Free PECB Certified ISO 37001 Lead Auditor Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified ISO 37001 Lead Auditor practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An organization already operates a management framework and wants to implement an ISO 37001:2025 anti-bribery management system. How may the anti-bribery system relate to that existing framework?

   1. A.It may be integrated into the existing management framework.Correct answer: A
   2. B.It must replace the existing management framework.
   3. C.It must operate separately from all existing management systems.
   4. D.It may be integrated only after the existing framework is certified.

   Explanation: ISO states that the system "can function as a stand-alone or be seamlessly integrated into an organization’s existing management framework." Integration is therefore an available approach; neither replacement, mandatory separation nor prior certification is stated as a condition.

   Reference: ISO 37001:2025 Anti-bribery management systems — page 3, What is an anti-bribery management system?

2. 2An organization is considering a transaction with a business associate whose bribery exposure needs further examination. What is the role of due diligence in that decision?

   1. A.To establish with certainty that no bribery risk exists.
   2. B.To further assess the nature and extent of bribery risk for the decision.Correct answer: B
   3. C.To assess bribery risk only after the decision is irreversible.
   4. D.To assess the associate's commercial value without examining bribery risk.

   Explanation: ISO defines due diligence as a process to "further assess the nature and extent of the bribery risk" and assist decisions involving specific transactions and business associates. It is not a guarantee of zero risk.

   Reference: ISO 37001:2025 Anti-bribery management systems — Requirements with guidance for use — clause 3.29, due diligence

3. 3An organization hires an outside auditor to perform an audit on the organization's own behalf for internal purposes. How is that audit classified?

   1. A.A second-party audit.
   2. B.A first-party audit.Correct answer: B
   3. C.A third-party certification audit.
   4. D.A regulatory enforcement audit.

   Explanation: ISO says internal or first-party audits can be conducted "by, or on behalf of, the organization itself". Hiring an outside auditor does not by itself make the audit third-party certification.

   Reference: ISO 19011:2026 Guidelines for auditing management systems — clause 3.1, audit, note 1

4. 4An audit leader needs to describe which organizational units, locations and period the ABMS audit will cover. Which audit element should contain those boundaries?

   1. A.The audit scope.Correct answer: A
   2. B.The audit criteria.
   3. C.The audit conclusion.
   4. D.The audit evidence.

   Explanation: ISO describes audit scope as the "extent and boundaries of an audit" and notes that it generally includes locations, units, activities and the period covered.

   Reference: ISO 19011:2026 Guidelines for auditing management systems — clause 3.6, audit scope

5. 5During an initial certification audit, what is the primary preparatory role of Stage 1 according to ISO and IAF guidance?

   1. A.Scope and plan Stage 2 while evaluating the organization's readiness.Correct answer: A
   2. B.Use Stage 1 to make the certification decision without a later audit.
   3. C.Complete detailed Stage 2 testing before the preliminary review.
   4. D.Review dates alone while excluding readiness from Stage 1.

   Explanation: The ISO and IAF guidance says the first stage is primarily for "scoping and planning the subsequent part of the certification audit" and assessing readiness. Stage 2 follows that preparation.

   Reference: ISO 9001 Auditing Practices Group: Two stage initial certification audit — page 1, Two stage initial certification audit

6. 6An auditor sees a situation that appears undesirable but cannot identify any applicable requirement that it fails. What should the auditor conclude about documenting it as a nonconformity?

   1. A.Do not raise a nonconformity until an applicable requirement is identified.Correct answer: A
   2. B.Raise a nonconformity from the observation without linking it to a requirement.
   3. C.Treat the auditor's personal preference as the applicable requirement.
   4. D.Cite a requirement without evaluating whether the observation fails it.

   Explanation: ISO and IAF guidance states that "if the auditor cannot identify a requirement, then the auditor cannot raise a nonconformity". The situation must be evaluated against an applicable requirement.

   Reference: ISO 9001 Auditing Practices Group: Nonconformity - Documenting — page 2, Nonconformity - Documenting

7. 7A manager wants to improve an ABMS audit programme over time. Which activity does ISO and IAF guidance identify as useful for evaluating the programme?

   1. A.Evaluate only the initial plan without monitoring audits as performed.
   2. B.Review the number of scheduled audits without monitoring their conduct.
   3. C.Monitor individual audits for evaluation and improvement of the programme.Correct answer: C
   4. D.Assess the programme's objectives without reviewing audit performance.

   Explanation: The guidance lists "Individual audits are monitored for evaluation and improvement of the audit program" among programme management responsibilities.

   Reference: ISO 9001 Auditing Practices Group: Effective Use of ISO 19011 — page 3, Managing an audit program

8. 8An organization says its ISO 37001 certification proves bribery can no longer occur. How should an auditor assess that claim?

   1. A.Certification guarantees that bribery is eliminated.
   2. B.Certification can reduce risk but does not guarantee eradication.Correct answer: B
   3. C.Certification removes the need to respond to incidents.
   4. D.Certification transfers responsibility for bribery to the auditor.

   Explanation: ISO states that "certification doesn’t guarantee the complete eradication of bribery"; it can support measures that reduce risk and manage incidents, rather than establish that bribery cannot occur.

   Reference: ISO 37001:2025 Anti-bribery management systems — page 7, What about certification?

9. 9A company integrates its anti-bribery system with another management system and discovers that their objectives conflict. According to PECB's integration guidance, how should it handle the conflict?

   1. A.Keep both conflicting objectives without further assessment.
   2. B.Give the other system's objectives automatic priority.
   3. C.Resolve it to maintain a coherent approach across the systems.Correct answer: C
   4. D.Remove the anti-bribery objectives from the integrated system.

   Explanation: PECB says "Any conflicting objectives should be resolved" to maintain a coherent and unified approach. The conflict should not simply be retained or resolved by automatically discarding one system's goals.

   Reference: Integrating ISO 37001 with other Management Systems — Policy Alignment and Legal Compliance

10. 10An auditor examines a remote site using video while also visiting another site. What does ISO 19011:2026 say about using these audit methods?

    1. A.A remote method excludes all on-site activity.
    2. B.A remote method can only be used for a virtual location.
    3. C.Remote and on-site methods may be combined.Correct answer: C
    4. D.On-site methods require every site to be visited physically.

    Explanation: ISO states that "Remote auditing methods can be used in combination with on-site methods" to achieve an effective audit. The combination described is therefore permitted.

    Reference: ISO 19011:2026 Guidelines for auditing management systems — clause 3.4, remote auditing method, note 1