Free PECB ISO 37001 Lead Implementer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB ISO 37001 Lead Implementer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1How can an ISO 37001:2025 anti-bribery management system relate to an organization's existing management framework?

   1. A.It can operate independently or be integrated into that framework.Correct answer: A
   2. B.It must replace all existing management systems in the organization.
   3. C.It can be integrated only after obtaining third-party certification.
   4. D.It must remain separate from all other management arrangements.

   Explanation: ISO explains that the system "can function as a stand-alone or be seamlessly integrated into an organization’s existing management framework." Both arrangements are possible; neither replacement nor certification is a prerequisite for integration.

   Reference: ISO 37001:2025 Anti-bribery management systems: Fostering a culture of integrity — page 3, What is an anti-bribery management system?

2. 2An organization is setting up its ABMS and will then manage it on an ongoing basis. What distinguishes the implementation project from ongoing management?

   1. A.Both the project and routine management end once implementation is delivered.
   2. B.The project has a finite timespan and deliverable; management continues over time.Correct answer: B
   3. C.The project has no defined outcome; management produces a unique deliverable.
   4. D.The project continues indefinitely; management ends at the implementation date.

   Explanation: APM distinguishes project management by its "final deliverable and a finite timespan" and describes management as "an ongoing process". The implementation project ends, while the system's management continues.

   Reference: What is project management? — Definition

3. 3In the OECD/UNODC/World Bank handbook's risk-assessment approach, what does inherent corruption risk represent?

   1. A.The risk level before considering existing controls.Correct answer: A
   2. B.The risk level assuming proposed future controls are effective.
   3. C.The level of risk approved as acceptable by management.
   4. D.The remaining risk after the impact of controls has been considered.

   Explanation: The handbook says "The inherent risk represents the overall risk level of each scheme without consideration of existing controls." Residual risk considers controls, while risk tolerance describes an acceptance threshold.

   Reference: Anti-Corruption Ethics and Compliance Handbook for Business — page 11, B.2, Step 3: Rate the Inherent Risk

4. 4What is the purpose of due diligence in ISO 37001:2025?

   1. A.To further assess bribery risk and inform decisions on specific activities or associates.Correct answer: A
   2. B.To assess only the overall corporate risk without considering specific activities.
   3. C.To record a decision on an associate without assessing its bribery risk.
   4. D.To replace decisions on activities with an assumption that risk is eliminated.

   Explanation: ISO defines due diligence as a process "to further assess the nature and extent of the bribery risk" and help organizations make decisions about specific transactions, activities, associates and personnel. It does not guarantee future behavior.

   Reference: ISO 37001:2025 Anti-bribery management systems — Requirements with guidance for use — clause 3.29, due diligence

5. 5What does ISO 37001:2025 mean by the effectiveness of an ABMS?

   1. A.The extent to which planned activities are realized and planned results achieved.Correct answer: A
   2. B.The amount of resources used, regardless of planned results.
   3. C.The extent of conformity to a requirement, regardless of planned results.
   4. D.The volume of planned activities, regardless of their implementation or results.

   Explanation: ISO defines effectiveness as the "extent to which planned activities are realized and planned results are achieved." Counting policies or audits alone does not establish that planned results were achieved.

   Reference: ISO 37001:2025 Anti-bribery management systems — Requirements with guidance for use — clause 3.9, effectiveness

6. 6How does ISO 37001:2025 define a nonconformity in a management system?

   1. A.The non-fulfilment of a requirement.Correct answer: A
   2. B.Any change in a documented procedure.
   3. C.The fulfilment of an audit objective.
   4. D.A planned improvement opportunity.

   Explanation: ISO defines nonconformity as "non-fulfilment of a requirement (3.4)". A change or improvement opportunity is not necessarily a failure to fulfil a requirement.

   Reference: ISO 37001:2025 Anti-bribery management systems — Requirements with guidance for use — clause 3.21, nonconformity

7. 7What is a principal purpose of stage 1 in a two-stage initial management-system certification audit?

   1. A.Scope and plan stage 2 while assessing the organization's readiness.Correct answer: A
   2. B.Evaluate the implemented system's conformity as the principal stage 2 activity.
   3. C.Perform the recurring surveillance audit after certification has been granted.
   4. D.Perform the recertification audit at the end of a certification cycle.

   Explanation: ISO/IAF auditing guidance describes stage 1 as "primarily for scoping and planning the subsequent part of the certification audit (Stage 2)" and evaluating readiness. It prepares the later audit.

   Reference: ISO 9001 Auditing Practices Group: Two stage initial certification audit — page 1, Two stage initial certification audit

8. 8What does ISO say certification to ISO 37001:2025 can establish about bribery in an organization?

   1. A.It guarantees that bribery risks have been eliminated.
   2. B.It transfers responsibility for prevention to the certification body.
   3. C.It removes the organization's need to maintain anti-bribery measures.
   4. D.It can support proportionate measures, but does not guarantee eradication.Correct answer: D

   Explanation: ISO says "certification doesn’t guarantee the complete eradication of bribery" and describes how it can help an organization implement proportionate measures. The organization still implements the measures, and certification does not make bribery risk disappear.

   Reference: ISO 37001:2025 Anti-bribery management systems: Fostering a culture of integrity — page 7, What about certification?

9. 9What is the main purpose of the business case for an ABMS implementation project?

   1. A.To justify the project using its schedule alone, regardless of other factors.
   2. B.To justify a chosen approach without comparing its costs or risks.
   3. C.To document operational tasks after a project decision has been made.
   4. D.To justify the project by evaluating options, benefits, costs and risks.Correct answer: D

   Explanation: APM says a business case "provides justification for undertaking a project" and evaluates "the benefit, cost and risk of alternative options". It supports a decision about the project; it is not a certification or a substitute for operational risk assessment.

   Reference: What is a business case? — Definition

10. 10A risk assessment team has rated a bribery scheme before controls and then evaluates the effect of existing controls. What does the remaining risk represent in the handbook's approach?

    1. A.The inherent risk of the scheme before controls.
    2. B.The residual risk after considering mitigating controls.Correct answer: B
    3. C.The approved risk tolerance set by management.
    4. D.The impact rating without considering likelihood.

    Explanation: The handbook defines "Residual risk" as "the extent of risk remaining after considering the risk reduction impact of mitigating controls." It is distinct from inherent risk and the organization's risk tolerance.

    Reference: Anti-Corruption Ethics and Compliance Handbook for Business — page 12, B.2, Step 5: Calculate the residual risk