ISO 37001 audit checklist: what auditors commonly look for

ISO 37001 audits are unlike quality audits: the auditor is testing whether your controls would actually stop a bribe, not whether your paperwork is tidy. Here is what they consistently drill into.

The evidence auditors request first

• Bribery risk assessment: current, function-specific, and reviewed after organisational changes
• Due diligence records for agents, intermediaries and high-risk suppliers
• Gifts, entertainment and hospitality register with approvals against thresholds
• Training records showing role-appropriate content, not one generic slide deck
• Investigation records: how the last whistleblowing report was handled, end to end

Where organisations fail

The most common major nonconformity is a risk assessment that does not match reality: procurement rated low risk while tender interactions with government agencies run weekly. The second is an anti-bribery function without genuine independence or authority.

If your compliance officer reports to the person who owns the highest-risk relationships, expect a finding.

Before the certification audit, run one honest tabletop exercise: pick a plausible bribery scenario in your business and trace whether your controls would have caught it. That single exercise surfaces more gaps than a month of document review.