Evaluation of the performance of an ABMS based on ISO 37001
What this domain tests
Clause 9: monitoring, measurement, analysis and evaluation; internal audit; management review. Questions usually probe what should be measured, who may audit what, and which inputs a management review must consider.
Monitoring and measurement (9.1)
Decide what to monitor, the methods, when it is done and when results are analysed and evaluated. Useful measures combine leading and lagging indicators: percentage of high-risk business associates due-diligenced on time, training completion and pass rates, number of gifts approved versus declined, time to close investigations, incidents reported, and control-test results. Results must be documented and used - a dashboard nobody acts on fails the intent.
Internal audit (9.2)
The organization runs a risk-based audit programme at planned intervals. Auditors must be objective and impartial; the ABCF should not audit its own work, and an auditor should not review an activity they manage. The programme should cover the full scope of the ABMS over the cycle, not only the comfortable clauses. Findings go to the ABCF and relevant management, and feed corrective action.
Management review (9.3)
Required at planned intervals. Typical inputs: status of actions from previous reviews, changes in external and internal issues, bribery risk assessment results, performance against objectives, monitoring results, audit results, incidents and investigations, concerns raised, and resource adequacy. Outputs must include decisions and actions on improvement and on resources - a review with no decisions does not satisfy the clause.
Worked example
An internal audit finds that 30% of high-risk business associates have no due diligence record. Correct handling: raise a nonconformity, investigate the cause (no named owner for due diligence in two regions), assign ownership, set a remediation plan with deadline, and verify effectiveness at the next audit. Management review then receives the finding, the root cause and the resourcing decision needed.
Traps
Measuring only incident counts; the ABCF auditing its own function; an audit programme that never reaches high-risk operations; management review recorded as a slide deck with no decisions or actions.