ISO 37001 LA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Undue advantage

Any benefit of value, financial or non-financial, offered, promised, given, accepted, or solicited to influence improperly the actions of a person, whether in the public or private sector.

Anti-bribery management system

A set of interrelated or interacting elements of an organization, including policy, objectives, processes, and resources, used to implement anti-bribery controls and achieve intended outcomes.

Reasonable and proportionate

The principle that anti-bribery controls are calibrated to the organization's size, structure, and bribery risk profile, so controls are adequate without being excessive or impractical for the organization.

PDCA cycle

Plan-Do-Check-Act: the iterative process by which the ABMS establishes objectives and controls, implements them, monitors and evaluates performance, and improves based on results.

High-Level Structure

The common clause framework (Annex SL) used by ISO management system standards, with clauses 4 to 10 covering context, leadership, planning, support, operation, performance evaluation, and improvement.

Bribery risk assessment

A process that identifies bribery risks, analyzes likelihood and impact, and evaluates which risks require treatment, considering factors such as country, sector, transaction, and business partner.

Anti-bribery compliance function

The function assigned by top management to oversee the ABMS, with authority, resources, and direct access to top management, and independence from commercial or operational pressures.

Due diligence on business associates

A risk-based process to evaluate the integrity and bribery risk of business associates before and during the relationship, and to take action where the risk is unacceptable.

Gifts and hospitality controls

Documented rules setting thresholds, approval levels, and recording requirements for offering and accepting gifts, hospitality, and donations, including prohibition where bribery could be perceived.

Raising concerns

The Clause 8 process enabling employees and others to report suspected bribery confidentially and without retaliation, with a defined route for receiving and handling reports.

Management review

A Clause 9 activity in which top management reviews ABMS performance, including audit results, risk changes, and corrective action status, and decides on improvement actions.

Audit evidence

Records, statements of fact, or other information that are relevant to the audit criteria and verifiable, used by the auditor to reach findings and conclusions.

Audit criteria

The set of policies, procedures, standards, or requirements used as a reference against which audit evidence is compared, such as ISO 37001 clauses and the organization's own ABMS documents.

Major nonconformity

A failure to meet a requirement that is systemic, affects a required process, or would prevent the ABMS from achieving its intended outcome, requiring prompt corrective action.

Minor nonconformity

An isolated or limited lapse in meeting a requirement that does not indicate a systemic failure of the ABMS and can be corrected through routine corrective action.

Auditor independence

The condition in which auditors are free from bias, conflict of interest, and operational responsibility for the activity being audited, so that conclusions are objective and impartial.

Audit sampling

Selecting a subset of a population for testing when full review is impractical, with the rationale and results documented so conclusions are supported by sufficient evidence.

Audit plan

A document specifying audit objectives, scope, criteria, dates, locations, auditee functions, time allocation, and audit team roles for a specific audit.

Opening meeting

A meeting at the start of an audit that confirms scope, criteria, schedule, communication channels, confidentiality, and the method for reporting findings to the auditee.

Document review

Pre-fieldwork examination of ABMS documentation such as policy, risk assessment, due diligence records, training records, and audit reports to prepare targeted audit tests.

Audit team competence

The combination of ISO 37001 knowledge, anti-bribery and sector expertise, audit method skills, and language ability required of team members to conduct the audit effectively.

Risk-based time allocation

Assigning more audit time and resources to high-risk processes such as third-party due diligence and high-value procurement, and less to lower-risk support processes.

Audit checklist

A guide prepared from audit criteria and identified risks that structures the questions and evidence to be gathered, and is tailored to the current audit rather than copied from prior audits.

Corroboration of evidence

Confirming verbal statements made in interviews with records or observation, so findings rest on objective evidence rather than on unverified assertions alone.

Transaction tracing

Following a transaction from initiation through approval to payment to test whether documented controls actually operated as described in the procedure.

Evidence-based finding

A finding stated with the specific criterion, the supporting evidence, and the gap identified, so that it is verifiable, traceable, and actionable for the auditee.

Escalation of suspected bribery

The auditor's action of recording facts and reporting a possible bribery incident through the planned escalation route, without investigating the incident or directing corrective action.

Closing meeting

A meeting presenting audit findings, conclusions, and recommendations, allowing the auditee to clarify factual accuracy but not to negotiate away evidence-based findings.

Audit report

A document recording audit objectives, scope, criteria, team, findings with evidence, conclusions on conformity and effectiveness, and areas of good practice.

Corrective action verification

Follow-up activity confirming that the root cause was addressed and the corrective action was implemented and effective, after which the nonconformity may be closed.

Audit program

The set of one or more audits planned for a specific time frame and purpose, managed by a competent person with authority over audit resources and scheduling.

Auditor rotation

Assigning different auditors over successive audit cycles to preserve independence and objectivity and to reduce familiarity that could compromise impartial judgment.