I85PREP
⌘ K
PECB ISO 37001 Transition study materials
PECB ISO 37001 Transition study resources

PECB ISO 37001 Transition practice questions

One question at a time. Build your PECB ISO 37001 Transition understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

Under ISO 37001:2025, which term describes an organization's obligation to identify and evaluate bribery risk associated with its activities, functions, and relationships?

  1. Management review
  2. Due diligence on personnel
  3. Bribery risk assessment Correct answer.
  4. Financial controls review

Explanation

The standard requires the organization to conduct a bribery risk assessment that identifies and evaluates bribery risk across its activities, functions, and relationships. This assessment then informs the design of the anti-bribery management system and the intensity of controls applied.

Question 2ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

In ISO 37001:2025, what is the primary role of the governing body in relation to the anti-bribery management system?

  1. Ensuring the system is established and maintained at the top level Correct answer.
  2. Conducting individual bribery investigations
  3. Negotiating contracts with business associates
  4. Approving the annual financial statements

Explanation

The governing body is expected to ensure the anti-bribery management system is established, maintained, and integrated with the organization's strategic direction. This reflects the leadership commitment that underpins the whole standard.

Question 3ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization is implementing ISO 37001:2025 and wants to define who is responsible for day-to-day operation of the anti-bribery management system. What does the standard require in this respect?

  1. Responsibility must be outsourced to an external law firm
  2. Responsibility must be documented and assigned to a designated function Correct answer.
  3. Responsibility must be shared informally among all staff
  4. Responsibility must be assigned to the internal audit function only

Explanation

The standard requires that responsibility and authority for the anti-bribery management system be assigned and communicated to a designated function or functions. Documented assignment ensures accountability and supports consistent operation.

Question 4ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

What type of information must an organization retain as documented evidence that its anti-bribery management system is operating as intended?

  1. Documented information Correct answer.
  2. Marketing collateral
  3. Verbal briefings only
  4. Draft notes that are discarded

Explanation

ISO 37001:2025 uses the term documented information to cover both documents and records that must be maintained and retained. Retained documented information provides evidence of conformity and effective operation.

Question 5ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

Which statement best describes the purpose of the anti-bribery policy within an ISO 37001:2025 system?

  1. It replaces the need for any bribery risk assessment
  2. It serves as the organization's annual financial report
  3. It lists the names of all employees who have been investigated
  4. It sets out the organization's commitments and expectations regarding bribery Correct answer.

Explanation

The anti-bribery policy communicates top management's commitments, including prohibition of bribery and compliance with applicable requirements. It provides the framework against which the rest of the system is built.

Question 6ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

Under ISO 37001:2025, what is the purpose of due diligence on business associates?

  1. To evaluate the bribery risk posed by the associate before and during the relationship Correct answer.
  2. To replace the need for financial controls
  3. To satisfy tax reporting obligations
  4. To guarantee that the associate will never commit bribery

Explanation

Due diligence assesses the bribery risk that a business associate may present, so the organization can decide whether and how to proceed. It is a risk-based evaluation, not an absolute guarantee of conduct.

Question 7ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

What does ISO 37001:2025 require regarding the raising of concerns about suspected bribery?

  1. Concerns must be raised only after an investigation concludes
  2. Concerns must be raised only through line managers
  3. Confidential reporting channels must be available to raise concerns Correct answer.
  4. Concerns must be published on the organization's website

Explanation

The standard requires a reporting mechanism that allows concerns to be raised confidentially and without fear of retaliation. This supports early detection and a speak-up culture.

Question 8ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

What is the intended outcome of an ISO 37001:2025 anti-bribery management system?

  1. Prevention, detection, and response to bribery Correct answer.
  2. Guaranteed immunity from prosecution
  3. Elimination of all commercial risk
  4. Reduction of tax liabilities

Explanation

An anti-bribery management system is designed to help the organization prevent, detect, and respond to bribery. It supports compliance but does not eliminate commercial risk or confer legal immunity.

Question 9ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization identifies a high-risk business associate in a jurisdiction with elevated corruption perception. According to ISO 37001:2025, what is the most appropriate response?

  1. Proceed without additional checks because the contract is already signed
  2. Delegate all responsibility to the business associate
  3. Apply enhanced due diligence and proportionate controls before and during the relationship Correct answer.
  4. Reduce documentation to speed up the transaction

Explanation

The standard is risk-based: higher bribery risk calls for enhanced due diligence and proportionate controls. This ensures that the level of assurance matches the level of risk.

Question 10ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

A manager is offered a gift by a supplier during contract negotiations. Applying ISO 37001:2025 concepts, what should the organization's controls primarily address?

  1. Whether the gift was delivered in person
  2. Whether the supplier's employees are unionized
  3. Whether the gift can be resold for profit
  4. Whether the gift is acceptable under defined criteria and approval rules Correct answer.

Explanation

The standard expects controls over gifts, hospitality, and similar benefits, with defined criteria and approval requirements. The focus is on whether the benefit is acceptable and properly authorized.

Question 11ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

During an internal audit of the anti-bribery management system, an auditor finds that due diligence records are missing for several high-risk associates. What is the most appropriate classification of this finding?

  1. A matter outside the scope of the standard
  2. An acceptable variation with no action
  3. A reason to cancel certification immediately
  4. A nonconformity requiring corrective action Correct answer.

Explanation

Missing due diligence records for high-risk associates indicates the system is not operating as required, which is a nonconformity. The organization should investigate the cause and take corrective action.

Question 12ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization wants to demonstrate that its anti-bribery management system conforms to ISO 37001:2025. What does certification typically involve?

  1. A self-declaration with no external review
  2. Approval by the organization's largest customer
  3. A one-time review by the finance department
  4. An independent certification body auditing the system against the standard Correct answer.

Explanation

Certification is performed by an independent certification body that audits the management system against the requirements of the standard. Self-declaration does not constitute third-party certification.

Question 13ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

A company operates in a sector where facilitation payments are common. How does ISO 37001:2025 treat such payments?

  1. They are always acceptable if small in value
  2. They fall outside the definition of bribery
  3. They are permitted when approved verbally
  4. They are prohibited and should be controlled through the anti-bribery policy Correct answer.

Explanation

ISO 37001:2025 aligns with the principle that bribery, including facilitation payments, is prohibited, and the policy should reflect this. Organizations should implement controls to prevent and detect such payments.

Question 14ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

What is the relationship between the bribery risk assessment and the design of anti-bribery controls in ISO 37001:2025?

  1. Controls are selected and proportionate to the assessed bribery risks Correct answer.
  2. Controls are copied from a competitor's system
  3. Controls are based only on the organization's historical revenue
  4. Controls are designed independently of the risk assessment

Explanation

The risk assessment drives the selection and intensity of controls so that they are proportionate to the identified risks. This risk-based linkage is central to the standard's logic.

Question 15ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An employee reports a suspected bribe through the organization's confidential channel. What does ISO 37001:2025 expect the organization to do?

  1. Dismiss the report unless the employee provides proof
  2. Publish the reporter's identity to deter others
  3. Wait until the next annual management review to act
  4. Protect the reporter from retaliation and investigate appropriately Correct answer.

Explanation

The standard expects concerns to be handled confidentially and for those raising them to be protected from retaliation. Reports should be assessed and investigated as appropriate.

Question 16ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

Which activity best demonstrates top management's commitment to the anti-bribery management system under ISO 37001:2025?

  1. Delegating all anti-bribery decisions to junior staff
  2. Actively communicating and enforcing the anti-bribery policy Correct answer.
  3. Avoiding any involvement in management review
  4. Reducing the budget for compliance training

Explanation

Top management demonstrates commitment by actively communicating the policy, enforcing it, and providing resources. Leadership engagement is a recurring theme in the standard.

Question 17ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization's anti-bribery policy has not been reviewed for several years despite significant changes in its business environment. What does ISO 37001:2025 suggest?

  1. The policy should be replaced by a verbal statement
  2. The policy should remain unchanged until a bribe occurs
  3. The policy should be reviewed periodically and updated as appropriate Correct answer.
  4. The policy should be kept confidential from employees

Explanation

The standard expects the policy to be reviewed at planned intervals and updated when circumstances change. Keeping the policy current ensures it remains relevant and effective.

Question 18ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

A procurement officer is asked to approve a payment to a government official to expedite a routine permit. Which control would most directly address this situation?

  1. A marketing approval workflow
  2. A customer satisfaction survey
  3. A gifts, hospitality, and facilitation payment control with clear escalation Correct answer.
  4. A payroll reconciliation procedure

Explanation

Controls over gifts, hospitality, and facilitation payments, with clear escalation and approval rules, directly target this risk. They help prevent and detect improper payments.

Question 19ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization is deciding how much due diligence to perform on a low-risk supplier of office stationery. Applying the risk-based approach of ISO 37001:2025, what is appropriate?

  1. A proportionate, lighter level of due diligence Correct answer.
  2. The same intensive due diligence as for a high-risk agent
  3. Due diligence only after a bribery incident occurs
  4. No due diligence under any circumstances

Explanation

The standard requires due diligence proportionate to the assessed risk. A low-risk supplier warrants a lighter level of scrutiny than a high-risk intermediary.

Question 20ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

What should an organization do when it identifies a nonconformity in its anti-bribery management system?

  1. Record it and take corrective action to address the cause Correct answer.
  2. Delete the record to avoid audit findings
  3. Ignore it if no bribe has occurred yet
  4. Blame the individual and close the matter

Explanation

The standard requires nonconformities to be recorded and addressed through corrective action, including identifying and eliminating the cause where possible. This supports continual improvement.

Question 21ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization wants to ensure that its anti-bribery management system remains suitable over time. Which ISO 37001:2025 element most directly supports this?

  1. A fixed policy that is never revised
  2. A one-time risk assessment at implementation
  3. A single induction training session for new staff
  4. Management review at planned intervals Correct answer.

Explanation

Management review at planned intervals evaluates the system's continuing suitability, adequacy, and effectiveness. It enables adjustments in response to changing risks and performance.

Question 22ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

A company's anti-bribery training is delivered only once at hire and never repeated. How does this align with ISO 37001:2025 expectations?

  1. It is insufficient because training should be provided at planned intervals and updated Correct answer.
  2. It is acceptable if the workforce is small
  3. It is acceptable if no bribery has been detected
  4. It fully meets expectations because training is not required

Explanation

The standard expects awareness and training to be provided at planned intervals and updated to reflect changes in risk and roles. One-off training does not sustain competence and awareness.

Question 23ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization outsources part of its operations to a joint venture partner. How should ISO 37001:2025 requirements be reflected in this relationship?

  1. The partner should set the organization's anti-bribery policy
  2. The organization has no responsibility once the contract is signed
  3. Anti-bribery controls and expectations should be addressed in the relationship Correct answer.
  4. The partner should be exempt from any due diligence

Explanation

The standard expects anti-bribery controls to extend to business associates and relationships, including through contractual and due diligence measures. Responsibility is not transferred by contract alone.

Question 24ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

During a management review, senior leaders note that the bribery risk assessment has not been updated despite entry into a new market. What is the most appropriate conclusion?

  1. The risk assessment should be updated to reflect the new market and controls adjusted Correct answer.
  2. The existing risk assessment remains valid indefinitely
  3. The new market should be ignored until a problem arises
  4. The management review should be postponed

Explanation

A change such as entering a new market is a trigger to update the bribery risk assessment and adjust controls accordingly. Management review is the forum where such gaps should be identified and acted on.

Question 25ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization discovers that a senior manager concealed a bribery incident from the compliance function. Which combination of ISO 37001:2025 elements is most relevant to addressing this?

  1. Reporting channels, investigation procedures, and disciplinary measures Correct answer.
  2. Payroll processing and expense reimbursement only
  3. Facility maintenance and security guard scheduling
  4. Marketing strategy and customer segmentation

Explanation

Concealment undermines reporting and investigation, so the organization should rely on confidential reporting channels, proper investigation procedures, and disciplinary measures. These elements together deter and address such conduct.

Question 26ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

Under ISO 37001:2025, which term describes the person or body with overall responsibility for the anti-bribery management system's strategic direction and resourcing?

  1. Top management Correct answer.
  2. The compliance function
  3. The internal audit team
  4. The governing body of a business associate

Explanation

ISO 37001 assigns top management the responsibility for establishing, resourcing and directing the anti-bribery management system, including aligning it with the organization's strategy. The compliance function supports this work but does not replace top management's accountability.

Question 27ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

Which statement best captures how ISO 37001:2025 treats bribery that occurs through intermediaries such as agents or consultants?

  1. It is covered only if the organization signed a written contract
  2. It is excluded because the organization did not act directly
  3. It is addressed only when the intermediary is a public official
  4. It is treated as the organization's responsibility when conducted on its behalf Correct answer.

Explanation

The standard's concept of bribery extends to conduct carried out on the organization's behalf by intermediaries, which is why business associate due diligence and controls are central requirements. Organizations cannot avoid responsibility by pointing to a third party's direct involvement.

Question 28ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization is defining the boundaries of its anti-bribery management system. What does ISO 37001:2025 require the scope statement to do?

  1. Be documented and available to interested parties Correct answer.
  2. Exclude activities performed by business associates
  3. Be approved by an external certification body before use
  4. List every employee by name and role

Explanation

The scope of the anti-bribery management system must be established and documented, taking into account external and internal issues and the organization's activities. It must be available to relevant interested parties so that expectations are clear.

Question 29ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

What role does an anti-bribery policy play within an ISO 37001:2025 management system?

  1. It lists the disciplinary sanctions for every possible misconduct
  2. It records the outcome of each individual bribery investigation
  3. It replaces the need for a bribery risk assessment
  4. It states the organization's commitments and prohibitions regarding bribery Correct answer.

Explanation

The anti-bribery policy communicates the organization's commitment to prohibiting bribery and sets expectations for personnel and business associates. It is a governing statement rather than a substitute for risk assessment or investigation records.

Question 30ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

How does ISO 37001:2025 describe the relationship between the anti-bribery management system and the organization's other management systems?

  1. It must be integrated with the quality management system
  2. It must remain completely separate from all other systems
  3. It is only applicable to organizations without other systems
  4. It may be aligned or integrated with other management systems Correct answer.

Explanation

The standard allows the anti-bribery management system to be stand-alone or aligned and integrated with other management systems, such as compliance or risk frameworks. This flexibility supports consistent governance without imposing a single structure.

Question 31ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

Which element is part of the documented information that ISO 37001:2025 requires the organization to retain as evidence of competence?

  1. The personal tax filings of senior managers
  2. Records of training, skills and experience Correct answer.
  3. Minutes of every informal team meeting
  4. A copy of each employee's employment contract

Explanation

The standard requires documented information as evidence of competence, typically training records, qualifications and experience relevant to anti-bribery roles. Employment contracts, meeting minutes and personal tax filings are not the specified evidence.

Question 32ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

What is the purpose of the anti-bribery compliance function in an ISO 37001:2025 management system?

  1. To set the organization's overall commercial strategy
  2. To oversee and advise on the day-to-day operation of the anti-bribery controls Correct answer.
  3. To guarantee that no bribery will ever occur
  4. To conduct the external certification audit

Explanation

The compliance function is responsible for overseeing the design and operation of the anti-bribery management system and advising personnel on bribery-related matters. It supports, but does not replace, top management's accountability.

Question 33ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

ISO 37001:2025 requires the anti-bribery policy to be communicated to which group?

  1. Only to employees working in high-risk countries
  2. Only to members of the governing body
  3. Only to external auditors on request
  4. To personnel and, where appropriate, to business associates Correct answer.

Explanation

The policy must be communicated to personnel and, as appropriate, to business associates so that expectations are understood throughout the organization's sphere of influence. Limiting communication to a narrow group would undermine the system's effectiveness.

Question 34ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization is designing its bribery risk assessment process. Which input does ISO 37001:2025 expect to be considered?

  1. The number of parking spaces at each facility
  2. The organization's size, structure and the nature of its activities Correct answer.
  3. The brand of software used for email
  4. The personal investment portfolios of board members

Explanation

The risk assessment should consider factors such as the organization's size, structure, activities, locations and the sectors in which it operates. These factors shape the likelihood and impact of bribery risk.

Question 35ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

A compliance officer wants to strengthen the anti-bribery system's response to a newly identified high-risk market. What sequence best reflects ISO 37001:2025 expectations?

  1. Rely on the market's reputation instead of a formal assessment
  2. Delegate the decision entirely to the business associate
  3. Assess the bribery risk, then design and apply proportionate controls before or during entry Correct answer.
  4. Approve the market entry first, then assess risk after contracts are signed

Explanation

The standard links risk assessment to control design, so risks should be identified and evaluated before or alongside the activity and addressed with proportionate controls. Acting first and assessing later leaves exposure unmanaged.

Question 36ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

A company finds that its bribery risk assessment identifies a risk not addressed by any existing control. What should happen next?

  1. The assessment should be postponed until the next audit cycle
  2. The gap should be addressed by adding or improving controls proportionate to the risk Correct answer.
  3. The risk should be accepted without documentation
  4. The risk should be removed from the register to avoid nonconformity

Explanation

Where the risk assessment reveals an untreated risk, the organization should design and implement proportionate additional controls. Removing risks or ignoring gaps undermines the risk-based foundation of the system.

Question 37ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization is deciding what due diligence to apply to a new agent who will interact with government officials. What approach aligns with ISO 37001:2025?

  1. Apply the same minimal checks used for all suppliers regardless of risk
  2. Rely on the agent's self-declaration alone
  3. Apply enhanced due diligence proportionate to the assessed bribery risk Correct answer.
  4. Skip due diligence because the agent was recommended by a colleague

Explanation

Due diligence must be proportionate to the bribery risk, so an agent interacting with public officials warrants enhanced scrutiny. A one-size-fits-all or self-declaration-only approach does not match the risk-based requirement.

Question 38ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

What does ISO 37001:2025 require when an organization enters a relationship with a business associate that poses more than a low bribery risk?

  1. The relationship must be terminated automatically
  2. The business associate must join the organization
  3. The relationship must be reported to competitors
  4. Appropriate controls should be applied to the relationship Correct answer.

Explanation

For higher-risk business associates, the organization must apply proportionate anti-bribery controls, which may include contractual terms, monitoring and approval requirements. Automatic termination is not a universal requirement.

Question 39ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An employee in a high-risk role has not received anti-bribery training for two years. How should the organization respond under ISO 37001:2025?

  1. Take no action because training is a one-time event
  2. Provide refresher training appropriate to the role and risk Correct answer.
  3. Wait until the next external audit to address it
  4. Transfer the employee to a different department

Explanation

Training must be provided on a recurring basis and tailored to roles and risks, so lapsed training in a high-risk role should be refreshed. Training is an ongoing process, not a single event.

Question 40ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

A financial controller notices a payment request with an unusually vague description and an offshore beneficiary. What is the most appropriate ISO 37001:2025-aligned action?

  1. Process the payment because the request was approved by a manager
  2. Delete the request to avoid involvement
  3. Ask the beneficiary to resubmit with a different description
  4. Escalate the payment for scrutiny under the financial controls before processing Correct answer.

Explanation

Financial controls under the standard require scrutiny and escalation of unusual or suspicious transactions before payment. Processing on approval alone or coaching the beneficiary would defeat the control's purpose.

Question 41ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

How should gifts and hospitality be handled to align with ISO 37001:2025?

  1. Prohibit all gifts and hospitality without exception
  2. Apply a documented process with thresholds, approval and recording Correct answer.
  3. Allow any gift provided it is given in cash
  4. Leave the decision entirely to individual discretion

Explanation

The standard expects controls over gifts and hospitality, typically through documented rules with thresholds, approval requirements and records. Blanket prohibition or unfettered discretion are not the prescribed approach.

Question 42ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

A whistleblower reports suspected bribery through the organization's confidential channel. Which action best reflects ISO 37001:2025 expectations for handling the report?

  1. Investigate the report and protect the reporter from retaliation Correct answer.
  2. Forward the report to the business associate named in it
  3. Publicly identify the reporter to demonstrate transparency
  4. Dismiss the report if the reporter is anonymous

Explanation

Reports of suspected bribery should be investigated and reporters protected from retaliation, which encourages people to raise concerns. Exposing or dismissing reporters undermines the reporting process.

Question 43ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

What is the role of the governing body in an ISO 37001:2025 anti-bribery management system?

  1. To approve individual gifts above a token value
  2. To oversee the system and ensure appropriate resources and accountability Correct answer.
  3. To replace the compliance function entirely
  4. To personally conduct every bribery investigation

Explanation

The governing body oversees the anti-bribery management system and holds top management accountable for its effectiveness, including resourcing. It does not perform operational tasks such as investigations or gift approvals.

Question 44ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization wants to ensure its anti-bribery management system remains aligned with its objectives over time. Which activity does ISO 37001:2025 identify for this purpose?

  1. A single review performed at system launch
  2. Quarterly rewriting of the anti-bribery policy
  3. Annual replacement of all senior managers
  4. Periodic management review of the system's performance and suitability Correct answer.

Explanation

Management review is a recurring process in which top management evaluates the system's continuing suitability, adequacy and effectiveness. A one-time review or indiscriminate rewrites do not achieve this.

Question 45ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization identifies a nonconformity during an internal audit of its anti-bribery system. What is the appropriate response?

  1. Record it and take corrective action to address the cause Correct answer.
  2. Remove the audit finding from the report
  3. Wait for the next certification cycle to act
  4. Ignore it if no bribery has yet occurred

Explanation

Nonconformities must be addressed through corrective action that tackles the underlying cause, with records kept as evidence. Ignoring or concealing findings leaves the weakness in place.

Question 46ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

A manager is offered an expensive holiday by a supplier whose contract is up for renewal. Which response best reflects ISO 37001:2025-aligned behaviour?

  1. Accept it because refusing could damage the business relationship
  2. Ask the supplier to provide it in cash instead
  3. Accept it but keep it confidential from colleagues
  4. Decline it and report the offer through the organization's gift process Correct answer.

Explanation

Gifts that could improperly influence a business decision should be declined and recorded through the organization's gift and hospitality process. Confidentiality or cash alternatives would compound the risk.

Question 47ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization is considering a charitable donation requested by a government official in a country where it is bidding for a contract. What should the organization do under ISO 37001:2025?

  1. Route the donation through an intermediary to avoid scrutiny
  2. Assess the donation for bribery risk and apply controls before proceeding Correct answer.
  3. Make the donation quickly to build goodwill
  4. Treat charitable donations as outside the scope of the system

Explanation

Charitable and political donations can be used to disguise bribery, so they should be assessed for risk and subjected to controls such as approval and due diligence. Routing them through intermediaries heightens rather than reduces the risk.

Question 48ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

A company uses a third-party sales agent whose contract lacks any anti-bribery clauses. What is the most significant weakness from an ISO 37001:2025 perspective?

  1. The contract fails to specify the agent's office location
  2. The organization has no contractual basis to require anti-bribery compliance or audit the agent Correct answer.
  3. The agent was not given a copy of the organization's marketing plan
  4. The contract does not include a non-compete clause

Explanation

Contracts with business associates should include anti-bribery commitments and rights to monitor or audit compliance, so their absence removes a key control. Office location, marketing plans and non-compete terms are unrelated to bribery risk management.

Question 49ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

An organization's bribery risk assessment was prepared by a single junior employee without input on high-risk operations. What is the main concern under ISO 37001:2025?

  1. The assessment should be discarded and replaced by the policy
  2. The assessment may be incomplete and fail to reflect the organization's actual risk profile Correct answer.
  3. The assessment is acceptable because one person prepared it
  4. The assessment is invalid because risk assessments must be outsourced

Explanation

A credible risk assessment requires appropriate competence and input covering the organization's activities and high-risk areas. A narrow, uninformed assessment may miss significant exposures and lead to inadequate controls.

Question 50ISO 37001:2025 anti-bribery management system requirements and guidance (foundation-level concepts)

A senior manager argues that because the organization has never faced a bribery allegation, it can reduce its anti-bribery monitoring. How should this reasoning be evaluated under ISO 37001:2025?

  1. It is sound because past absence of incidents proves low risk
  2. It is sound because monitoring is optional for established organizations
  3. It is flawed because monitoring should be proportionate to assessed risk, not merely past incidents Correct answer.
  4. It is flawed only if a competitor has faced an allegation

Explanation

Monitoring and other controls should be driven by the assessed bribery risk, not by the historical absence of incidents, which may simply reflect undetected risk. Reducing monitoring without a risk-based justification weakens the system.