Six Weeks to Stage 2

On the evidence, proceeding as planned is high risk and probably premature. A certification body will expect the ABMS to be implemented across the stated scope, with recent internal audit and management review, a current risk assessment, and nonconformities managed. The internal audit is 13 months old, covered only head office, and left 9 findings open; that does not demonstrate coverage of Country B or effective correction. The management review is 11 months old with no retained minutes, so there is no evidence that top management reviewed performance. The risk assessment predates a significant acquisition, and the new ABMS owner has no documented handover. The scope also excludes a franchise that uses the brand and procedures. I would recommend postponing Stage 2 or, if the certification body agrees, using the six weeks for a focused internal audit covering both countries and the acquisition, a management review, a risk-assessment update, closure or justification of findings, and documented handover. Expect a major nonconformity if the audit proceeds unchanged.

The starting point is control and influence, not convenience. A franchisee is a separate legal entity, so it may be outside the ABMS boundary if the group genuinely does not control its operations. But the franchise uses the group's brand and operating procedures, which creates bribery risk that can be attributed to the group and affects its reputation. Excluding Country C is permissible only if the scope statement is accurate and the exclusion is not being used to hide risk. The group should define interface controls: anti-bribery obligations in the franchise agreement, training, due diligence, audit rights, incident reporting, and termination rights. If those controls are absent, the exclusion is weak. Certification cannot claim coverage of Country C, and the group should not imply that it does. A risk-based decision may be to include franchise oversight in scope even if the franchisee itself is not certified.

The audit lacks objectivity. The finance manager approves third-party payments, so the manager was auditing a control for which they have operational responsibility. ISO 37001 expects internal audits to be conducted by competent and impartial auditors, and an auditor should not audit their own work. The findings may still be factually useful, but their credibility is weakened, and the certification body will question the audit programme. The group should have the audit re-performed or supplemented by an independent auditor or a cross-functional team with relevant ABMS competence, reporting to the board or audit committee. The audit scope must cover the full certification scope, including Country B and the acquired customs brokerage. This is also a corrective action for the audit process itself, not just a scheduling problem.