I85PREP
⌘ K
ISO 37001 LA study materials
ISO 37001 LA study resources

ISO 37001 LA practice questions

One question at a time. Build your ISO 37001 LA understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of an anti-bribery management system

In ISO 37001, what does the term "bribery" cover when the standard defines the scope of an anti-bribery management system?

  1. Any gift or hospitality recorded in a company's gift register, regardless of intent
  2. Only payments made directly to a public official in exchange for a contract award
  3. Offering, promising, giving, authorizing, or accepting an undue advantage of any value, directly or indirectly Correct answer.
  4. Only conduct that has already resulted in a criminal conviction in the organization's home country

Explanation

ISO 37001 defines bribery broadly as offering, promising, giving, authorizing, or accepting an undue advantage, whether financial or non-financial, and whether direct or indirect through intermediaries. The definition is not limited to public officials, to completed payments, or to conduct already prosecuted. This breadth is why the standard requires controls across all business relationships.

Question 2Fundamental principles and concepts of an anti-bribery management system

Which statement best describes the relationship between ISO 37001 and national anti-bribery law?

  1. ISO 37001 sets maximum penalties that authorities may apply to certified organizations
  2. ISO 37001 replaces applicable anti-bribery legislation for certified organizations
  3. ISO 37001 certification provides a legal safe harbour against prosecution in all jurisdictions
  4. ISO 37001 is a voluntary management system standard that does not create legal obligations and does not replace legal requirements Correct answer.

Explanation

ISO 37001 is a certifiable management system standard; it specifies what an organization should do to prevent, detect, and address bribery. It does not itself impose legal duties, override national law, or grant immunity. Organizations must still comply with all applicable legislation, and certification is not a defence against prosecution.

Question 3Fundamental principles and concepts of an anti-bribery management system

According to ISO 37001, who within the organization bears responsibility for establishing, maintaining, and improving the anti-bribery management system?

  1. The governing body and top management, who provide leadership and commitment Correct answer.
  2. External certification bodies, because they verify conformity
  3. The anti-bribery compliance function alone
  4. The internal audit team, because it provides independent assurance

Explanation

The standard follows the high-level structure used by other ISO management system standards, requiring top management to demonstrate leadership and commitment. The governing body also has a role in overseeing the system. Compliance functions support this work but do not carry sole responsibility.

Question 4Fundamental principles and concepts of an anti-bribery management system

What is the primary purpose of the anti-bribery policy required by ISO 37001?

  1. To describe the technical security controls protecting the compliance database
  2. To state the organization's commitments, prohibitions, and expectations regarding bribery in a documented form Correct answer.
  3. To list the names of employees who have been investigated for bribery
  4. To replace the need for due diligence on business associates

Explanation

The anti-bribery policy is a documented statement of the organization's stance: it prohibits bribery, sets expectations for personnel and business associates, and commits to compliance with law. It must be communicated and available to relevant parties. It is a governing document, not a record of individual cases or a substitute for due diligence.

Question 5Fundamental principles and concepts of an anti-bribery management system

In ISO 37001 terminology, what is a "business associate"?

  1. Any employee who has been with the organization for more than one year
  2. A competitor operating in the same market segment
  3. A regulator that supervises the organization's sector
  4. An external party with whom the organization has, or plans to establish, a business relationship Correct answer.

Explanation

The standard uses "business associate" for external parties such as contractors, suppliers, consultants, agents, and joint venture partners with whom the organization has or plans a business relationship. The concept matters because bribery risk often arises through third parties. Employees and regulators are not business associates in this sense.

Question 6Fundamental principles and concepts of an anti-bribery management system

ISO 37001 requires a bribery risk assessment. Which approach best reflects the standard's expectations for that assessment?

  1. A financial audit of the organization's accounts payable ledger
  2. A documented, periodic assessment that considers the nature and extent of bribery risks and is reviewed and updated when circumstances change Correct answer.
  3. A one-off assessment performed only at the time of initial certification
  4. A qualitative survey of employee opinions about ethical culture

Explanation

The standard requires the organization to identify and assess bribery risks on a documented and recurring basis, taking into account factors such as sector, country, transaction type, and business relationships. The assessment must be reviewed and updated when significant changes occur. A single event or a pure financial audit does not satisfy this requirement.

Question 7Fundamental principles and concepts of an anti-bribery management system

An organization discovers that a consultant engaged to win a public tender has made a payment to a procurement official. Under ISO 37001, which action best reflects the required response?

  1. Take appropriate action to address the nonconformity and the bribery, including investigation and remediation, and consider terminating the relationship Correct answer.
  2. Refer the matter to the certification body and take no further internal steps
  3. Continue the relationship but reduce the consultant's fee by the amount of the payment
  4. Take no action because the payment was made by a third party rather than an employee

Explanation

The standard requires organizations to respond to actual or suspected bribery by investigating, taking appropriate action, and remediating the situation. Third-party conduct does not remove the organization's responsibility, since bribery through intermediaries is within scope. Action may include terminating or suspending the relationship and considering reporting obligations.

Question 8Fundamental principles and concepts of an anti-bribery management system

Which control does ISO 37001 specifically require for higher-risk business associates?

  1. Publishing their financial statements on the organization's website
  2. Requiring them to purchase the same certification
  3. Conducting due diligence proportionate to the bribery risk they present and applying appropriate controls Correct answer.
  4. Excluding them from all communications with the organization's compliance function

Explanation

The standard requires due diligence on business associates that is proportionate to the risk they pose, together with appropriate controls. Higher-risk associates may require enhanced due diligence and contractual anti-bribery commitments. Certification status or financial disclosure is not the prescribed control.

Question 9Fundamental principles and concepts of an anti-bribery management system

Which statement best captures the standard's expectations for gifts, hospitality, and donations?

  1. They are always prohibited, regardless of value or context
  2. They are outside the scope of an anti-bribery management system
  3. They are permitted without restriction provided they are disclosed annually
  4. They must be managed through controls proportionate to risk, such as policy limits, prior approval, and recording Correct answer.

Explanation

ISO 37001 expects organizations to implement controls over gifts, hospitality, and donations, including limits, approval thresholds, and records. These measures help prevent them being used as a conduit for bribery. Absolute prohibition is a policy choice, not a requirement of the standard.

Question 10Fundamental principles and concepts of an anti-bribery management system

A compliance officer asks whether the anti-bribery management system should apply to all of the organization's activities. What does ISO 37001 require regarding scope?

  1. The scope must be defined and documented, and the standard applies to the activities, locations, and entities within that defined scope Correct answer.
  2. The scope must cover every legal entity in which the organization holds any financial interest
  3. The scope may be left undefined so the organization retains flexibility
  4. The scope must cover only activities in the organization's home country

Explanation

The standard requires the organization to define and document the scope of the management system, and the system applies to what is within that scope. The organization should consider its context and risk when determining scope. Leaving scope undefined or limiting it arbitrarily would undermine conformity.

Question 11Fundamental principles and concepts of an anti-bribery management system

What role does ISO 37001 assign to a compliance function with responsibility for the anti-bribery management system?

  1. It must be dissolved once certification is achieved
  2. It must report only to the sales director to align with commercial objectives
  3. It must have direct access to the governing body and adequate resources and authority to operate the system Correct answer.
  4. It must be staffed exclusively by external contractors

Explanation

The standard expects the organization to assign responsibility and authority for the anti-bribery management system to a function or person with adequate resources and direct access to the governing body. This supports independence and escalation. The function must be able to operate the system effectively and cannot be disbanded after certification.

Question 12Fundamental principles and concepts of an anti-bribery management system

Which of the following best describes the standard's requirement for anti-bribery training?

  1. Training must be provided only to senior executives
  2. Training must be delivered exclusively in a classroom setting
  3. Training is optional and may be replaced by a signed declaration
  4. Training must be provided to personnel whose roles present bribery risk, and the organization must retain records of it Correct answer.

Explanation

The standard requires training for personnel whose work presents a bribery risk, and the organization must maintain documented information of training activities. Training should be appropriate to the roles concerned. It is not limited to executives, and the standard does not prescribe a single delivery method.

Question 13Fundamental principles and concepts of an anti-bribery management system

What is the purpose of the anti-bribery due diligence on personnel that ISO 37001 requires?

  1. To evaluate the personal creditworthiness of all staff
  2. To assess the bribery risk associated with personnel in higher-risk roles before and during employment Correct answer.
  3. To verify each candidate's academic qualifications before hiring
  4. To replace the need for a code of conduct

Explanation

The standard requires due diligence on personnel where the role presents a bribery risk, both before appointment and during employment. This helps the organization place suitable people in sensitive positions. It is risk-based and is not a general background or credit check.

Question 14Fundamental principles and concepts of an anti-bribery management system

Which statement best reflects ISO 37001's expectations for raising concerns (whistleblowing)?

  1. Concerns must be reported only through the line manager
  2. Anonymous reporting must be prohibited to ensure accountability
  3. Reports may be submitted only after the bribery has been proven
  4. The organization must provide confidential reporting channels and protect those who report in good faith Correct answer.

Explanation

The standard requires the organization to establish procedures for raising concerns, including confidential channels and protection against retaliation for good-faith reporting. Reporting must be possible before any finding is established. The standard does not restrict reporting to a single route.

Question 15Fundamental principles and concepts of an anti-bribery management system

How does ISO 37001 treat the concept of "reasonable and proportionate" controls?

  1. Controls apply only to large multinational organizations
  2. Controls should be proportionate to the bribery risk the organization faces Correct answer.
  3. Controls must be identical across all organizations regardless of risk
  4. Controls should be minimized to reduce administrative cost

Explanation

The standard emphasizes that anti-bribery controls should be reasonable and proportionate to the risk, given the organization's size, sector, and operating context. This allows smaller or lower-risk organizations to apply lighter controls where justified. It does not permit controls to be minimized below what the risk requires.

Question 16Fundamental principles and concepts of an anti-bribery management system

Which of the following is an example of a "facilitation payment" as the term is commonly understood in anti-bribery practice?

  1. A performance bonus paid to a sales employee
  2. A small payment to a low-level official to speed up a routine administrative process Correct answer.
  3. A charitable donation approved by the board
  4. A fee paid to a law firm for legal advice

Explanation

Facilitation payments are small payments made to secure or expedite routine government actions to which the payer is already entitled. Many legal regimes prohibit them, and ISO 37001 expects organizations to prohibit or control them. Ordinary commercial payments and lawful fees are not facilitation payments.

Question 17Fundamental principles and concepts of an anti-bribery management system

Which of the following best describes the role of the governing body under ISO 37001?

  1. It is responsible only for the financial statements
  2. It approves every individual gift given by employees
  3. It personally conducts all due diligence on business associates
  4. It oversees the anti-bribery management system and receives reports on its performance Correct answer.

Explanation

The standard expects the governing body to oversee the anti-bribery management system and to be informed about its operation and effectiveness. It does not require the governing body to perform operational tasks such as individual due diligence or gift approvals. Oversight and direction are its core responsibilities.

Question 18Fundamental principles and concepts of an anti-bribery management system

A company wants to rely on ISO 37001 certification when bidding for a contract. What does certification actually demonstrate?

  1. That the organization has never experienced a bribery incident
  2. That the organization is exempt from anti-bribery laws in the countries where it operates
  3. That the organization's employees are individually certified as ethical
  4. That an independent body has assessed the organization's anti-bribery management system as conforming to the standard at the time of the audit Correct answer.

Explanation

Certification is an independent assessment that the management system conforms to ISO 37001 at the time of the audit. It does not guarantee that no bribery has occurred or will occur, and it does not exempt the organization from law. Individual employee conduct is not certified.

Question 19Fundamental principles and concepts of an anti-bribery management system

Which statement best explains why ISO 37001 requires the organization to consider its "context" when establishing the anti-bribery management system?

  1. Context analysis is only relevant to organizations operating in a single country
  2. Understanding internal and external factors helps the organization identify relevant bribery risks and design proportionate controls Correct answer.
  3. Context analysis is used to determine the organization's tax obligations
  4. Context analysis replaces the need for a documented anti-bribery policy

Explanation

The standard requires the organization to understand its internal and external context, including legal, cultural, and market factors that affect bribery risk. This understanding informs the risk assessment and the design of proportionate controls. It does not replace the policy or relate to tax matters.

Question 20Fundamental principles and concepts of an anti-bribery management system

Which of the following best reflects the relationship between ISO 37001 and other ISO management system standards?

  1. ISO 37001 shares the high-level structure used by other ISO management system standards, which facilitates integration Correct answer.
  2. ISO 37001 is entirely unrelated to other management system standards
  3. ISO 37001 requires organizations to abandon any existing ISO certifications
  4. ISO 37001 can only be implemented in isolation from quality and environmental systems

Explanation

ISO 37001 uses the harmonized high-level structure common to many ISO management system standards, which supports integration with systems such as quality or environmental management. Organizations are not required to abandon existing certifications. Integration can reduce duplication of effort.

Question 21Fundamental principles and concepts of an anti-bribery management system

An organization is considering whether to prohibit all political contributions. Which statement best reflects ISO 37001's treatment of political contributions?

  1. Political contributions should be controlled and, where the bribery risk is high, may be prohibited, given the risk of being used to obtain an undue advantage Correct answer.
  2. Political contributions are outside the scope of the standard
  3. Political contributions must be approved by the certification body
  4. Political contributions are always permitted if they are disclosed in the annual report

Explanation

The standard expects organizations to control political contributions because they can be used as a conduit for bribery. Where the risk is high, prohibition is an appropriate control. Annual disclosure alone does not manage the risk, and certification bodies do not approve contributions.

Question 22Fundamental principles and concepts of an anti-bribery management system

Which of the following best describes the "tone at the top" concept in ISO 37001?

  1. Top management sets a clear anti-bribery culture through its statements and behavior, which influences the rest of the organization Correct answer.
  2. Top management issues an annual statement without further involvement
  3. Top management delegates all anti-bribery matters to the compliance function
  4. Top management focuses only on financial performance metrics

Explanation

Tone at the top refers to the example set by top management through its communications and actions, which shapes the organization's anti-bribery culture. Delegation alone or a single annual statement does not create that culture. The standard expects visible and consistent leadership commitment.

Question 23Fundamental principles and concepts of an anti-bribery management system

Which of the following best describes the role of documented information in an ISO 37001 management system?

  1. Documentation is optional and may be omitted if the organization is small
  2. Documentation must be kept in paper form only
  3. Documented information provides evidence that processes are performed as planned and supports consistency and traceability Correct answer.
  4. Documentation exists solely to satisfy the certification body during audits

Explanation

The standard requires documented information to support the operation of the management system and to provide evidence of conformity. Documentation supports consistency and traceability, not just the audit. It may be in any appropriate medium, and its extent should be proportionate to the organization's context.

Question 24Fundamental principles and concepts of an anti-bribery management system

What is the purpose of the management review in an ISO 37001 system?

  1. To conduct individual performance appraisals of employees
  2. To review the performance and suitability of the anti-bribery management system and identify opportunities for improvement Correct answer.
  3. To approve the annual financial budget
  4. To replace internal audits

Explanation

Management review is a top-management activity that evaluates the continuing suitability, adequacy, and effectiveness of the anti-bribery management system. It considers inputs such as audit results and risk changes and produces decisions on improvement. It does not replace internal audit or deal with financial budgeting.

Question 25Fundamental principles and concepts of an anti-bribery management system

Which statement best describes how ISO 37001 addresses charitable donations and sponsorship?

  1. They are outside the scope of the anti-bribery management system
  2. They are always prohibited under the standard
  3. They should be subject to controls because they can be misused to channel bribes Correct answer.
  4. They are permitted without any controls if approved by the marketing department

Explanation

Charitable donations and sponsorship are recognized as potential conduits for bribery, so the standard expects organizations to apply controls such as due diligence and approval. They are not automatically prohibited, but they must be managed. Marketing approval alone is not a sufficient control.

Question 26Fundamental principles and concepts of an anti-bribery management system

Which term does ISO 37001 use for the person or body that directs and controls the organization at the highest level and is accountable for the anti-bribery management system?

  1. The internal audit team
  2. The compliance function
  3. The anti-bribery committee
  4. The governing body Correct answer.

Explanation

ISO 37001 places ultimate accountability for the anti-bribery management system on the governing body, the highest-level person or group that directs and controls the organization. The standard requires that body to demonstrate leadership and commitment rather than delegate responsibility away. Other roles support the system but do not hold this top-level accountability.

Question 27Fundamental principles and concepts of an anti-bribery management system

An organization is deciding how far its anti-bribery controls must extend to business associates such as agents, consultants, and joint-venture partners. Which principle in ISO 37001 governs that decision?

  1. Controls are only required where the associate is located outside the organization's home country
  2. Controls may be omitted where the associate has signed a general code of conduct
  3. Controls must be reasonable and proportionate to the bribery risk the associate presents Correct answer.
  4. Controls must be identical for every associate regardless of the risk involved

Explanation

ISO 37001 requires controls over business associates to be reasonable and proportionate to the nature and level of bribery risk they represent. Higher-risk associates therefore attract more intensive due diligence, contractual requirements, and monitoring, while lower-risk relationships may need lighter measures. A uniform or purely geographic approach does not reflect the standard's risk-based logic.

Question 28Fundamental principles and concepts of an anti-bribery management system

A newly appointed anti-bribery compliance officer must ensure the organization's anti-bribery policy is understood and applied at every level. According to ISO 37001, how should the policy be made available?

  1. It should be documented and communicated throughout the organization and made available to relevant interested parties as appropriate Correct answer.
  2. It should be communicated verbally by line managers without any documented form
  3. It should be kept confidential to the governing body to avoid creating legal exposure
  4. It should be published only to external regulators on request and withheld from employees

Explanation

ISO 37001 requires the anti-bribery policy to be established, documented, and communicated within the organization, and made available to relevant interested parties as appropriate. Documented communication ensures employees and associates understand expectations and can be held to them. Concealment or purely verbal transmission would undermine the policy's preventive purpose.

Question 29Fundamental principles and concepts of an anti-bribery management system

An organization has strong anti-bribery procedures on paper, but senior managers routinely approve high-risk payments outside those procedures and no one challenges them. Which conclusion best reflects ISO 37001's requirements?

  1. The system is deficient because leadership must actively support and be seen to comply with the anti-bribery management system, not merely endorse it on paper Correct answer.
  2. The system is compliant because documented procedures exist and are formally approved
  3. The system is compliant provided the payments are recorded in the financial accounts
  4. The system is deficient only if a regulator has already identified the payments as improper

Explanation

ISO 37001 requires top-level leadership and commitment that is demonstrated in practice, including ensuring the system is integrated into processes and that senior personnel do not override controls. Documented procedures that are routinely bypassed by management indicate a failure of leadership commitment and system effectiveness. Compliance is judged by whether the system actually operates, not by paperwork alone or by waiting for external detection.

Question 30Anti-bribery management system requirements

Under ISO 37001, which document establishes the organization's obligation to prohibit bribery and states the governing principles for the anti-bribery management system?

  1. The risk assessment register
  2. The anti-bribery policy Correct answer.
  3. The internal audit programme
  4. The due diligence procedure

Explanation

ISO 37001 requires top management to establish an anti-bribery policy that prohibits bribery, is appropriate to the organization's purpose, and provides a framework for setting anti-bribery objectives. The policy is the governing statement of commitment from which other procedures flow. Risk registers, due diligence procedures and audit programmes are supporting mechanisms, not the governing policy statement.

Question 31Anti-bribery management system requirements

ISO 37001 requires the organization to designate responsibility and authority for the anti-bribery management system. Which arrangement satisfies this requirement?

  1. A designated compliance function with authority, independence and direct access to the governing body Correct answer.
  2. A rotating committee of line managers who handle bribery concerns alongside production duties
  3. An external law firm retained only when a bribery allegation arises
  4. Assignment to the finance director because bribery risks are financial in nature

Explanation

The standard requires a function or person with responsibility and authority for the anti-bribery management system, adequate resources, and direct access to the governing body where needed. Independence matters because the responsible function must be able to report concerns without management filtering. Ad hoc arrangements or purely external support do not meet the structural requirement.

Question 32Anti-bribery management system requirements

An organization wants to give its anti-bribery compliance function the authority to reject a proposed sales contract with a high-risk intermediary. Which ISO 37001 concept does this illustrate?

  1. Authority and independence of the compliance function Correct answer.
  2. Management review of the anti-bribery management system
  3. Communication of the anti-bribery policy to business associates
  4. Continual improvement of the anti-bribery management system

Explanation

The standard expects the function responsible for the anti-bribery management system to have sufficient authority and independence to intervene when bribery risk is unacceptable, including the ability to block or escalate transactions. Management review and continual improvement are separate clauses about oversight and enhancement over time. Communicating the policy concerns awareness, not decision rights.

Question 33Anti-bribery management system requirements

Which statement best describes how ISO 37001 treats the relationship between the anti-bribery management system and the organization's existing management systems?

  1. It applies only to organizations with no other certified management system
  2. It may be integrated with existing management systems provided the anti-bribery requirements remain satisfied Correct answer.
  3. It replaces existing quality and environmental systems entirely
  4. It must be maintained as a fully separate standalone system with no shared processes

Explanation

ISO 37001 is structured to be compatible with other management system standards, so organizations may integrate processes such as document control, internal audit and management review. Integration is permitted as long as the anti-bribery requirements are still met. There is no requirement for a standalone system, and the standard does not displace other disciplines.

Question 34Anti-bribery management system requirements

During context analysis, an organization determines that it has no direct operations in high-corruption jurisdictions but sells through agents in several of them. What is the appropriate ISO 37001 response?

  1. Exclude those markets from the system because the organization has no local operations
  2. Limit the system to head-office activities and treat agent conduct as outside its control
  3. Defer the analysis until a bribery incident occurs in those markets
  4. Include the intermediary-related bribery risk in the scope of the anti-bribery management system Correct answer.

Explanation

Context analysis must consider the organization's activities, business relationships and the environments in which it operates, including indirect exposure through intermediaries. Risk arising from agents in high-corruption markets therefore falls within scope and must be managed through due diligence and controls. Geographic absence of owned operations does not remove the exposure.

Question 35Anti-bribery management system requirements

What is the primary purpose of the bribery risk assessment required by ISO 37001?

  1. To identify and evaluate the organization's bribery risks so that proportionate controls can be planned Correct answer.
  2. To calculate the maximum fine the organization could face under applicable law
  3. To replace the need for due diligence on individual transactions
  4. To produce a public disclosure of every third party the organization deals with

Explanation

The risk assessment identifies bribery risks relevant to the organization's activities and evaluates them so that controls are proportionate and targeted. It is an internal planning tool, not a public register or a legal penalty calculation. It informs due diligence but does not substitute for it.

Question 36Anti-bribery management system requirements

An organization's risk assessment identifies facilitation payments to customs officials as a recurring risk. Which approach is consistent with ISO 37001?

  1. Authorize facilitation payments up to a fixed monthly ceiling per country
  2. Leave facilitation payments to local management discretion without documentation
  3. Prohibit facilitation payments and require escalation when officials demand them Correct answer.
  4. Permit small facilitation payments as long as they are recorded in the accounts

Explanation

ISO 37001 treats facilitation payments as a form of bribery risk and expects the organization to prohibit them, with clear guidance on what to do when they are demanded. Recording a payment does not make it acceptable under the standard's prohibition of bribery. Discretionary or capped allowances undermine the control environment.

Question 37Anti-bribery management system requirements

How does ISO 37001 require the organization to keep its bribery risk assessment current?

  1. Review and update it at planned intervals and when significant changes occur Correct answer.
  2. Repeat it only when an external auditor requests evidence
  3. Refresh it once at initial certification and then leave it unchanged
  4. Update it only after a confirmed bribery prosecution

Explanation

Risk assessments must be reviewed and updated at planned intervals and whenever significant changes affect the organization, such as new markets, new business relationships or regulatory shifts. This keeps controls aligned with the actual risk profile. Waiting for audits or prosecutions leaves the system reactive.

Question 38Anti-bribery management system requirements

Which activity is the clearest example of the due diligence ISO 37001 requires on a business associate?

  1. Assessing the associate's bribery risk and integrity before entering the relationship and periodically thereafter Correct answer.
  2. Obtaining the associate's marketing brochure and product catalogue
  3. Reviewing the associate's social media followers
  4. Confirming the associate's tax registration number only

Explanation

Due diligence under the standard is risk-based evaluation of business associates' bribery risk and commitment to anti-bribery, carried out before engagement and refreshed periodically. It focuses on integrity, ownership, reputation and control environment. Administrative or marketing data alone does not address bribery exposure.

Question 39Anti-bribery management system requirements

Due diligence reveals that a proposed distributor is owned by a close relative of a government official responsible for awarding the relevant licences. What is the most appropriate ISO 37001 response?

  1. Ask the official to confirm in writing that no conflict exists
  2. Proceed but reduce the commission rate to lower the risk score
  3. Proceed because the distributor is legally registered and pays taxes
  4. Escalate the conflict and decline or apply enhanced controls before proceeding Correct answer.

Explanation

A connection between a business associate's ownership and a decision-making official is a red flag requiring escalation and either avoidance or enhanced mitigation. Legal registration and tax compliance do not neutralize the conflict of interest. Seeking confirmation from the official involved compounds the risk rather than resolving it.

Question 40Anti-bribery management system requirements

ISO 37001 requires controls over gifts, hospitality and donations. Which control design best reflects the standard?

  1. A ban on all gifts and hospitality regardless of value or context
  2. A documented policy with thresholds, pre-approval and registers so that gifts and hospitality are transparent and proportionate Correct answer.
  3. Verbal guidance from managers so that practices remain flexible
  4. Approval by the recipient of their own hospitality requests

Explanation

The standard expects proportionate, documented controls so gifts, hospitality and donations cannot be used to disguise bribery. Thresholds, pre-approval and registers provide transparency and accountability. Blanket bans may be impractical, while verbal or self-approved arrangements lack the required control.

Question 41Anti-bribery management system requirements

A department wants to sponsor a community event hosted by an entity that is bidding for a public contract the organization is pursuing. Which control most directly addresses the ISO 37001 concern?

  1. Make the sponsorship in cash to avoid administrative paperwork
  2. Announce the sponsorship publicly after it has been paid
  3. Assess the donation or sponsorship for bribery risk and obtain independent approval before committing Correct answer.
  4. Rely on the marketing team's judgement because sponsorship is a commercial decision

Explanation

Donations and sponsorships can be vehicles for bribery, particularly where they intersect with public procurement. The standard requires risk assessment and approval by someone independent of the business interest. Cash payments and post-hoc publicity do not provide the necessary pre-commitment control.

Question 42Anti-bribery management system requirements

What does ISO 37001 require regarding the organization's financial and commercial controls as an anti-bribery measure?

  1. A single annual reconciliation performed by the sales team
  2. Controls that ensure transactions are accurately recorded, approved and traceable, with particular attention to high-risk payments Correct answer.
  3. Delegation of payment approval to the counterparty's finance staff
  4. Removal of all cash transactions from the business model

Explanation

The standard expects financial and commercial controls that prevent and detect bribery, including accurate records, segregation of duties, approval limits and scrutiny of high-risk payments such as commissions and political contributions. Controls must be operational and auditable. Delegating approval to counterparties or relying on self-reconciliation defeats the purpose.

Question 43Anti-bribery management system requirements

Which arrangement best satisfies ISO 37001 expectations for controlling high-risk intermediaries such as sales agents?

  1. Oral assurances of ethical conduct from the agent's managing director
  2. Commission rates set well above market to secure loyalty
  3. Contracts that omit termination clauses to preserve the relationship
  4. Written agreements with anti-bribery commitments, commission benchmarks and audit or termination rights Correct answer.

Explanation

The standard expects business associates to be bound by anti-bribery commitments and subject to monitoring, with contractual rights to audit and terminate. Commissions should be proportionate to legitimate services because excessive payments can fund improper benefits. Oral assurances and relationship-protective terms weaken control.

Question 44Anti-bribery management system requirements

ISO 37001 addresses gifts and hospitality but also requires controls over political and charitable contributions. Why are these treated as bribery risks?

  1. They can be used to obtain improper advantage and therefore require assessment, approval and recording Correct answer.
  2. They are relevant only to government-owned organizations
  3. They fall outside the anti-bribery management system once publicly disclosed
  4. They are prohibited outright in all circumstances by the standard

Explanation

Contributions and donations can conceal improper benefits to decision-makers, so the standard requires them to be assessed, approved and recorded. They are not banned outright; the requirement is controlled management. Public disclosure does not remove the need for pre-approval and risk assessment.

Question 45Anti-bribery management system requirements

Which statement correctly describes the ISO 37001 requirement for raising concerns (whistleblowing)?

  1. Reports must be submitted only through the line manager
  2. Concerns must be published internally with the reporter's name
  3. Anonymous reports must be rejected to ensure accountability
  4. Confidential reporting channels must be available and concerns must be handled without retaliation Correct answer.

Explanation

The standard requires procedures that encourage and enable personnel to report suspected bribery in confidence and without fear of retaliation. Reporting should not be restricted to a single channel that may be conflicted. Protecting reporter identity supports, rather than undermines, accountability.

Question 46Anti-bribery management system requirements

An employee reports a suspected bribe to the compliance function and is subsequently moved to a less desirable role. How should the organization respond under ISO 37001?

  1. Treat the transfer as potential retaliation, investigate it and protect the reporter Correct answer.
  2. Close the original bribery concern because the reporter is now unreliable
  3. Ask the reporter to withdraw the concern to resolve the dispute
  4. Take no action because the transfer was a legitimate management decision

Explanation

The standard requires protection of people who raise concerns in good faith, and retaliation is itself a failure of the reporting system. A detrimental change following a report must be examined and remedied. Closing the underlying concern or pressuring withdrawal compounds the failure.

Question 47Anti-bribery management system requirements

What does ISO 37001 require of the organization's training and awareness activities on anti-bribery?

  1. A single induction briefing for all staff regardless of role
  2. Training appropriate to roles and bribery risk, delivered to personnel and, where relevant, business associates Correct answer.
  3. Training limited to the compliance team
  4. Optional self-study with no records kept

Explanation

The standard requires awareness and training proportionate to roles and the bribery risks people face, with records as evidence. High-risk roles such as sales, procurement and those dealing with officials need more targeted training. One-size-fits-all or optional arrangements without records do not demonstrate the required competence and awareness.

Question 48Anti-bribery management system requirements

A procurement manager who negotiates with state-owned suppliers has received no anti-bribery training, while administrative staff have completed a general module. What gap does this represent under ISO 37001?

  1. No gap exists because training was delivered somewhere in the organization
  2. Training is not proportionate to the higher bribery risk of the procurement role Correct answer.
  3. The gap concerns only documentation, not the substance of training
  4. The gap is irrelevant because state-owned suppliers are subject to their own controls

Explanation

The standard requires training to be appropriate to the roles and risks involved, so personnel facing elevated exposure need targeted content. Delivering generic training elsewhere in the organization does not cover the high-risk function. Documentation matters, but the primary deficiency here is substantive and risk-based.

Question 49Anti-bribery management system requirements

ISO 37001 requires the organization to implement controls over its business associates. What does this most directly involve?

  1. Requiring associates to adopt ISO 37001 certification as a condition
  2. Transferring responsibility for bribery risk entirely to the associate
  3. Applying anti-bribery commitments and monitoring proportionate to the associate's risk Correct answer.
  4. Reviewing associates only when a contract is renewed

Explanation

The standard expects the organization to seek anti-bribery commitments from business associates and to monitor them in a way proportionate to risk. Certification is not a precondition, and responsibility cannot be outsourced. Monitoring only at renewal leaves risk unmanaged between reviews.

Question 50Anti-bribery management system requirements

How should ISO 37001's requirement for documented information be understood in relation to the anti-bribery management system?

  1. The organization must retain documented information necessary for the effectiveness of the system and as evidence of results Correct answer.
  2. Documentation is required only for externally certified processes
  3. Records may be discarded once the financial year closes
  4. Every decision must be recorded in a single central register regardless of relevance

Explanation

The standard requires documented information needed to support the operation of the system and to serve as evidence of results, with control over its creation, updating and retention. It does not mandate a single central register for everything, nor does it permit premature disposal. Documentation requirements are tied to the system's effectiveness and conformity.