PECB ISO 37001 Transition study plan

Map the clause structure of ISO 37001:2025 (context, leadership, planning, support, operation, performance evaluation, improvement) and label which clauses carry bribery-specific content versus standard management-system text

Define anti-bribery management system, bribery, and the roles of governing body, top management, compliance function, and anti-bribery compliance function in your own words

List the documented information the standard requires and note where each is generated in the clause sequence

Build a one-page glossary of 20 core terms with a short definition and clause reference for each

Compare the 2025 revision against the prior edition on governance and leadership, recording each change in a two-column change log

Explain how strengthened governing-body oversight, accountability at the top, and compliance-function independence are expected to operate in practice

Trace how the bribery risk assessment feeds the planning clause, the objectives, and the operational controls

Draft five exam-style questions on governance changes and answer them without notes

Describe the support and operation clauses: resources, competence, awareness, communication, and documented information control

Explain the controls the standard expects over gifts, hospitality, donations, and political contributions, and how they connect to the risk assessment

Outline how performance evaluation works: monitoring, measurement, internal audit, and management review inputs and outputs

Summarize the nonconformity and corrective action process and how it drives continual improvement

Define due diligence in the standard's terms and distinguish it from risk assessment and from ongoing monitoring

Classify third parties and business associates by bribery risk and state the proportionate due diligence each tier requires

Explain the due diligence expectations for transactions such as mergers, acquisitions, joint ventures, and new business relationships

Identify the red flags that should trigger enhanced due diligence and describe what evidence the organization should retain

Draft the sections of a third-party due diligence procedure covering onboarding, periodic review, and exit

Explain how due diligence findings must feed contractual controls and the organization's own anti-bribery controls over intermediaries

Describe the standard's expectations for gifts, hospitality, and facilitation payments in relation to third-party conduct

Compare the whistleblower and reporting provisions of 2025 with those of the prior edition and record the differences

Distinguish a safe reporting channel from a general grievance mechanism and list what makes a channel safe in practice

Describe the protections the standard expects for people who report in good faith, including against retaliation, and who the protection extends to

Explain confidentiality, anonymity where permitted, and how reports are triaged, investigated, and closed

Outline the governance of the reporting channel: independence, oversight, record keeping, and reporting to the governing body

Identify how a non-retaliation policy is communicated and how its effectiveness is monitored

Integrate the four domains into a single narrative of how an anti-bribery management system operates end to end

Work through at least 40 practice questions across all domains and log every wrong answer with the underlying concept

Re-study the two weakest concepts identified from the practice log and restate each in your own words

Rehearse explaining due diligence tiers and whistleblower protections aloud in under three minutes each

Review the change log and the comparison table and confirm you can state each change without referring to notes

Take two timed practice sets and score them, then compare results against week 7 to confirm improvement

Drill the highest-risk recall items: governance accountability, due diligence triggers, and retaliation protection scope

Write a one-page personal cheat sheet of the 20 facts most likely to be tested and recite it from memory