Preparing an ISO 37001 audit
What the domain tests
Preparation questions test whether you can turn an audit program into a specific ISO 37001 audit: objectives, scope, criteria, team, plan, sampling and working documents. The exam expects risk-based preparation, not a generic checklist.
Core steps
- Define audit objectives, scope and criteria with the client; confirm sites, shifts, entities and exclusions.
- Review the ABMS documentation: policy, scope, risk assessment, due diligence records, controls, investigation logs, internal audit results and management review.
- Review prior findings and changes affecting bribery risk-new markets, agents, mergers, laws.
- Build an audit plan with dates, areas, interviewees, auditor assignments and time allocation. Allocate more time to high-risk processes.
- Design a sampling plan by risk: high-risk agents, gifts, donations, public officials, procurement and payments.
- Prepare working documents that reference criteria and leave space for evidence; brief the team on roles and confidentiality.
Worked example
A manufacturer has a small sales office in a high-risk country and a large low-risk domestic distributor. A weak plan would sample by transaction value and spend most time domestically. A risk-based plan samples the high-risk agents, facilitation payments, government tenders and third-party due diligence, and reserves interview time with the compliance function and finance.
Traps
Confusing the audit plan with the audit program; writing a checklist without linking it to ISO 37001 clauses; ignoring the risk assessment; planning only document review; and failing to confirm scope and criteria before fieldwork.