PECB ISO 37001 Transition common mistakes
PECB ISO 37001 Transition · Understand the traps and how to avoid them.
Treating ISO 37001:2025 as a full rewrite and assuming the clause structure, core definitions, and the Plan-Do-Check-Act logic were replaced, so the candidate answers transition questions as if the whole standard were new.
Transition candidates studied the 2016 edition and hear 'significant changes', so they over-correct and lose track of what is genuinely retained, such as the requirement for an anti-bribery policy, anti-bribery compliance function, and documented information.
What to do instead
Before answering, separate the standard into 'retained core' (policy, leadership commitment, risk assessment, due diligence, controls, training, monitoring, continual improvement) and 'changed or expanded' (governance bodies, expanded due diligence scope, whistleblower protections). Answer transition questions by naming which category the clause falls into.
Confusing the governing body with top management when answering questions about strengthened governance, attributing top management's operational responsibilities to the board or vice versa.
The 2025 edition sharpens the distinction between the governing body (oversight, direction, resourcing decisions) and top management (implementation and integration into processes), and candidates default to treating 'leadership' as one undifferentiated role.
What to do instead
Memorise the split: governing body sets direction, approves policy, oversees the anti-bribery management system and receives reporting; top management implements, integrates requirements into business processes, and provides resources. For each governance question, first ask 'is this a decision/oversight act or an execution act?'
Answering due diligence questions with a one-off, onboarding-only check, rather than risk-based, proportionate and continuing due diligence across the whole relationship lifecycle.
Many candidates carry the mental model of 'vet the third party at contract stage', which was already insufficient in 2016 and is more explicitly emphasised in 2025, especially for transactions, third parties and business associates.
What to do instead
Frame every due diligence answer around three elements: risk-based proportionality (depth matches bribery risk), coverage of transactions and business associates as well as third parties, and continuing/re-triggered review on changed risk. Reject any option implying a single pre-contract check with no monitoring.
Limiting third-party due diligence to the direct contracting party and ignoring business associates such as intermediaries, consultants, agents, joint venture partners, and sub-contractors in the supply chain.
Candidates equate 'third party' with 'supplier' and miss the broader business-associate concept that the 2025 edition emphasises, so they pick answers that only address the direct counterparty.
What to do instead
Before choosing, list every party involved in the scenario (agent, consultant, JV partner, subcontractor, beneficial owner) and check whether the proposed control reaches all of them. If an option covers only the direct supplier, it is usually the distractor.
Treating whistleblower protection as limited to confidentiality of identity, and missing the wider set of protections such as protection against retaliation, and accessible, safe reporting channels that allow anonymous or confidential reporting.
Candidates recall 'confidentiality' as the headline concept and stop there, whereas the 2025 edition gives expanded emphasis to protecting reporters from retaliation and to multiple safe channels.
What to do instead
For each reporting question, test the answer against three tests: is the channel safe and accessible (including to third parties and anonymous reporters), is identity protected, and is the reporter protected from retaliation and detriment? An option that only mentions confidentiality is incomplete.
Confusing the anti-bribery compliance function with internal audit, and assigning monitoring, investigation, or assurance roles to the wrong function.
The 2016 and 2025 editions assign different roles to the compliance function (advice, guidance, oversight of the management system) versus internal audit (independent assurance) and versus the investigation process, and candidates collapse these into one.
What to do instead
Build a small role matrix: compliance function advises and oversees; internal audit gives independent assurance on the management system; investigations are conducted by competent, independent people. Match each scenario to the role's purpose, not to who sounds most senior.
Answering 'what must an organisation do' questions with the 2016 requirement when the 2025 edition has strengthened or expanded it, for example giving the older, narrower due diligence or whistleblowing scope.
Under time pressure, candidates recall the familiar 2016 wording and do not check whether the 2025 edition added scope, which is exactly what transition questions test.
What to do instead
For every requirement question, consciously ask 'has 2025 expanded this?'. Mark the three expansion areas (governance, due diligence for transactions/third parties/business associates, whistleblower protection) as high-probability areas and verify the answer against the expanded scope.
Treating ISO 37001 as a certification of an organisation's ethical culture or a guarantee that no bribery will occur, rather than a management system standard requiring proportionate, risk-based controls.
Foundation-level candidates conflate 'certification' with 'clean bill of health', and the 2025 edition's emphasis on risk-based proportionality makes this a frequent distractor.
What to do instead
State the standard's purpose precisely: it specifies requirements and provides guidance for a management system to help prevent, detect and address bribery, proportionate to risk. Certification confirms the system conforms, not that bribery is absent.
Skipping the definitional distinctions between bribery, facilitation payments, extortion, and gifts/hospitality, and applying a single control to all of them.
Candidates assume these terms are interchangeable, but the standard treats facilitation payments, gifts and hospitality, and extortion differently, and 2025 foundation questions test whether the candidate can classify the scenario correctly.
What to do instead
Learn the distinctions: bribery is offering/giving/receiving an undue advantage; facilitation payments are a subset of bribery to expedite routine actions; extortion involves coercion; gifts and hospitality require risk-based rules. Classify the scenario first, then choose the control.
Answering questions about risk assessment by naming a risk register as sufficient, without linking the assessment to the design of due diligence, controls, and monitoring, and without periodic review.
Candidates treat risk assessment as a documentation task rather than the driver of the whole management system, which the 2025 edition links more explicitly to due diligence and control proportionality.
What to do instead
For each risk question, trace the chain: risk assessment identifies bribery risk, due diligence is proportionate to that risk, controls address the identified risk, and monitoring and review update the assessment. Choose answers that complete the chain, not ones that stop at 'document the risk'.