Preparation for an ABMS certification audit
What this domain tests
The exam tests certification mechanics, readiness evidence, and the difference between conformity and legal compliance. Know the two-stage process and what each stage examines.
Certification basics
ISO 37001 is a certifiable management system standard. Certification is granted by an independent, accredited certification body operating to ISO/IEC 17021-1, with auditors competent in anti-bribery. The certificate covers the organization's defined ABMS scope. It is a point-in-time opinion that the ABMS conforms to the standard - not a guarantee that no bribery will occur and not legal advice.
Readiness evidence
Before Stage 1 you should hold: the anti-bribery policy, documented risk assessment, due diligence records, training and competence records, gift and hospitality approvals, investigation and incident logs, a completed internal audit covering the full scope, management review minutes with decisions, and closed corrective actions with effectiveness evidence. Auditors test operation, not just documents: expect interviews and transaction sampling.
Stage 1 and Stage 2
Stage 1 reviews readiness - scope, documentation, whether internal audit and management review have been performed - and flags concerns. Stage 2 tests implementation effectiveness through sampling, observation and interviews. Findings are graded, typically as major or minor nonconformities; a major nonconformity generally blocks certification until correction and effectiveness evidence are accepted.
Worked example
During Stage 2 the auditor samples five high-risk agents and finds no due diligence on any. This is a major nonconformity: it shows a system failure in a Clause 8.2 process, not an isolated slip. The organization must correct, analyse the cause, implement corrective action, provide evidence of effectiveness, and be re-assessed before the certification decision. Presenting a newly written procedure alone would not close it.
Traps
Assuming certification equals legal compliance; concealing incidents, which sampling usually reveals; a risk assessment older than the last significant change; an ABCF without independence; no management review before Stage 1; treating Stage 1 as a formality that requires no preparation.