 'due diligence is inadequate', or that cite a clause number with no description of the finding, the evidence, and the requirement not met.
Candidates conflate the audit finding with the audit conclusion and assume the reader shares their context. In practice, writing a well-formed nonconformity is a skill rarely taught outside audit training, so candidates default to summary judgements because those are quicker to write under time pressure.
What to do instead
Use a fixed four-part structure for every nonconformity: requirement (quote or paraphrase the specific clause), evidence (what was seen, where, and in what sample), finding (what is missing or ineffective), and significance (why it matters to the bribery risk). Practise converting vague statements into this structure until it becomes automatic, and check that each one would be understandable to someone who was not on the audit.
Classifying every gap as a major nonconformity, or conversely downgrading systemic failures to observations, without reference to defined criteria such as whether the requirement is unmet entirely, whether the failure is systemic, and whether the management system's ability to achieve its intended results is affected.
Candidates want to show they spotted problems, so escalation feels safer than calibration. Without an explicit grading rule, classification becomes emotional, and different candidates grade identical findings differently, which is precisely what the exam probes.
What to do instead
Write your own grading rule before practising: a major nonconformity is a requirement not addressed or a systemic breakdown affecting the system's ability to prevent bribery; a minor is an isolated lapse in an otherwise functioning control; an observation is an improvement opportunity with no requirement breached. Then apply the rule to ten short findings and defend each grade in one sentence.
Closing an audit by issuing the report and stopping there, omitting the follow-up of corrective actions, verification of effectiveness, and the link back to the audit programme through performance monitoring and improvement.
Candidates treat the closing meeting as the finish line because it is the last visible event in the audit sequence. The corrective-action and follow-up clauses feel like the auditee's business rather than the auditor's, so they are under-studied and easily dropped from answers.
What to do instead
Memorise closing as a chain rather than an event: report issued, corrective action agreed with root-cause analysis, action implemented by the auditee, effectiveness verified by the auditor, status tracked, and results fed into the next audit programme cycle. Practise describing what the auditor does at each link, especially how effectiveness is verified rather than merely whether the action was completed.
Describing an audit programme as a list of audits to be performed, without addressing how the programme itself is planned, resourced, monitored, reviewed and improved, or how audit frequency and depth are determined by risk and by the results of previous audits.
Candidates collapse 'programme' into 'plan' because the words are near-synonyms in ordinary usage. The programme-level requirements are also the least concrete part of audit management, so they are harder to revise and get skipped in favour of clause-by-clause content.
What to do instead
Keep a clear two-level distinction: the programme is the set of audits over a period with its own objectives, risks, resources, competences and performance measures; each audit is one instance within it. Practise answering programme questions with the cycle plan, implement, monitor, review, improve, and always state that frequency and scope are risk-based and informed by prior results.