ISO 37001 LI common mistakes
ISO 37001 LI · Understand the traps and how to avoid them.
Treating ISO 37001 as a document-writing exercise: answering scenario questions by listing which policies, registers and forms must exist, rather than describing how the organisation identifies, assesses and treats bribery risk and how the controls actually operate.
Candidates often study the standard by memorising clause headings and the named documents (anti-bribery policy, gift register, due diligence file), because that is the easiest way to revise. The exam, however, tests understanding of the management-system logic - risk-based controls, top management leadership, due diligence, and monitoring - so a document-checklist answer misses the point of the question.
What to do instead
For every clause, practise converting it into a 'what happens, who does it, what evidence shows it works' statement. When answering, lead with the process and the risk rationale, then mention the documented information only as evidence that the process exists.
Confusing ISO 37001's role with that of a certification body or with legal advice: describing the ABMS as guaranteeing that no bribery occurs, or as establishing legal compliance with the UK Bribery Act, FCPA or other statutes.
The standard is a management-system standard built on reasonable and proportionate anti-bribery controls; it explicitly does not provide assurance that no bribery has occurred or will occur, and it does not substitute for legal obligations. Candidates who blur this boundary pick answers that overstate what certification proves.
What to do instead
Memorise the two boundaries: ISO 37001 addresses the design and operation of an anti-bribery management system (reasonable and proportionate controls), while legal compliance is a separate matter for the organisation's legal advisers and regulators. Practise spotting answer options that promise 'zero bribery' or 'legal compliance' and eliminate them.
Skipping or superficially performing the context and risk-assessment steps at initiation: jumping straight to writing a policy and appointing a compliance function without defining the scope, identifying interested parties, or assessing bribery risk.
Candidates who have implemented other management systems assume the early clauses are administrative formalities. In ISO 37001 the bribery risk assessment is the engine that drives the appropriateness of all later controls, so questions about initiation turn on scope, context and risk, not on document templates.
What to do instead
Build a mental sequence for initiation: understand the organisation and its context, determine the scope of the ABMS, identify bribery risks (including through third parties and business associates), then design controls proportionate to those risks. In scenario questions, always ask whether the organisation has defined scope and assessed risk before choosing a control-based answer.
Treating the bribery risk assessment as a one-off project deliverable produced at the start of implementation, rather than a recurring process that is reviewed when circumstances change and feeds monitoring and improvement.
Risk assessment is often completed once to satisfy an auditor or a project plan. Candidates then answer questions as if the assessment is static, missing the standard's expectation that it is reviewed at planned intervals and when significant changes occur (new markets, new business associates, mergers, new products).
What to do instead
Remember the risk assessment as a living cycle: identify, analyse, evaluate, treat, and review. Link it explicitly to changes in context and to the monitoring and improvement clauses, and in exam scenarios ask what event should trigger a reassessment.
Designing controls without proportionality: recommending maximum controls everywhere (full due diligence on every supplier, gifts banned outright, every transaction approved at board level) instead of controls proportionate to the assessed bribery risk.
Candidates equate 'stronger' with 'better' and fear that a graded answer looks lenient. ISO 37001 requires controls that are reasonable and proportionate to the risk, so blanket maximal controls can be marked wrong because they are neither risk-based nor sustainable, and they may push legitimate business activity outside the system.
What to do instead
Anchor every control recommendation to a stated risk level. Practise writing answers of the form 'for high-risk third parties, enhanced due diligence; for low-risk, simplified checks', and check that each control you propose can be traced back to an identified risk.
Misdescribing the roles of top management, the governing body and the compliance function: assuming the anti-bribery compliance function can own the ABMS, or that top management's role is limited to approving the policy.
The standard separates governance (the governing body oversees), leadership (top management ensures the ABMS is integrated into processes and resourced), and operation (the compliance function advises, monitors and reports but does not replace line management accountability). Candidates collapse these into one role and then choose answers that give the compliance officer decision-making authority they should not have.
What to do instead
Draw a three-column map: governing body (oversight, receives reports), top management (leadership, resources, integration into business processes), compliance function (advice, guidance, monitoring, reporting, with direct access to the governing body). Test each answer option against that map.
Confusing due diligence with monitoring or with a one-time onboarding check: describing due diligence as a single pre-contract screening step and failing to recognise it as an ongoing, risk-based process applied to business associates and personnel, with results feeding decisions on the relationship.
Due diligence is often reduced in candidates' minds to a form filled in at supplier onboarding. The standard frames it as a continuing process proportionate to risk, applied before and during the relationship, with outcomes used to decide whether to proceed, impose conditions, or exit.
What to do instead
Study due diligence as a cycle: assess the risk of the relationship, gather information proportionate to that risk, evaluate it, decide and record the decision, and re-run at defined intervals or on trigger events. In questions, look for the word 'ongoing' and for what the organisation does with the due diligence findings.
Treating monitoring and internal audit as interchangeable, or assuming the compliance function can audit its own work: answering that the compliance officer performs the audit of the ABMS, or that monitoring is sufficient without independent review.
Both activities produce assurance, so candidates merge them. ISO 37001 distinguishes monitoring (ongoing checks by the compliance function and management) from internal audit (independent, objective review), and independence is the point of the distinction; an answer that has the compliance function auditing its own controls is a classic trap.
What to do instead
Memorise the contrast: monitoring is continuous, performed by those responsible for the controls, and feeds corrective action; internal audit is periodic, independent of the activity audited, and reports to the governing body. When a question asks who should review the compliance function's own performance, the answer is independent audit or an equivalent independent review.
Treating nonconformity and corrective action as paperwork closure: answering that a nonconformity is resolved by updating the procedure document, without addressing the root cause, the effect on existing controls, or verification that the corrective action worked.
Candidates revise corrective action as a form with fields, not as a causal process. The standard expects the organisation to react to the nonconformity, evaluate the need to eliminate the cause, implement action, review effectiveness, and update the risk assessment if needed - and exam questions probe exactly those steps.
What to do instead
Learn the corrective-action sequence as a chain: contain and correct, determine cause, assess whether similar nonconformities exist elsewhere, plan and implement action, review effectiveness, and feed back into risk assessment and the ABMS. Rehearse a short worked example so the sequence is automatic.
Approaching the certification audit as a document review: preparing by assembling policies and records, without being able to explain how the ABMS operates in practice, what evidence demonstrates effectiveness, or how the organisation handles the audit's sampling and interviews.
Candidates who have only read the standard assume certification is a paperwork check. Certification audits test implementation and effectiveness through interviews, sampling and tracing, so a candidate who cannot describe the evidence trail from risk assessment to control to monitoring to improvement will misjudge preparation questions.
What to do instead
Prepare as if you were the organisation: for each clause, identify the process, the owner, the records that evidence it, and a concrete example of it operating. Practise tracing one high-risk scenario (for example a high-risk agent engagement) end to end through risk assessment, due diligence, approval, monitoring and review.
Misreading question stems that ask for the 'most appropriate' or 'first' action: choosing a technically correct control or a later-stage activity when the question is testing sequence or proportionality within the ABMS lifecycle.
ISO 37001 questions frequently hinge on ordering (context before scope, risk assessment before controls, monitoring before improvement) and on proportionality. Candidates who answer from general anti-bribery knowledge rather than from the standard's process logic select a plausible but out-of-sequence option.
What to do instead
Before choosing, identify which lifecycle stage the stem is testing and eliminate options that belong to a different stage. Where two options are both valid, prefer the one that is risk-based, proportionate and traceable to the clause being examined.