ISO 37001 LA study plan

Define bribery and related terms (facilitation payments, extortion, kickbacks) as used in ISO 37001 and distinguish them from gifts and hospitality.

Explain the purpose and structure of an anti-bribery management system (ABMS) and how it follows the ISO High-Level Structure.

Map the core concepts of ISO 37001 (risk-based approach, due diligence, top management commitment) to the Plan-Do-Check-Act cycle.

Identify the mandatory clauses of ISO 37001 and their interrelationships (e.g., leadership, planning, support, operation, performance evaluation, improvement).

Outline the specific requirements of ISO 37001 clauses 4–6 (context, leadership, planning) and explain how they apply to an organization.

Describe the requirements for anti-bribery policy, roles and responsibilities, and the anti-bribery compliance function.

Explain the risk assessment process and how to integrate bribery risk into the organization's overall risk management.

List the documented information required for planning and leadership, and explain why each is necessary.

Detail the support and operation requirements (clauses 7–8), including resources, competence, awareness, communication, and documented information.

Explain the due diligence requirements for projects, business associates, and personnel, and how to determine the level of due diligence.

Describe the controls required for gifts, hospitality, donations, and facilitation payments, and how to manage them.

Outline the requirements for reporting concerns (whistleblowing) and investigating bribery allegations.

Explain the performance evaluation and improvement requirements (clauses 9–10), including monitoring, measurement, internal audit, management review, and corrective action.

Define the fundamental audit concepts: audit criteria, evidence, findings, and the difference between audit and inspection.

Describe the principles of auditing per ISO 19011: integrity, fair presentation, due professional care, confidentiality, independence, and evidence-based approach.

Outline the audit process (initiating, preparing, conducting, reporting, closing, follow-up) and the roles of audit team and client.

Explain how to initiate an audit: define objectives, scope, criteria, and feasibility, and establish communication with the auditee.

Describe how to prepare an audit plan, including sampling strategy, resource allocation, and risk-based prioritization.

Develop audit checklists and working documents based on ISO 37001 requirements and the organization's context.

Identify the roles and responsibilities of the audit team, technical experts, and observers, and how to manage conflicts of interest.

Conduct opening meetings and apply effective interviewing techniques to collect audit evidence.

Gather and verify evidence through document review, observation, and interviews, ensuring it is sufficient, relevant, and reliable.

Evaluate evidence against audit criteria to determine conformity, nonconformity, and opportunities for improvement.

Document findings clearly, including writing nonconformity statements with evidence and criteria references.

Prepare audit conclusions and conduct closing meetings, including presenting findings and resolving disagreements.

Write an audit report that meets ISO 19011 requirements, including scope, objectives, findings, and conclusions.

Explain the follow-up process for corrective actions and how to verify their effectiveness.

Describe the audit closure steps, including document retention and feedback to the audit team.

Explain how to establish and manage an audit program, including objectives, risks, and resources.

Describe the process for selecting audit team members and ensuring their competence, including ongoing professional development.

Monitor and review the audit program, including performance indicators and improvement actions.

Integrate the audit program with other management system audits and consider the organization's context and risks.