I85PREP
⌘ K
PECB ISO 37001 Foundation study materials
PECB ISO 37001 Foundation study resources

PECB ISO 37001 Foundation practice questions

One question at a time. Build your PECB ISO 37001 Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of an anti-bribery management system – ABMS

In ISO 37001, what is the primary purpose of an anti-bribery management system (ABMS)?

  1. To replace the organization's legal obligations with voluntary commitments
  2. To help an organization prevent, detect and respond to bribery through a structured set of controls Correct answer.
  3. To certify individual employees as personally immune from bribery liability
  4. To guarantee that no bribery incident will ever occur inside the organization

Explanation

An ABMS is a structured framework of policies, controls, responsibilities and monitoring designed to help an organization prevent, detect and address bribery. It supports compliance with legal duties but does not replace them and cannot guarantee that bribery will never happen.

Question 2Fundamental principles and concepts of an anti-bribery management system – ABMS

Which statement best reflects the definition of bribery under ISO 37001?

  1. Offering, promising, giving, accepting or soliciting an undue advantage of any value, directly or indirectly, to influence someone's conduct Correct answer.
  2. Any commercial negotiation in which one party gains a price advantage
  3. A payment made to a government agency that is required by written law
  4. A gift exchanged between colleagues during a public holiday

Explanation

ISO 37001 defines bribery as offering, promising, giving, accepting or soliciting an undue advantage of any value, directly or indirectly, as an inducement or reward to influence the conduct of a person. The key elements are the undue advantage and the intent to influence.

Question 3Fundamental principles and concepts of an anti-bribery management system – ABMS

ISO 37001 distinguishes between bribery by the organization and bribery of the organization. Which situation illustrates bribery of the organization?

  1. An employee offers cash to a customs officer to speed up a shipment
  2. An intermediary is engaged to channel money to a client's purchasing agent
  3. A supplier pays a kickback to a procurement manager so that invoices are approved without review Correct answer.
  4. A director authorizes a payment to a foreign official to win a public tender

Explanation

Bribery of the organization occurs when someone offers, promises or gives an undue advantage to a person associated with the organization, such as an employee, to influence that person's conduct. The supplier paying a kickback to a procurement manager is an example of the organization being the recipient side of the bribe.

Question 4Fundamental principles and concepts of an anti-bribery management system – ABMS

According to ISO 37001, what does the term 'public official' cover?

  1. Any person holding a legislative, administrative or judicial office, or performing a public function, including employees of public enterprises Correct answer.
  2. Only individuals who personally sign government contracts
  3. Only employees of the organization's own government ministry
  4. Only persons elected to a national legislature

Explanation

The standard uses a broad notion of public official that includes persons holding legislative, administrative or judicial positions, persons performing public functions, and employees of public or state-owned enterprises. The breadth reflects the range of officials who can be exposed to bribery risk.

Question 5Fundamental principles and concepts of an anti-bribery management system – ABMS

What does ISO 37001 mean by a 'third party'?

  1. A government regulator that supervises the organization's sector
  2. Any employee working outside the organization's head office
  3. A department within the organization that is independent of the compliance function
  4. An external individual or body with whom the organization has, or is about to establish, a business relationship Correct answer.

Explanation

A third party is an external person or organization with which the organization has or plans to have a business relationship, such as suppliers, agents, consultants and joint venture partners. Third parties are a central focus because they can create bribery risk on the organization's behalf.

Question 6Fundamental principles and concepts of an anti-bribery management system – ABMS

ISO 37001 is built on which management system structure, shared with other ISO management system standards?

  1. A contractual penalty schedule
  2. A product certification scheme
  3. The High Level Structure with elements such as context, leadership, planning, support, operation, performance evaluation and improvement Correct answer.
  4. A financial audit checklist

Explanation

ISO 37001 follows the common High Level Structure used by many ISO management system standards, organizing requirements into context of the organization, leadership, planning, support, operation, performance evaluation and improvement. This allows integration with other management systems such as quality or compliance.

Question 7Fundamental principles and concepts of an anti-bribery management system – ABMS

Which of the following best describes the 'risk-based approach' required by ISO 37001?

  1. Controlling bribery risk only after an incident has been reported
  2. Applying identical controls to every third party regardless of exposure
  3. Proportioning anti-bribery measures to the nature and level of the organization's bribery risks Correct answer.
  4. Delegating all risk decisions to external legal counsel

Explanation

A risk-based approach means the organization identifies and assesses its bribery risks and then applies controls that are proportionate to those risks. Higher-risk activities and relationships warrant more intensive due diligence and monitoring than low-risk ones.

Question 8Fundamental principles and concepts of an anti-bribery management system – ABMS

Under ISO 37001, what is the role of the governing body in the ABMS?

  1. To oversee the design and implementation of the ABMS and ensure adequate resources are available Correct answer.
  2. To represent the organization in bribery-related court proceedings
  3. To personally conduct every third-party due diligence review
  4. To approve individual gifts below a fixed monetary threshold

Explanation

The governing body is responsible for overseeing the establishment, implementation and continual improvement of the ABMS and for ensuring that it receives adequate resources and authority. It provides top-level direction and accountability rather than performing operational tasks.

Question 9Fundamental principles and concepts of an anti-bribery management system – ABMS

What is the function of the anti-bribery compliance function in an ISO 37001 ABMS?

  1. To provide advice, guidance and oversight of the ABMS on a day-to-day basis Correct answer.
  2. To replace line management's responsibility for bribery risk
  3. To set the organization's commercial pricing strategy
  4. To audit the organization's financial statements

Explanation

The anti-bribery compliance function is responsible for the day-to-day operation and oversight of the ABMS, including advising personnel and monitoring compliance. It supports, but does not replace, the accountability of line management and the governing body.

Question 10Fundamental principles and concepts of an anti-bribery management system – ABMS

An organization discovers that a sales agent it uses in a high-risk country has a family connection to a procurement official at a key client. Which ISO 37001 concept is most directly engaged?

  1. Environmental aspect identification
  2. Third-party bribery risk requiring enhanced due diligence Correct answer.
  3. Documented information retention period
  4. Product quality nonconformity

Explanation

The relationship between an agent and a client's procurement official is a classic third-party bribery risk indicator. ISO 37001 requires due diligence proportionate to risk, so this situation calls for enhanced scrutiny before and during the relationship.

Question 11Fundamental principles and concepts of an anti-bribery management system – ABMS

Which statement correctly describes the relationship between ISO 37001 and legal requirements?

  1. ISO 37001 replaces national anti-bribery legislation once certification is achieved
  2. ISO 37001 applies only to organizations operating in developing countries
  3. ISO 37001 is a voluntary standard that helps organizations meet legal obligations but does not override them Correct answer.
  4. ISO 37001 exempts small organizations from anti-bribery laws

Explanation

ISO 37001 is a voluntary management system standard that provides a framework for preventing, detecting and addressing bribery. It complements applicable laws and regulations, which continue to apply regardless of certification or organization size.

Question 12Fundamental principles and concepts of an anti-bribery management system – ABMS

What does 'proportionate' mean in the context of ISO 37001 controls?

  1. Every control must be identical across all business units
  2. Controls should match the size, complexity and bribery risk profile of the organization Correct answer.
  3. Controls should be reduced whenever they inconvenience senior managers
  4. Controls should be limited to what competitors are known to do

Explanation

Proportionality means the design and intensity of anti-bribery controls reflect the organization's size, structure, activities and bribery risk. A small low-risk entity may need simpler measures than a large multinational operating in high-risk markets.

Question 13Fundamental principles and concepts of an anti-bribery management system – ABMS

Which of the following is an example of a facilitation payment as commonly understood in anti-bribery practice?

  1. A dividend paid to shareholders from legitimate profits
  2. A donation to a registered charity approved under the organization's policy
  3. A small payment to a low-level official to secure or expedite a routine action the payer is already entitled to Correct answer.
  4. A bonus paid to an employee for exceeding sales targets

Explanation

Facilitation payments are small payments made to secure or expedite the performance of a routine government action to which the payer is already entitled. Many legal regimes prohibit them, and ISO 37001 requires organizations to address them in their anti-bribery policy.

Question 14Fundamental principles and concepts of an anti-bribery management system – ABMS

What is the purpose of the anti-bribery policy in an ISO 37001 ABMS?

  1. To state the organization's commitment to prohibit bribery and set out the principles that govern its conduct Correct answer.
  2. To list the names of employees who have been disciplined for misconduct
  3. To replace the need for any operational procedures
  4. To describe the organization's marketing plan for the coming year

Explanation

The anti-bribery policy communicates top management's commitment to prohibiting bribery and establishes the principles and expectations that apply throughout the organization and to third parties. It is a high-level document supported by more detailed procedures and controls.

Question 15Fundamental principles and concepts of an anti-bribery management system – ABMS

Which statement best captures the meaning of 'due diligence' in ISO 37001?

  1. A one-time background check performed only at contract signature
  2. A financial audit of the third party's annual accounts
  3. An ongoing process to assess the bribery risk of transactions, projects, activities and business relationships before and during engagement Correct answer.
  4. A legal opinion obtained only when a dispute arises

Explanation

Due diligence in ISO 37001 is a risk-based, ongoing process used to assess the nature and extent of bribery risk associated with transactions, projects, activities and business relationships. It informs decisions on whether to proceed and what controls to apply, and it continues throughout the relationship.

Question 16Fundamental principles and concepts of an anti-bribery management system – ABMS

An employee is offered an all-expenses-paid holiday by a supplier whose contract is up for renewal. Under an ISO 37001 ABMS, what is the most appropriate response?

  1. Decline it and report the offer through the organization's gift and hospitality controls Correct answer.
  2. Accept it only if the supplier pays in cash instead
  3. Accept it because gifts from suppliers are always permitted
  4. Accept it but keep it confidential from colleagues

Explanation

Gifts and hospitality that could improperly influence a business decision are a bribery risk and should be refused and reported under the organization's controls. ISO 37001 expects proportionate controls over gifts, hospitality and similar benefits, including reporting mechanisms.

Question 17Fundamental principles and concepts of an anti-bribery management system – ABMS

What is the purpose of a speak-up or whistleblowing mechanism in an ISO 37001 ABMS?

  1. To replace the need for management review of the ABMS
  2. To collect customer feedback on product quality
  3. To provide a channel for employees to appeal disciplinary decisions
  4. To allow employees to report suspected bribery confidentially and without fear of retaliation Correct answer.

Explanation

ISO 37001 requires a mechanism through which personnel and others can report suspected or actual bribery in good faith, confidentially and without fear of retaliation. Such reporting supports early detection and investigation of concerns.

Question 18Fundamental principles and concepts of an anti-bribery management system – ABMS

How should an organization treat bribery risk in its business relationships with third parties under ISO 37001?

  1. Assess the risk, apply due diligence and contractual controls, and monitor the relationship over time Correct answer.
  2. Ignore third-party risk because the organization is only responsible for its own employees
  3. Rely solely on the third party's written self-declaration of integrity
  4. Require every third party to achieve ISO 37001 certification before any contact

Explanation

ISO 37001 requires the organization to assess bribery risk associated with third parties, conduct due diligence proportionate to that risk, and put in place contractual and monitoring controls. Responsibility extends to third parties acting on the organization's behalf.

Question 19Fundamental principles and concepts of an anti-bribery management system – ABMS

Which phrase best describes the 'tone at the top' concept in an ISO 37001 ABMS?

  1. Visible leadership commitment and modelling of anti-bribery behaviour by top management Correct answer.
  2. The frequency of internal audit reports issued to the board
  3. The use of formal signage in the organization's reception area
  4. The tone of voice used in disciplinary hearings

Explanation

Tone at the top refers to visible commitment by top management to the anti-bribery policy and to modelling expected behaviour. Leadership engagement is essential because a management system is unlikely to succeed without it.

Question 20Fundamental principles and concepts of an anti-bribery management system – ABMS

What does ISO 37001 expect regarding the anti-bribery responsibilities of personnel at all levels?

  1. Anti-bribery responsibilities apply only to staff in sales roles
  2. Only the compliance officer has any anti-bribery responsibility
  3. All personnel are expected to understand and comply with the policy and to report concerns Correct answer.
  4. Only senior executives are expected to understand the policy

Explanation

ISO 37001 assigns anti-bribery responsibilities across the organization: all personnel must understand and comply with the policy and report concerns, while specific roles have additional defined duties. Awareness and training are required to make this effective.

Question 21Fundamental principles and concepts of an anti-bribery management system – ABMS

What is the role of the anti-bribery compliance function's independence under ISO 37001?

  1. It should have direct and independent access to the governing body and be free from undue influence Correct answer.
  2. It must report to the sales director to stay commercially aligned
  3. It should be combined with the internal audit function to save resources
  4. It must be outsourced to an external law firm in all cases

Explanation

ISO 37001 expects the anti-bribery compliance function to be able to act independently, with direct and prompt access to the governing body. Independence protects the function from commercial pressure that could compromise its oversight.

Question 22Fundamental principles and concepts of an anti-bribery management system – ABMS

A company decides to enter a joint venture in a country ranked as high risk for corruption. Which sequence best reflects ISO 37001's risk-based logic?

  1. Apply the same controls used for a low-risk domestic supplier without adjustment
  2. Rely on the joint venture partner's local reputation without further checks
  3. Conduct a bribery risk assessment and due diligence, then decide whether to proceed and what controls are needed Correct answer.
  4. Sign the agreement first, then conduct due diligence if a problem emerges

Explanation

The risk-based logic is to assess bribery risk and perform due diligence before committing, then use the findings to decide whether to proceed and which controls to apply. Higher-risk contexts require more intensive measures.

Question 23Fundamental principles and concepts of an anti-bribery management system – ABMS

Which of the following best explains why ISO 37001 requires documented information as evidence of the ABMS's operation?

  1. To increase the volume of paperwork for its own sake
  2. To shift legal liability from the organization to individual employees
  3. To provide traceable evidence that controls are implemented and to support monitoring and continual improvement Correct answer.
  4. To satisfy marketing claims made in advertising

Explanation

Documented information provides evidence that the ABMS is implemented as intended and supports monitoring, review and continual improvement. It also demonstrates the organization's efforts to prevent, detect and address bribery.

Question 24Fundamental principles and concepts of an anti-bribery management system – ABMS

What does 'continual improvement' mean in the context of an ISO 37001 ABMS?

  1. Replacing the entire ABMS every year with a new design
  2. Ongoing enhancement of the ABMS's suitability, adequacy and effectiveness Correct answer.
  3. Improving only the organization's financial performance
  4. Increasing the number of policies without evaluating their effect

Explanation

Continual improvement means the organization repeatedly evaluates and enhances the suitability, adequacy and effectiveness of the ABMS. It is driven by monitoring, audits, management review and corrective action rather than by wholesale replacement.

Question 25Fundamental principles and concepts of an anti-bribery management system – ABMS

An organization's anti-bribery policy prohibits bribery but senior managers routinely approve large 'consultancy' payments to intermediaries in high-risk markets without review. Which conclusion is most consistent with ISO 37001 principles?

  1. The ABMS is adequate because a written policy exists
  2. The situation is outside the scope of ISO 37001 because no bribe has been proven
  3. The payments are acceptable because they are approved by senior managers
  4. The organization has a gap between its stated policy and actual practice, undermining the effectiveness of the ABMS Correct answer.

Explanation

An ABMS requires that stated commitments be supported by actual controls and behaviour. Unreviewed payments to intermediaries in high-risk markets indicate that policy is not being implemented, which is a significant weakness even before any bribe is proven.

Question 26Fundamental principles and concepts of an anti-bribery management system – ABMS

In ISO 37001, what does the term 'bribery' cover when the standard defines it?

  1. Only cash payments that exceed a fixed monetary threshold
  2. Any gift exchanged between two private companies during contract negotiation
  3. The offering, promising, giving, authorizing, or accepting of an undue advantage, directly or indirectly Correct answer.
  4. Only payments made directly by an employee to a public official

Explanation

ISO 37001 defines bribery broadly as offering, promising, giving, authorizing, or accepting an undue advantage, whether direct or indirect, and whether to a public official or a private person. The definition is not limited to cash, to a fixed amount, or to public officials only.

Question 27Fundamental principles and concepts of an anti-bribery management system – ABMS

Which term describes a payment made to speed up a routine action that the payer is already legally entitled to have performed?

  1. Extortion
  2. Facilitation payment Correct answer.
  3. Lobbying
  4. Sponsorship

Explanation

A facilitation payment is a small payment to expedite a routine, non-discretionary act the payer is already entitled to. ISO 37001 does not carve it out as acceptable; it is treated as a form of bribery risk that the organization must address.

Question 28Fundamental principles and concepts of an anti-bribery management system – ABMS

What is the primary intended outcome of implementing an anti-bribery management system based on ISO 37001?

  1. Certifying that the organization's business partners are free of corruption risk
  2. Establishing a systematic set of controls and culture that help prevent, detect, and respond to bribery Correct answer.
  3. Replacing the organization's legal obligations with a voluntary standard
  4. Guaranteeing that no bribery incident will ever occur in the organization

Explanation

An ABMS provides a structured, risk-based system of policies, controls, and culture intended to help an organization prevent, detect, and respond to bribery. It supports compliance with law but does not replace legal obligations or guarantee that no incident will occur.

Question 29Fundamental principles and concepts of an anti-bribery management system – ABMS

In ISO 37001 terminology, who is a 'public official'?

  1. Only elected politicians at national level
  2. Any employee of a privately owned supplier to government
  3. A person holding a legislative, administrative, or judicial position, or performing a public function, including in state-owned entities Correct answer.
  4. Any person who has signed a government procurement contract

Explanation

The term public official is broad and includes people exercising legislative, administrative, or judicial authority, and those performing public functions, including in state-owned or controlled entities. It is not limited to elected politicians or to people who merely contract with government.

Question 30Fundamental principles and concepts of an anti-bribery management system – ABMS

What does 'due diligence' mean in the context of ISO 37001?

  1. An investigation performed only after a bribery allegation is received
  2. A financial audit of a partner's annual accounts
  3. A legal review performed exclusively by external counsel
  4. A risk-based process to evaluate the bribery risk of transactions, projects, activities, and business relationships before and during engagement Correct answer.

Explanation

In ISO 37001, due diligence is a risk-based assessment of the bribery risk associated with proposed transactions, projects, activities, and business relationships. It is carried out before committing and updated as risk changes, not only after an allegation.

Question 31Fundamental principles and concepts of an anti-bribery management system – ABMS

Which statement best captures the meaning of 'tone at the top' in an ISO 37001 ABMS?

  1. The compliance function reports annually to the board
  2. The organization publishes its anti-bribery policy on its website
  3. Employees receive anti-bribery training once at induction
  4. Senior management demonstrates visible commitment to anti-bribery through its decisions, communication, and behavior Correct answer.

Explanation

Tone at the top refers to the demonstrable commitment of top management, expressed through decisions, conduct, and communication, which shapes culture. Publishing a policy or running training supports this but does not by itself establish leadership commitment.

Question 32Fundamental principles and concepts of an anti-bribery management system – ABMS

What does ISO 37001 require regarding the anti-bribery policy?

  1. It must list the names of all employees who have been disciplined for bribery
  2. It must be approved each year by an external certification body
  3. It must be documented, communicated to personnel and business partners as appropriate, and made available to relevant interested parties Correct answer.
  4. It must be kept confidential and available only to senior management

Explanation

The anti-bribery policy must be documented and communicated throughout the organization and to business partners where appropriate, and made available to relevant interested parties. It is a high-level commitment document, not a confidential management-only file or a disciplinary register.

Question 33Fundamental principles and concepts of an anti-bribery management system – ABMS

What is the role of the anti-bribery compliance function in an ISO 37001 ABMS?

  1. To personally approve every payment made by the organization
  2. To replace line management's responsibility for bribery risk
  3. To provide oversight, advice, and support for the ABMS, with sufficient authority and independence Correct answer.
  4. To act as the sole channel for reporting bribery concerns

Explanation

The anti-bribery compliance function oversees and supports the ABMS and advises the organization, and it needs adequate authority, resources, and independence. It does not absorb the responsibilities of line management or become the only reporting channel.

Question 34Fundamental principles and concepts of an anti-bribery management system – ABMS

A procurement officer is offered a luxury watch by a bidder shortly before contract award. Under an ISO 37001 ABMS, what is the most appropriate immediate response?

  1. Decline the gift and report the offer through the organization's reporting channel Correct answer.
  2. Accept it because gifts under a certain value are always permitted
  3. Postpone the decision until after the contract is awarded and then decide
  4. Accept the gift but record it in a personal diary

Explanation

An offer of a valuable gift from a bidder during a live procurement is a clear bribery risk indicator. The appropriate response is to decline and report it so the organization can assess and act on the risk, consistent with its gifts and hospitality controls.

Question 35Fundamental principles and concepts of an anti-bribery management system – ABMS

Which statement correctly describes the relationship between ISO 37001 and applicable anti-bribery laws?

  1. ISO 37001 overrides national law where the two differ
  2. ISO 37001 sets a management system framework that supports legal compliance but does not replace legal obligations Correct answer.
  3. ISO 37001 only applies to organizations operating in countries without anti-bribery legislation
  4. Compliance with ISO 37001 is a legal defence that exempts an organization from prosecution

Explanation

ISO 37001 provides a management system framework intended to help organizations meet their anti-bribery obligations. It does not supersede legislation, and certification is not a legal exemption from liability.

Question 36Fundamental principles and concepts of an anti-bribery management system – ABMS

An organization's risk assessment identifies that agents used in a particular sector carry high bribery risk. What does ISO 37001 expect the organization to do next?

  1. Terminate all agent relationships immediately in every country
  2. Apply no controls because agents are independent contractors
  3. Rely solely on the agent's own written assurance of good conduct
  4. Apply proportionate due diligence and controls to those agents, such as vetting, contractual anti-bribery terms, and monitoring Correct answer.

Explanation

ISO 37001 requires controls proportionate to the assessed risk, including due diligence, contractual commitments, and monitoring of higher-risk business relationships. Immediate blanket termination is not required, and a self-declaration alone is not adequate for high risk.

Question 37Fundamental principles and concepts of an anti-bribery management system – ABMS

What does ISO 37001 mean by 'proportionate' controls?

  1. Controls limited to what competitors are known to do
  2. Controls that cost the same in every business unit
  3. Controls applied identically regardless of the risk involved
  4. Controls sized to the organization's assessed bribery risk and context Correct answer.

Explanation

Proportionality means the design and intensity of controls should match the assessed bribery risk and the organization's context. This allows lighter controls for low-risk activities and stronger controls where risk is higher.

Question 38Fundamental principles and concepts of an anti-bribery management system – ABMS

Which of the following is the best example of an undue advantage under ISO 37001?

  1. A payment to an official's relative to secure a contract award Correct answer.
  2. A donation to a registered charity that is publicly disclosed and unrelated to any decision
  3. A published discount available to all customers
  4. A standard invoice paid on contractual terms

Explanation

An undue advantage is something of value offered to influence improperly, and indirect routes such as paying a relative of an official to win a contract are classic examples. Legitimate discounts, normal invoices, and transparent unrelated donations are not undue advantages.

Question 39Fundamental principles and concepts of an anti-bribery management system – ABMS

What is the purpose of the speak-up mechanism in an ISO 37001 ABMS?

  1. To replace the organization's internal audit function
  2. To provide a channel for negotiating settlements with officials
  3. To collect customer complaints about product quality
  4. To allow personnel and others to report suspected bribery confidentially and without fear of retaliation Correct answer.

Explanation

A speak-up mechanism gives personnel and other relevant parties a confidential route to raise bribery concerns and protects them from retaliation. It supports detection and is separate from product complaints, internal audit, or any negotiation with officials.

Question 40Fundamental principles and concepts of an anti-bribery management system – ABMS

An organization wants to rely on a third-party intermediary in a high-risk market. Which action best reflects the ISO 37001 approach to business relationships?

  1. Sign the contract first and conduct due diligence only if a problem arises
  2. Ask the intermediary to confirm verbally that it does not pay bribes
  3. Conduct risk-based due diligence before engagement and include anti-bribery commitments in the agreement Correct answer.
  4. Rely on the intermediary's reputation in the market

Explanation

ISO 37001 expects due diligence to be performed before entering a higher-risk relationship, followed by contractual anti-bribery commitments and ongoing monitoring. Reputation, verbal assurances, or post-hoc checks are not adequate substitutes.

Question 41Fundamental principles and concepts of an anti-bribery management system – ABMS

What does 'continual improvement' refer to in an ISO 37001 ABMS?

  1. Increasing the number of controls regardless of their effectiveness
  2. A one-off project to rewrite the anti-bribery policy
  3. The recurring process of enhancing the suitability, adequacy, and effectiveness of the ABMS Correct answer.
  4. Replacing the compliance function every few years

Explanation

Continual improvement is an ongoing process of enhancing the ABMS so it remains suitable, adequate, and effective over time. It is not a one-time documentation exercise, nor is it about adding controls without regard to results.

Question 42Fundamental principles and concepts of an anti-bribery management system – ABMS

Which statement best describes the role of the governing body in an ISO 37001 ABMS?

  1. It approves individual gifts and hospitality requests
  2. It delegates all anti-bribery responsibility to the compliance function with no oversight
  3. It supervises the design and implementation of the ABMS and receives reports on its performance Correct answer.
  4. It personally conducts all third-party due diligence

Explanation

The governing body oversees the ABMS and is informed about its operation and effectiveness through reporting. It does not perform operational tasks such as due diligence or gift approvals, and it cannot simply delegate away its oversight role.

Question 43Fundamental principles and concepts of an anti-bribery management system – ABMS

An organization's anti-bribery policy prohibits bribery, but senior managers routinely approve large 'consultancy' payments to companies linked to officials. What does this situation most clearly illustrate?

  1. An effective ABMS because a policy exists
  2. Compliance with ISO 37001 because approvals were documented
  3. A proportionate control because senior managers approved the payments
  4. A gap between the stated policy and actual conduct, which undermines the ABMS Correct answer.

Explanation

When leadership behavior contradicts the anti-bribery policy, the system's credibility and effectiveness are undermined, regardless of what the documents say. Documented approvals do not cure a control environment in which senior managers enable high-risk payments.

Question 44Fundamental principles and concepts of an anti-bribery management system – ABMS

What is the role of anti-bribery training and awareness under ISO 37001?

  1. It is optional and has no bearing on certification
  2. It consists solely of distributing the policy by email once
  3. It must be provided to all personnel and, where relevant, to business partners, based on their roles and the risks they face Correct answer.
  4. It is required only for the compliance function

Explanation

ISO 37001 requires anti-bribery awareness and training for personnel and relevant business partners, tailored to roles and risks. It is not limited to the compliance team, and simple distribution of a policy is not sufficient training.

Question 45Fundamental principles and concepts of an anti-bribery management system – ABMS

Which statement best describes how ISO 37001 treats facilitation payments?

  1. They are explicitly permitted if they are small and routine
  2. They should be prohibited or, where an organization decides otherwise, tightly controlled, because they are a form of bribery risk Correct answer.
  3. They are permitted whenever local custom accepts them
  4. They are outside the scope of an ABMS because they are not real bribes

Explanation

ISO 37001 treats facilitation payments as a bribery risk, and organizations are expected to prohibit them or, where they decide not to do so, to manage them through strict controls. Local custom does not make them acceptable under the standard.

Question 46Fundamental principles and concepts of an anti-bribery management system – ABMS

An organization identifies a bribery risk it cannot reduce to an acceptable level through controls. According to the ISO 37001 approach, what is the appropriate management action?

  1. Decline or discontinue the activity, or seek to manage the risk through other means, rather than proceeding as planned Correct answer.
  2. Proceed anyway and document that the risk was accepted by the compliance officer
  3. Ignore the risk because it has been identified
  4. Increase marketing spend in the affected market

Explanation

Where bribery risk cannot be managed to an acceptable level, the organization should not proceed with the activity and may decline it or seek alternative ways to manage the risk. Merely documenting acceptance or ignoring the finding does not satisfy the risk-based approach.

Question 47Fundamental principles and concepts of an anti-bribery management system – ABMS

Which situation best demonstrates that an organization's bribery risk assessment is being used effectively?

  1. The assessment is completed once at the start of the ABMS and never revisited
  2. The assessment is kept confidential from those who design controls
  3. The assessment results directly shape due diligence depth, control design, and monitoring priorities Correct answer.
  4. The assessment is written by an external consultant without internal input

Explanation

An effective risk assessment is a living input that drives how much due diligence is done, which controls are designed, and where monitoring focuses. A one-off, isolated, or purely external exercise does not connect risk information to decisions.

Question 48Fundamental principles and concepts of an anti-bribery management system – ABMS

An organization is certified to ISO 37001, yet one of its subsidiaries is later found to have paid a bribe. Which interpretation is most consistent with the standard?

  1. Certification indicates the ABMS was assessed as conforming at the time, but it does not guarantee that no bribery will occur Correct answer.
  2. The subsidiary's conduct is irrelevant because certification covers only the parent company
  3. Certification means the organization has no further obligation to investigate or respond
  4. The certificate is automatically invalid because certification guarantees no bribery

Explanation

Certification confirms that the management system was found to conform to the standard at the time of assessment; it is not a guarantee of conduct. The organization is still expected to investigate, respond, and improve the ABMS when an incident occurs.

Question 49Fundamental principles and concepts of an anti-bribery management system – ABMS

Which combination best reflects the ISO 37001 principle that anti-bribery responsibility sits with leadership while controls operate throughout the organization?

  1. Top management sets direction and oversight, while all functions apply controls and are accountable within their areas Correct answer.
  2. External auditors are responsible for preventing bribery in the organization
  3. Only the compliance function is accountable for bribery risk
  4. Only the governing body applies controls, and personnel merely observe

Explanation

ISO 37001 places direction and oversight with top management and the governing body, while requiring personnel at all levels to apply and be accountable for controls in their areas. Responsibility is not confined to the compliance function or to external parties.

Question 50Fundamental principles and concepts of an anti-bribery management system – ABMS

What distinguishes a 'bribe' from a legitimate gift or hospitality under an ISO 37001 ABMS?

  1. Whether the recipient works in the public or private sector
  2. Whether it is given in cash or by bank transfer
  3. The monetary value alone, regardless of intent or context
  4. Whether it is intended to obtain an improper advantage and whether it is proportionate, transparent, and permitted under the organization's controls Correct answer.

Explanation

The decisive factor is whether something of value is intended to obtain an improper advantage, assessed together with proportionality, transparency, and compliance with the organization's gift and hospitality controls. Value, payment method, or sector alone do not determine whether it is a bribe.