Managing an ISO 37001 audit program
What the domain tests
This domain tests the audit program: the set of audits planned for a period, not a single audit plan. Expect questions on program objectives, risk-based frequency, resources, competence, independence, monitoring and review.
Core rules
- Establish program objectives aligned with the organization’s bribery risk and ABMS scope.
- Determine audit frequency and depth by risk, results of previous audits, changes and complaints-not by a fixed annual calendar alone.
- Assign a program manager with authority, resources and access to top management.
- Ensure auditor competence in ISO 37001, the sector, laws and audit methods; avoid auditors auditing their own area.
- Define program processes: planning, scheduling, resourcing, records, reporting and follow-up.
- Monitor and review the program for effectiveness, coverage and emerging risks; feed results into management review and improvement.
Worked example
A group has high-risk operations in two countries and low-risk domestic sales. A flat annual cycle treats every site the same. A risk-based program audits the high-risk entities every year, adds follow-up audits after major findings, and uses a lower frequency for the stable domestic unit. It also assigns an auditor with public-procurement experience to the high-risk tenders.
Traps
Calling a schedule an audit program; auditing every area at the same frequency; using an auditor who recently managed the area being audited; ignoring prior findings when setting frequency; and reviewing the program only when an audit fails.