PECB ISO 37301 Lead Auditor common mistakes
PECB ISO 37301 Lead Auditor · Understand the traps and how to avoid them.
When asked to classify a nonconformity, the candidate cites a clause number from memory without quoting the requirement text, and often attributes a 'shall' from ISO 37301 to the wrong clause or invents a plausible-sounding obligation that does not exist in the standard.
The candidate studied summaries and gap-analysis checklists rather than the standard's actual clause structure, so clause numbers and requirement wording blur together under time pressure; certification bodies' marketing summaries and blog posts are often paraphrased loosely and omit distinctions between 'shall', 'should' and 'may'.
What to do instead
Build a one-page clause map from the standard itself: for each clause from 4 to 10, write the clause heading, the number of 'shall' statements, and a ten-word paraphrase of each. Practise writing nonconformity statements in the form 'Requirement (clause x.y): . Evidence: . Gap: .', and never write a finding without quoting the requirement verbatim from your map.
The candidate treats a missing or outdated documented procedure as automatically a major nonconformity, and conversely treats a fully documented procedure as evidence that the process is effective, without examining records or interviewing process owners.
Documentation is the easiest evidence to obtain in a desk review, so candidates anchor on it; many candidates come from a documentation-writing background where the document itself is the deliverable, and they have not internalised that ISO 37301 is a management-system standard judged on implementation and effectiveness, not on a document set.
What to do instead
For every requirement, force yourself to name three evidence types: document, record, and interview/observation. Practise grading findings on a two-axis test: is the requirement unmet (nonconformity) versus is the requirement met but the outcome not achieved (effectiveness concern)? Rehearse the phrase 'the procedure exists and is current, but sampling of five completed due-diligence checks showed three without approval, therefore the control is not being applied' as the model for a defensible finding.
The candidate conflates compliance risk assessment with enterprise risk management generally, and cannot explain how the organisation's compliance obligations are identified, how the risk of non-compliance is evaluated, and how that output drives the compliance policy, objectives and controls.
Risk terminology is familiar from other standards, so candidates answer from generic ISO 31000 knowledge and skip the ISO 37301-specific logic that obligations come first, then the risk of failing to meet them; the standard's sequencing is easy to miss if the candidate has only read clause headings.
What to do instead
Draw the causal chain on one page: context and interested parties, then compliance obligations (mandatory and voluntary), then risk of non-compliance per obligation, then controls and mitigation, then monitoring and reporting to the governing body. For each arrow, write the clause that requires it. In exam scenarios, ask 'where in this chain is the break?' rather than 'is there a risk register?'.
The candidate describes the compliance function as the owner of all compliance risk and writes audit findings against the compliance officer for failures occurring in business units, instead of auditing the governance arrangements, mandate, independence and reporting lines that make the function effective.
The word 'compliance' in the exam title pulls attention to the compliance department, and candidates who work in compliance roles import their operational view; the standard instead places responsibility on the governing body and top management, with the compliance function supporting and advising.
What to do instead
Memorise the three-lines distinction in ISO 37301 terms: the governing body and top management are accountable, the compliance function has a mandate of oversight and advice, and business functions own their compliance obligations. When writing a finding, test the finding against the question 'who is accountable under the standard for this outcome?' before naming an owner, and practise writing findings against governing-body oversight of the compliance function rather than against the function itself.
The candidate answers audit-principle questions with slogans such as 'auditors must be independent and objective' but cannot apply the principles when a scenario introduces a real conflict, for example an auditor who previously designed the process being audited, or an audit team pressured by the client to soften a finding.
Principles are learned as a list to be recited, not as decision rules; candidates do not rehearse the trade-off between evidence-based decision-making, confidentiality, and the client relationship, and they underestimate how often the exam tests the principle through a scenario rather than a definition.
What to do instead
For each principle, write a one-line decision rule and a scenario you can apply it to, for example 'independence concerns the freedom from bias and conflict of interest, not the absence of a prior employment relationship; where objectivity is compromised, the auditor must be replaced or the finding escalated'. Practise three scenarios per principle and state the action, the principle invoked, and the consequence of ignoring it.
The candidate mixes up audit criteria, audit evidence and audit findings, writing findings that state an opinion ('the compliance culture is weak') or a recommendation ('the organisation should implement a whistleblowing hotline') instead of a requirement-evidence gap.
Business writing habits reward conclusions and recommendations, and candidates carry that style into audit reporting; also, the audit criteria are often assumed rather than explicitly stated at the opening meeting, so the candidate has nothing to compare evidence against and drifts into opinion.
What to do instead
Before writing any finding, state the criteria in one sentence. Then apply a three-part template: criteria (quoted requirement or agreed audit criterion), evidence (document, record, interview with date and sample size), conclusion (conformity, minor nonconformity, major nonconformity, observation or opportunity for improvement). Delete any sentence containing 'should' from the finding body and move recommendations to a separate section if the audit scope permits them.
The candidate builds an audit plan that lists clauses to be checked but not processes, locations, shifts, interviewees, sampling rationale or time allocations, and does not tailor the plan to the organisation's compliance obligations and risk profile.
Candidates copy a generic clause-by-clause checklist because it feels complete and is easy to memorise; they also underestimate how much of the planning marks depend on demonstrating risk-based sampling and coverage of the full audit scope, including outsourced processes and remote sites.
What to do instead
Draft plans in a table with columns for process, clause coverage, auditee role, location or shift, time, sampling approach and evidence to be sought. Justify each sample in one line ('three of twelve third-party intermediaries, selected by transaction value and country risk'). Before finalising, run a coverage check that every clause in scope is touched by at least one process and every high-risk obligation has at least one planned evidence source.
The candidate prepares a document-review-only audit plan and treats interviews as confirmation of documents, failing to plan for sampling records, observing processes in operation, and following trails from a compliance obligation through to a control and its evidence.
Document review is comfortable and can be done remotely, while observing real work and interviewing sceptical process owners feels risky; candidates also confuse 'reviewing the compliance management system documentation' with 'auditing the compliance management system'.
What to do instead
For each planned audit day, allocate explicit blocks to record sampling and to observation, and design at least two trace tests per audit: pick one compliance obligation and trace it through risk assessment, control design, operating record and monitoring report; pick one reported incident and trace it through investigation, root-cause analysis, corrective action and effectiveness check. Write the trace path into the plan so it cannot be skipped.
During the audit, the candidate asks closed or leading questions, accepts verbal assurance ('we always do that') as evidence, and fails to pursue an ambiguous answer or a discrepancy between what is said and what the records show.
Candidates fear appearing confrontational or incompetent, and time pressure in role-play or scenario questions rewards moving on; without a rehearsed question ladder, the candidate has no structured way to probe, so the first answer closes the topic.
What to do instead
Rehearse an open-to-closed ladder: 'walk me through how this is done', then 'show me the record for the last three cases', then 'what happens when the approver is unavailable', then 'how do you know it worked'. Adopt the rule that verbal statements are corroborated by at least one record or observation before being used as evidence, and practise the neutral probe 'help me understand why the register shows a different date from the report'.
The candidate closes the audit by listing findings without grading them, omits the audit conclusion on the effectiveness of the compliance management system, and cannot explain the difference between correction, root-cause analysis, corrective action and verification of effectiveness in the follow-up.
Closing is treated as an administrative step after the fieldwork, so candidates do not prepare the grading rationale or the conclusion; the corrective-action vocabulary is also confused with the everyday meaning of 'fixing the problem', and the standard's requirement to evaluate the need for action on the management system, not just the symptom, is missed.
What to do instead
Prepare a closing script: findings with grade and criteria, then the audit conclusion stated against the audit objectives and scope, then the follow-up mechanism and who verifies effectiveness and when. For every finding, write four lines: containment, root cause, corrective action, effectiveness check. Practise distinguishing a correction ('re-approved the three due-diligence checks') from a corrective action ('revised the approval workflow so the check cannot be closed without approval, and sampled ten cases to confirm').
The candidate designs an audit programme as a single annual full-scope audit, or as a fixed three-year cycle copied from a certification scheme, without considering the results of previous audits, the organisation's compliance risk profile, changes in obligations, or the competence needed across the programme.
Certification-scheme recertification cycles are the most familiar model, so candidates transplant them; the standard instead requires the programme to be risk-based and reviewed, and candidates rarely articulate how audit frequency and scope should respond to findings, incidents, regulatory change or organisational restructuring.
What to do instead
Write a programme document with explicit inputs (risk assessment output, previous findings, incident trends, regulatory changes, interested-party expectations) and show how each input changes frequency, scope or depth. Include a competence matrix for the audit team and a process for monitoring programme performance and reviewing it at planned intervals. In scenario questions, answer with the risk-based justification rather than a fixed cycle.