ISO 37001:2025 Internal Auditor Training

Starts by asking whether your controls would notice a bribe paid through an agent, then takes three enforcement cases: Ericsson's settlement of more than one billion US dollars under the US Foreign Corrupt Practices Act, Airbus's global penalties of more than 3.9 billion US dollars, and ABB's 315 million US dollars over bribes to an Eskom official. From them come three audit themes: business associates, payments and public officials. The module introduces Crestline Contracting, a worked example of a civil and building services contractor in Dubai with about 1,500 staff, government tenders, a success-fee agent and a joint venture. A gifts register traced to expense claims shows why clause 9.2 audits need evidence. It closes with the scope of ISO 37001:2025, bribery by and of the organisation, referring suspicions rather than investigating, and how the course and exam work.

What you will be able to do

• Explain what the Ericsson, Airbus and ABB cases teach an anti-bribery internal auditor
• Distinguish bribery by the organisation from bribery of the organisation
• Describe why an auditor refers a suspected bribe instead of investigating it

Why it matters

Shows staff why anti-bribery controls must be tested with evidence before a prosecutor does, and which risks an ISO 37001 audit covers.

Practice: Practice: Welcome: why anti- bribery audits matter · 3 questions

Begins with recurring clearance tips in Crestline's petty cash book. The module sets out what the second edition, published in February 2025, changed: anti-bribery culture, climate change, conflicts of interest, the clarified anti-bribery function and planning of changes in clause 6.3, noting that 2016 certificates expire at the end of February 2027. It explains the scope boundary, which excludes fraud, cartels and money laundering, and the clauses ISO 37001 adds, including the bribery risk assessment in 4.5 and controls in 8.2 to 8.10. It defines bribery, governing body, anti-bribery function, personnel, business associate, public official, third party, conflict of interest, due diligence and anti-bribery culture, and why a requirement here is stated and obligatory. Annex A guidance on facilitation and extortion payments, reasonable and proportionate measures and low risk follows, ending with a Mumbai import-licence exercise.

What you will be able to do

• Explain the main changes in ISO 37001:2025 and why a 2016 checklist needs updating
• Apply the definitions of bribery, business associate and public official to audit situations
• Distinguish a facilitation payment from an extortion payment using Annex A

Why it matters

Lets auditors write findings in the exact words of the 2025 edition and judge each control against the bribery risk it addresses.

Practice: Practice: The 2025 standard, an auditor's view · 3 questions

Opens with Crestline's compliance manager, who is also the anti-bribery function, auditing the whole system for three years with no findings while an agent's success fees go unchecked. The module explains clause 9.2.1 and its two sets of criteria, then the programme in 9.2.2: frequency, methods, objectives, criteria, scope and reporting to managers, the function, top management and the governing body. Clause 9.2.3 requires reasonable, proportionate and risk-based audits reviewing controls for bribery, policy violations, non-conforming business associates and weaknesses. Clause 9.2.4 lists five options for auditors and the rule that no auditor audits their own area of work. Annex A guidance in A.16 covers third-party auditors, unannounced audits and the governing body's role. A London engineering consultancy with forty staff shows a small-firm approach, and the module drafts the Crestline finding with a Singapore exercise.

What you will be able to do

• Explain what clause 9.2 requires of an anti-bribery audit programme and its reporting
• Identify the four kinds of review an anti-bribery audit must cover under clause 9.2.3
• Apply the five options of clause 9.2.4 to decide who may audit which area

Why it matters

Helps organisations run audits that meet the ISO 37001 objectivity rules and avoid the function auditing the system it runs.

Practice: Practice: Internal audit in ISO 37001 · 3 questions

Places ISO 19011:2026, the fourth edition published in May 2026, as guidance behind clause 9.2, with expanded guidance on remote auditing. The module defines an audit under clause 3.19 and objective evidence, stressing that suspicion and rumour are not findings. Crestline's gifts register shows three evidence sources disagreeing: an interview, fourteen register entries and twenty-six expense claims above the limit. That case and a Mumbai pharmaceutical distributor with two agents lacking due diligence teach the chain of criteria, evidence, finding and conclusion. It covers nonconformity, opportunities for improvement and good practice; audit roles; programme, scope and plan; combined, joint and remote audits; and first, second and third-party audits. The seven principles follow, stressing independence and conflicts of interest, then audit versus a clause 8.10 investigation, a Nairobi logistics company audited remotely and a gossip exercise.

What you will be able to do

• Explain the chain of audit criteria, evidence, finding and conclusion
• Compare interviews, records and observations as sources of audit evidence
• Distinguish an internal audit of the system from an investigation of suspected bribery

Why it matters

Gives auditors a disciplined method so every finding rests on verifiable evidence and a named criterion, not on suspicion.

Practice: Practice: Audit concepts and principles · 3 questions

Starts with Crestline's scope covering the United Arab Emirates only, while its risk assessment rates an agent-led hospital tender in another Gulf country as high risk. The module explains clause 4.1 and its eight factors, from size, structure and delegated decision-making to interactions with public officials, and the recorded decision on climate change. Clause 4.2 is illustrated with government clients, lenders, regulators and employees, separating mandatory requirements from voluntary commitments such as an industry integrity pledge. Clause 4.3 adds the bribery risk assessment as an input to scope, comparing a weak and a strong scope and treating controlled entities under clause 8.5.1. Clause 4.4 asks for measures that prevent, detect and respond. A London engineering consultancy working through overseas partners follows, then auditor questions, expected evidence, the written finding and a Toronto exercise.

What you will be able to do

• Identify the eight factors of clause 4.1 and check each appears in the context analysis
• Test the scope of the anti-bribery management system against the bribery risk assessment
• Check that the system contains measures to prevent, detect and respond to bribery

Why it matters

Helps auditors catch high-risk tenders, agents and locations left outside the anti-bribery management system before an incident does.

Practice: Practice: Context, parties, scope and the ABMS · 3 questions

Opens with a two-year-old Crestline risk assessment that omits a new success-fee agent, a hospital tender abroad and a majority-owned joint venture. The module explains the three steps of clause 4.5.1, with permit, agent, procurement and customs risks, and why both outbound and inbound bribery must be assessed. Clause 4.5.2 criteria are covered with the Annex A example of risk levels, factors, a published bribery index and ratings for categories of business associates. It traces a risk through identify, rate, rank and evaluate, testing control effectiveness with nine of thirty urgent purchases on a single quote. Clause 4.5.3 review triggers and clause 4.5.4 documented information follow, with one high risk traced into due diligence, controls, training and audits. A Sydney mining services company, two written findings and a Hong Kong bank exercise complete it.

What you will be able to do

• Assess whether bribery risks are identified, rated, ranked and compared with controls
• Identify significant changes that should have triggered a review under clause 4.5.3
• Trace one high bribery risk into due diligence, controls, training and audits

Why it matters

Shows whether the bribery risk assessment still reflects the business and actually drives the controls built on it.

Practice: Practice: The bribery risk assessment · 3 questions

Begins with twelve months of Crestline board minutes that never mention the system, and a chief executive telling sales to win the hospital tender whatever it takes. The module explains clause 5.1.1 governing body duties, from approving the policy to reasonable oversight, and who the governing body is under clause 3.7. It groups top management's thirteen duties in clause 5.1.2, stressing protection for good-faith reports and for refusing bribes even when business is lost, and reporting allegations of serious bribery to the board. Clause 5.1.3 on anti-bribery culture, new in 2025, is audited through Annex A factors, records and interviews, with four quick checks. A Paris energy trading company's quarterly ethics committee shows good practice. Two findings follow, including a board report missing two logged allegations, and a possible retaliation case handled with care.

What you will be able to do

• Assess whether the governing body receives and reviews system information at planned intervals
• Check top management's reports to the board against the function's case log
• Apply four practical checks to audit anti-bribery culture through records and interviews

Why it matters

Lets auditors test whether leadership commitment is real, so the board hears about allegations and staff who refuse bribes are protected.

Practice: Practice: Leadership and anti-bribery culture · 3 questions

Starts with Crestline's anti-bribery function held part time by the head of procurement, who approves the largest supplier awards and reports only through the finance director. The module lists the nine contents of the clause 5.2 policy and how it is documented, communicated in appropriate languages and sent to business associates posing more than a low risk, comparing a weak and a strong policy. Clause 5.3.1 sets out roles for top management, managers and personnel. Clause 5.3.2 gives the function four responsibilities and requires competence, status, authority, independence and direct, prompt access to the governing body. It explains why auditors interview the managers who run controls, not only the function. Clause 5.3.3 delegated decisions free of conflicts of interest are shown through subcontract awards, variations and agent appointments. A Singapore logistics company, two findings and a Mumbai exercise close it.

What you will be able to do

• Check an anti-bribery policy against the nine contents required by clause 5.2
• Assess whether the anti-bribery function has independence and direct access to the board
• Test a delegated decision against the authority matrix and conflict declarations

Why it matters

Helps auditors spot a function that cannot act independently and a policy missing required content, before either weakens the system.

Practice: Practice: Policy, roles and the function · 3 questions

Opens with Crestline's two objectives, zero bribery and be ethical, and a move to an online procurement system nobody assessed for anti-bribery controls. The module separates clause 6.1 risks and opportunities to the system, such as an overloaded function or an e-tendering portal, from the clause 4.5 bribery risk assessment, and traces an action through planning, integration and evaluation. Clause 6.2 sets eight qualities for objectives and six planning elements, including who imposes sanctions or penalties, with weak and strong objectives compared and mid-year monitoring of an agent due diligence target. Clause 6.3, new in 2025, and clause 8.1 require planned changes, with an Annex A checklist. A procurement change that left large orders on one approval for eight months contrasts with a Hong Kong bank's planned gifts workflow. Two findings and a Paris exercise follow.

What you will be able to do

• Distinguish risks to the management system from the bribery risks assessed in clause 4.5
• Assess anti-bribery objectives for measures, owners, dates, monitoring and sanction holders
• Audit a system change by listing the anti-bribery controls it touched

Why it matters

Helps auditors confirm that plans become owned, measurable actions and that system changes do not quietly remove approval controls.

Practice: Practice: Risks, objectives and changes · 3 questions

Opens with a Crestline procurement manager whose conflict of interest declaration is two years old while a relative's scaffolding supplier has won four orders, and a sales bonus paid only on contracts won. The module covers clause 7.1 resources and clause 7.2.1 competence. Clause 7.2.2.1 sets out employment conditions, policy and training, discipline, protection from retaliation and the duty to report conflicts. Clause 7.2.2.2 adds, for exposed positions, due diligence before hiring or promotion, bonus reviews at planned intervals and periodic declarations, with Annex A examples. Conflicts of interest under clause 3.28 are explained with four Annex A examples and a cycle of declaring, recording, acting and reviewing. Inbound bribery data checks, labour-supplied site workers and a New York hospital group's address matching follow, then two findings and a Sydney promotion exercise.

What you will be able to do

• Identify positions exposed to more than a low bribery risk and the extra controls they need
• Assess whether bonuses and targets have been reviewed for safeguards at planned intervals
• Audit a conflict of interest register for dates, actions and refreshed declarations

Why it matters

Prepares auditors to test the HR controls where bribery often begins, catching stale declarations and risky bonus schemes early.

Practice: Practice: People, competence and conflicts · 3 questions

Begins with all 1,500 Crestline staff taking the same twenty-minute English-only course, reported as ninety-eight per cent completion, while many site workers read Hindi, Urdu or Tagalog. The module explains the clause 7.3.1 awareness points and how awareness differs from training. Clause 7.3.2 requires training that takes the bribery risk assessment into account, with Annex A guidance on adapting it by role, including in-person training for top management and higher-risk roles. It shows how to test understanding rather than completion, with four key risk indicators. New joiners, the function and internal auditors are covered, then clause 7.3.3 training for business associates through contract terms and clause 7.3.4 timing. Clause 7.4 communication, including languages, is applied to toolbox talks. A Toronto software company's scenario workshops, a training test and two findings close it.

What you will be able to do

• Distinguish awareness from training and check both against clause 7.3
• Use scenario questions in interviews to test whether anti-bribery training was understood
• Check that the policy is available in the languages the workforce actually reads

Why it matters

Moves training audits beyond completion rates to whether high-risk staff and associates know how to respond to a bribe request.

Practice: Practice: Awareness, training and communication · 3 questions

Starts with Crestline's gifts register, a shared spreadsheet anyone can edit with three entries deleted, and agent due diligence files locked on an absent director's personal drive. The module explains the two kinds of documented information in clause 7.5.1, the Annex A list of typical records and why the extent depends on size and risk. Clause 7.5.2 covers identification, format and approval, and clause 7.5.3 covers availability, protection from loss of confidentiality, improper use and integrity, version control, retention and external documents such as tender rules and lender requirements. It follows a five-step document change trail, separates documents from records, and tests access to concern and investigation files under clauses 8.9 and 8.10. A Mumbai pharmaceutical distributor's seven-year retention, four quick tests, the auditor's own working papers and two written findings complete it.

What you will be able to do

• Identify the records an anti-bribery management system should hold and where each lives
• Assess whether registers are protected from silent changes by access rights and change logs
• Apply version, approval, access and retrieval tests to documented information

Why it matters

Confirms anti-bribery records would stand up as evidence, protect reporters' identities and can be produced when an investigation needs them.

Practice: Practice: Documented information · 3 questions

Opens with the due diligence file on Crestline's hospital tender agent: one self-completed questionnaire, a success fee twice the usual rate and an owner who once worked for the ministry running the hospital. The module covers clause 8.1 operational planning and control, maps the specific controls of clauses 8.2 to 8.10, and shows how an outsourced customs clearing agent is controlled. Clause 8.2 requires due diligence where the risk assessment found more than a low risk, for transactions, business associates and personnel, updated at a defined frequency. Annex A factors, six questions on associates and methods such as web searches and debarment lists, including the World Bank's, show what good looks like. It covers proportionate depth, the limits of due diligence and the four decisions it should produce. A London engineering consultancy, two written findings and a Hong Kong bank exercise complete it.

What you will be able to do

• Check that due diligence categories follow the bribery risk assessment and are recorded
• Assess a business associate file for ownership, capability, reputation and payment terms
• Write a finding where due diligence on a high-risk agent was missing or out of date

Why it matters

Helps auditors catch weak checks on agents and other high-risk associates, the route used in the Ericsson case, before a payment is made.

Practice: Practice: Operations and due diligence · 3 questions

Begins with an agent's success fee paid on an invoice reading only consultancy services, raised and approved by one person, and two Crestline subcontract awards evaluated by a single engineer. The module explains clause 8.3 and the nine Annex A financial controls, from separation of duties and tiered authority to restricted cash and accurate descriptions, linking unclear entries to the ABB case. A petty cash test compares site expenses with permit inspection dates. Clause 8.4 non-financial controls are shown across eight areas, from procurement and sales to mergers and acquisitions, with Annex A procurement controls such as three competitors and two evaluators. Variations, acquisitions and disproportionate agent fees, recalling Ericsson's sham contracts, are covered. It shows how to trace one high-risk payment end to end and run a separation-of-duties query. A Paris energy trading company, two findings and a Sydney exercise close it.

What you will be able to do

• Trace a high-risk payment from request to bank transfer against the financial controls
• Use a system query to test separation of duties across payments to high-risk payees
• Assess non-financial controls over tenders, variations and acquisitions as well as purchasing

Why it matters

Gives auditors practical tests that follow the money, so disguised bribes in vague invoices, petty cash or inflated variations are found early.

Practice: Practice: Financial and non-financial controls · 3 questions

Starts with Crestline Interiors, a controlled subsidiary with no anti-bribery controls, and an agent contract with no commitment or termination right. The module explains clause 8.5.1: controlled organisations either join the organisation's system or run their own proportionate controls, and what control means. Annex A shows how bribery travels through subsidiaries, joint venture partners, agents and suppliers. Clause 8.5.2 asks whether higher-risk associates have controls, requiring them where practicable depending on influence, with Annex A guidance on how much to require and four steps to make it real. Clause 8.6 requires written commitments and a right to terminate from associates posing more than a low risk. The Airbus case shows why auditors follow the payment, not just the contract. The road joint venture, a Singapore logistics company's broker controls, a four-step test, the labour supplier and two findings follow, with a Toronto reseller exercise.

What you will be able to do

• Check every controlled entity against the two options set out in clause 8.5.1
• Assess whether a higher-risk associate's controls were determined, required or factored into risk
• Read a signed contract for an anti-bribery commitment and a right to terminate

Why it matters

Helps auditors extend anti-bribery controls to subsidiaries, joint ventures and agents, where much bribery is paid on the organisation's behalf.

Practice: Practice: Associates and commitments · 3 questions

Opens with Crestline's register of fourteen gifts against twenty-six expense claims above the limit, including a beach resort weekend for a municipal inspector and his family two weeks before an inspection. The module explains clause 8.7, which covers giving and receiving and anything that could reasonably be perceived as bribery. It lists similar benefits from Annex A, including confidential information, linked to the ABB case and the Eskom official. Controls by value, timing, recipient and reasonableness are covered, with who counts as a public official, prior approval, an open register and supervision. Donations, sponsorship and paid travel for officials have their own checks, and a legitimate inspection trip is compared with the beach weekend. A data test matches expense claims to the register, finding twelve missing, three involving officials. A Hong Kong bank, the finding, referring the beach weekend and a New York exercise close it.

What you will be able to do

• Match expense claims above the approval limit to the gifts and hospitality register
• Assess donations, sponsorship and official travel against the checks Annex A describes
• Distinguish a control finding on gifts from a concern that must go to the anti-bribery function

Why it matters

Gives auditors a one-hour data test that shows whether the gifts control works, before an unregistered dinner for officials reaches the press.

Practice: Practice: Gifts, hospitality and donations · 3 questions

Begins with a Crestline customs clearing agent appointed despite high-risk due diligence findings about its owner's link to a customs official, and a concerns hotline whose number is out of service. The module explains clause 8.8 as the way a system says no: enhance controls, exit an existing relationship as soon as practicable, or postpone or decline a new one. Clause 8.9 requires procedures that encourage reporting, protect confidentiality, allow anonymous reporting, prohibit retaliation and offer advice, with notes on third-party channels and ISO 37002 whistleblowing guidance. It distinguishes confidential from anonymous reports, maps who receives reports about senior managers, and shows how to run an agreed test call. It explains why zero reports may signal a broken channel. A London engineering consultancy's twelve-language hotline, the auditor's own use of the procedure, two written findings and a Singapore exercise follow.

What you will be able to do

• Trace a due diligence decision where controls could not manage the identified bribery risk
• Test each concerns channel with an agreed test report and trace where it went
• Distinguish confidential from anonymous reporting and check that both routes work

Why it matters

Helps organisations prove their speak-up channels actually work and that high-risk relationships are refused, not waved through.

Practice: Practice: Inadequate controls and raising concerns · 3 questions

Starts with a concern that a Crestline site manager asked for payments to approve variations, investigated in one day by his own line manager, who had approved many of the same variations, without telling the anti-bribery function. The module sets out the six requirements of clause 8.10 and the rule that investigators are not part of the role or function investigated. It follows the Annex A flow from receiving and assessing a report to investigating, reporting and acting, contrasting a festival gift of dates with the variations concern. It covers investigator powers, skills and methods, ISO/TS 37008, factors to weigh before starting, and appropriate actions, from discipline to reporting to authorities. It stresses that auditors review closed cases for process and never retry a case. A five-point case sampling method, Crestline's case log, a Mumbai pharmaceutical distributor, two findings and a Paris exercise follow.

What you will be able to do

• Assess whether investigators were independent of the role or function being investigated
• Sample closed case files for timeline, signed reports, actions taken and changed controls
• Explain why an internal auditor audits the investigation process but never retries a case

Why it matters

Lets auditors confirm that bribery concerns are investigated independently and lead to control changes, without harming live cases.

Practice: Practice: Investigating and dealing with bribery · 3 questions

Opens with a Crestline management review minuted in one line, the system is working well, and three corrective actions closed as staff retrained. The module explains clause 9.1 monitoring, with a sample Crestline monitoring plan and Annex A examples, from training effectiveness and sample testing to audits not performed and the status of anti-bribery culture. Clause 9.3 asks for two reviews: top management's, with the inputs of clause 9.3.2 including reports of bribery, investigations and the nature of bribery risks, and the governing body's review of implementation. Clause 9.4 adds the anti-bribery function's continual review and reports. The module sets the reviews beside internal audit, then covers clause 10.2 corrective action and root cause analysis, and clause 10.1 continual improvement. A Toronto software company's review practice, two written findings and a Sydney exercise on ad hoc board reporting complete it.

What you will be able to do

• Check management review minutes against every input that clause 9.3.2 requires
• Distinguish the three reviews of ISO 37001 and the evidence each one should leave
• Assess whether a corrective action found the root cause and was checked for effectiveness

Why it matters

Helps auditors show whether reviews rest on real evidence and corrective actions stop repeat failures, so the board's assurance is well founded.

Practice: Practice: Monitoring, reviews and improvement · 3 questions

Begins with last year's one-line Crestline audit plan, which never reached the agent, customs payments or gifts, its three highest risks. The module places planning in the ISO 19011:2026 audit flow, then restates clauses 9.2.2 and 9.2.3 and the guidance to prioritise higher inherent risk and lower performance. A Crestline programme grid sets audit frequencies by risk, with Annex A ideas on sampling, unannounced audits and governing body direction, and a mid-year change after a concern about a new customs agent. It covers selecting auditors free of conflicts, then defines objectives, scope and criteria for an agent audit and for a Mumbai pharmaceutical distributor's gifts audit at state hospitals. A sample audit plan, mixing on-site and remote methods, preparation sources, four checklist types including Sterling's risk-based checklist, weak and strong checklist lines and four planning mistakes follow.

What you will be able to do

• Plan a risk-based audit programme that audits the highest bribery risks first and most often
• Define audit objectives, scope and criteria, naming each clause by number and title
• Write checklist questions that ask for a named sample and objective evidence

Why it matters

Makes sure audit time goes to agents, customs, permits and gifts rather than paperwork, so the audit tests the controls most likely to fail.

Practice: Practice: Planning a risk-based audit · 3 questions

Starts with a Crestline sales office audit with no opening meeting, an expensive lunch accepted from the sales director and a concern-raiser named to a colleague. The module covers the three purposes and eight points of the opening meeting in ISO 19011:2026, with a ten-minute opening for the agent audit and a weak and strong opening compared. On-site rules from Annex A include safety inductions, avoiding disruption and never touching registers or files, plus permission for copies, protecting names under clauses 8.9 and 8.10, and keeping guides from interfering. Remote methods from Table A.1 are explained, with four rules and a Singapore logistics company auditing customs brokers in three countries live. It covers declining hospitality, seventeen qualities of a good auditor and five traits of a bad one, an interview run two ways and two short exercises on guides and disclosed concerns.

What you will be able to do

• Run an opening meeting that confirms the plan, roles, sampling and confidentiality
• Choose between on-site and remote methods to fit the anti-bribery evidence needed
• Apply integrity and confidentiality rules when offered hospitality or told of a concern

Why it matters

Builds the trust that makes auditees talk, while protecting reporters' identities and the auditor's own integrity during anti-bribery audits.

Practice: Practice: Conducting the audit, I opening, site, people · 3 questions

Opens with investigating to the depth necessary, using a trail from a large Crestline payment to a customs clearing agent through invoices with unexplained expediting fees and no receipts. The module follows Figure 2 of ISO 19011:2026 from sources of information to verified evidence, findings and conclusions, with Annex A checks that evidence is complete, correct, consistent and current. A Sydney mining services company's emergency payment shows why auditors verify before writing. It compares judgement-based and statistical sampling, the risk of sampling, and Annex A data checks on payroll, expenses and supplier records, where a bank match found a buyer sharing an address with a supplier. Open, closed and leading questions and good note taking follow. The core exercise traces the hospital tender won through an agent across ten clauses, recalling Airbus and Ericsson, with a defensible sample and two short checks.

What you will be able to do

• Verify audit information as complete, correct, consistent and current before relying on it
• Choose a judgement-based or statistical sample sized to the bribery risk and record it
• Follow one high-risk transaction end to end across the clauses of ISO 37001

Why it matters

Teaches the habit that finds concealed bribery risk: following one transaction across the system rather than ticking clauses one by one.

Practice: Practice: Conducting the audit, II one transaction · 3 questions

Begins with reviewing findings with the auditee before the closing meeting, and the change in ISO 19011:2026 from requiring acceptance to seeking acknowledgement that the evidence is accurate. The module covers generating findings and grading, with Sterling's major and minor grading criteria applied to Crestline examples, and four nonconformities that will not stand. It sets out the four parts of a nonconformity from Annex A, with worked examples on same-user payments and twelve unregistered gifts, and weak and strong statements compared. When an audit finds what looks like a bribe, the auditor stops, secures notes, reports through clause 8.9 and tells nobody else, keeping the system finding apart from the concern. The closing meeting, audit report contents, reporting to four audiences under clause 9.2.2 and a Hong Kong bank's audit committee follow, then clause 10.2 responses, follow-up and an exercise on a weak corrective action.

What you will be able to do

• Write a nonconformity in four parts: criteria, evidence, statement and grade
• Separate a system finding from a suspected bribery concern and route each correctly
• Review a corrective action response and decide whether it addresses the cause

Why it matters

Produces findings management acts on and reaches the board where needed, while routing suspected bribery so a later investigation is not compromised.

Practice: Practice: Findings, reporting and follow-up · 3 questions

Starts with a new auditor who asked for everything and received nine hundred files. The module sets out a core document request, then a targeted list for each function with the clause behind it and a typical finding: the governing body and top management, the anti-bribery function and its case log, HR and exposed roles, procurement tender files, finance access rights and same-user queries, sales agent files and contracts, site permit logs, petty cash and customs receipts, legal and controlled entities, and internal audit itself. It recommends an interview order that starts with the function and the highest risks and ends with top management. It covers handling sensitive evidence without names, a one-page request for Crestline's agent audit, using three sources of evidence, pulling records live from systems, four red flags such as identical round-sum invoices, and a Paris controlled-entity exercise.

What you will be able to do

• Prepare a one-page targeted evidence request for each function in the audit scope
• Identify the records to sample in finance, sales, site operations and procurement
• Recognise red flags in anti-bribery evidence and treat them as questions, not findings

Why it matters

Saves audit time and gets better evidence by asking for the right records in each function and sampling them live from real systems.

Practice: Practice: The evidence, function by function · 3 questions

Sets out an effective internal audit in six steps: start from the ISO 37001 requirements, understand the area's setting and previous results, check documents against the work, test objectives and awareness, test controls, cases and results, and close properly. A mock audit of permits and customs on the road project, led by the procurement lead as an independent auditor, traces twenty-two inspections against petty cash and customs invoices. It records a conformity on petty cash, a major nonconformity on expediting fees without official receipts, a minor one on site manager training, and reports the possible facilitation payments to the function the same day. Closing, reporting to the audit committee and a ninety-day follow-up are shown. Four habits, four common failures and five takeaways lead into the thirty-question final exam, the sixty per cent pass mark for the Certificate of Competence, one retake and advice on a first audit.

What you will be able to do

• Apply the six steps of an effective internal audit to an area of your own organisation
• Grade findings from a mock audit and keep suspected bribery separate from the report
• Plan a first internal audit in an area outside your own work

Why it matters

Leaves learners ready to plan, conduct and report ISO 37001 internal audits in their own organisation and to sit the final exam.

Practice: Practice: An effective audit, end to end · 3 questions