What an ISO 37001 Audit Examines, Clause by Clause

An ISO 37001 audit looks at how an organisation prevents, detects and responds to bribery. The current edition is ISO 37001:2025, published in February 2025, which replaced the 2016 edition and its 2024 amendment. This guide sets out what auditors examine in each clause. It suits Indian organisations building an Anti-Bribery Management System.

Where does an ISO 37001 audit spend most of its time?

Most ISO 37001 audit effort falls in clause 8, where controls operate. Clauses 4 to 7 and 9 to 10 follow the common management system structure. Practitioners commonly see findings cluster around three areas: the bribery risk assessment, independence of the anti-bribery function, and third-party due diligence that doesn’t match risk.

These findings are usually structural, not documentary. A policy can be written quickly, but a tested assessment and an empowered function take longer. That is why the standard is harder to implement superficially than most management system standards. Sampling depends on the activities, locations and associates in scope.

What do clauses 4 to 7 ask an organisation to show?

They ask for evidence that the system rests on real risk understanding and is led from the top: a risk assessment in clause 4.5, defined leadership roles in clause 5, objectives in clause 6 and proportionate people controls in clause 7.

Auditors expect the clause 4.5 risk assessment to work by category: location, sector, transaction type, type of business associate and contact with public officials. A single organisational rating rarely satisfies them. They usually ask what the assessment concluded about the highest-risk activity, then check that controls match.

Clause 5 gives the governing body and top management separate duties, and clause 5.1.3 adds anti-bribery culture. Under clause 5.3.2, the anti-bribery function (called the compliance function in 2016) needs authority, resources and direct access to the governing body. An auditor may ask its head whether they have ever escalated a concern. Reporting only to the executive it might need to report on is a structural finding.

Clauses 6 and 7 are where plans meet people. Objectives and planned changes follow from the assessment, and auditors look at employment terms, discipline and screening for exposed roles. Identical training for a high-risk sales team and head-office administration suggests proportionality was not applied.

How closely do auditors test third-party due diligence?

Closely, and in both directions. Under clause 8.2, auditors choose counterparties from the register and ask to see the diligence, the conclusion and the decision. They look for enhanced scrutiny where risk is high and sensible restraint where it is low.

Clauses 8.5 and 8.6 add written anti-bribery commitments from business associates and, where an associate poses more than low risk, equivalent controls or a way to verify theirs.

A customs-clearance firm in Chennai lists a regional agent in its register. The file holds a signed commitment and a diligence summary from the day of appointment. The approval carries the signature of the manager who proposed the agent, and nothing shows the risk was looked at again.

What else in clause 8 will an auditor sample?

Financial and non-financial controls, gifts and hospitality, raising concerns, and the handling of inadequate controls and investigations, which are clauses 8.3 to 8.10. Auditors sample each area according to the risks identified, so the depth varies between organisations and between audits.

Financial controls cover approval limits, segregation of duties, payment verification and unusual payment patterns, while non-financial controls reach procurement, tendering and contracting. Auditors read the gifts and hospitality register, and an empty one in a client-facing sales operation tends to draw questions. They also test the concerns channel for access, anonymity and protection from retaliation, and ask for evidence that reports were investigated. Clause 8.8 asks what changed when a control proved inadequate.

What do clauses 9 and 10 add?

They test whether the system is checked and then improved. In clauses 9 and 10, auditors look at monitoring, internal audit, management review and corrective action, and ask for evidence that the governing body, as well as top management, considered the anti-bribery system.

Clause 9.4 adds a review by the anti-bribery function itself. Practitioners often find the governing body’s part overlooked, so minuted board discussion carries weight.

How do ISO 37001 consultants play a main role?

They test the system against the standard before an auditor does. They challenge the risk assessment, check the function’s independence, review due diligence files and run a mock audit, so gaps close while there is time. Experienced ISO certification consultants also bring a view of how auditors read evidence.

Their work is strongest where judgement is needed, such as setting risk ratings and deciding what proportionate means for each associate.

How can MSCi help an organisation prepare?

We assess the risk assessment, the anti-bribery function’s reporting line and the due diligence files against each clause, then support corrective action and a mock audit. MSCi brings 40+ years of experience in ISO consultation, and prepares companies for audit. MSCi is not a certification body and does not issue certificates.

Organisations preparing for ISO 37001 certification can contact us to arrange a gap review.

Frequently Asked Questions

1. Does an ISO 37001 audit test every contract and payment?

No, auditors sample according to the activities, locations and business associates in scope and the risks the assessment identified. The sample varies between organisations and between audits.

2. Who do auditors usually want to speak to?

Auditors typically ask to meet top management, the governing body or its representative, the head of the anti-bribery function and staff in exposed roles such as sales, procurement and finance. Interviews help them test whether practice matches the documents.

3. What records should an anti-bribery management system hold before an audit?

Expect to show the risk assessment, due diligence files, the gifts and hospitality register, concern reports and investigation records, training records and minutes of governing body review. The records should show decisions, not only completed forms.

4. Does ISO 37001 certification show that bribery cannot happen?

No, the standard sets out a system to help an organisation prevent, detect and respond to bribery, and an audit tests whether that system meets the requirements. It doesn’t guarantee that no incident will occur.

5. Do ISO 37001 consultants like MSCi issue the certificate?

No, MSCi is a consultancy with 40+ years of experience in ISO consultation, and it prepares companies for audit. Certification is awarded by an independent certification body.