Behind every anti-bribery management system sits a risk assessment. Your organisation looked at what it does, and rated some activities higher than others. Those ratings are not paperwork. They are supposed to decide where controls sit, how tight those controls are, and where audit effort goes. ISO 37001 internal auditor training in Iraq, delivered by IAS with EAS, teaches you to read your own ratings and build an audit around them. You finish able to plan, run and report an ABMS internal audit under clause 9.2 — starting with the areas your own risk assessment puts at the top.
Two days, 16 hours of instruction. Learn to aim an internal audit at the areas your organisation has rated highest. Speak to the IAS team about classroom, virtual or self-paced delivery.
- Two days, 16 hours
- IAS with EAS, under UQAS accreditation
- Classroom, virtual or self-paced
- No prior auditing experience required
What does ISO 37001 internal auditor training cover?
Anti-bribery management systems are what ISO 37001, an international standard, sets requirements for. Its coverage runs four ways — the organisation bribing, its own personnel bribing, business associates bribing on its behalf, and other parties bribing the organisation. An ABMS is the set of policies, controls and checks built to handle all four.
This course teaches you to audit that system inside your own employer. Over two days you learn how to prepare, how to gather evidence, how to judge whether a control is actually working, and how to write findings your management can act on. The two-day internal auditor course sits in the wider IAS training range alongside other management system subjects.
An internal audit spread evenly across a business wastes most of its hours. This ISO 37001 internal auditor course spends its time on the discipline of following your organisation's own ratings.
Why do your own risk ratings decide where the audit goes?
ISO 37001 asks the organisation to assess its bribery risk. That assessment produces ratings — however your organisation words them. Some processes come out low, some medium, some high.
Those ratings then carry a promise. If a process is rated high, the organisation has said, in writing, that it needs stronger controls there. An internal audit is how the organisation checks whether that promise was kept.
So the rating is the auditor's starting point, not the auditor's opinion. You do not decide what is risky. You read what your organisation decided, and you test whether the controls match it.
It also protects you. Auditors who invent their own risk views end up arguing with management about judgement calls. Auditors who work from the organisation's own register argue about evidence instead, and those arguments are winnable.
Three questions follow from any rating:
- Do controls exist that are proportionate to what the rating claims?
- Are those controls being operated, not just documented?
- Is the rating itself still supported by what you saw on the ground?
The third question is often the most valuable finding you will produce.
How do you read the risk assessment before planning anything?
Day one begins with source documents. You work through a worked example of a bribery risk assessment and pull out what an auditor needs.
You are looking for the unit of assessment. Is the register built around processes, around business units, around third-party categories, or around transaction types? Everything downstream depends on that. An audit plan built on departments will miss a register built on processes.
You then look at how the ratings were reached. Was there a method? Were likelihood and impact considered separately? Was anything rated high and then quietly reduced? Changes are worth reading closely — not because they are wrong, but because the reasoning should exist somewhere.
Next you check currency. When was the assessment last reviewed? Has the organisation started a new activity or taken on a new class of business associate since? Clause 8.4 in the 2025 edition brings mergers and acquisitions in as a non-financial control area.
Finally, you map controls to ratings. For each high-rated line, list the controls the organisation says are in place. That list becomes your ISO 37001 audit checklist. It beats a generic one, because it tests your system rather than a hypothetical one.
How much audit depth does each risk rating deserve?
Depth is a decision, and it should be a documented one. Most internal programmes fail here quietly. They visit everything, look at three records everywhere, and produce a report that reassures nobody.
The course gives you a depth model. You adapt it to your organisation's rating language, then defend your choices in the exercise that follows.
| Rating your organisation assigned | Audit depth you plan | Evidence you should expect to see |
|---|---|---|
| High | Full process walkthrough, interviews at two levels, larger sample, tracing transactions end to end | Signed due diligence files, approval records with named approvers, dated gift and hospitality entries, payment records matched to contracts, evidence of training completion for the people involved |
| Medium | Process review with a focused sample, one round of interviews, control design plus a test of operation | Approval records, register extracts, a sample of third-party checks, communication showing the control was explained to those who use it |
| Low | Design check and confirmation the control still exists and has an owner | Current procedure, named owner, evidence the control ran at least once in the period |
| Rated high but recently audited | Follow-up on previous findings, plus a fresh sample of the weakest control | Corrective action records, evidence of effectiveness, a new sample large enough to test the fix |
| Rated high with no controls listed | Immediate audit, treated as a planning priority | Either the missing controls, or a management explanation recorded against the register line |
A high rating with nothing beside it is not a gap in the audit. It is a finding waiting to be written.
How do you build the internal audit programme under clause 9.2?
Clause 9.2 requires the organisation to carry out internal audits at planned intervals. It asks that the programme consider the importance of the processes concerned and the results of previous audits. It requires defined criteria and scope for each audit, auditors selected so that objectivity and impartiality are protected, reporting to relevant management, and retained documented information as evidence.
Read that again with risk ratings in mind. "Importance of the processes concerned" is the clause hook for everything this page describes. A programme that ignores its own ratings is hard to defend against that wording.
You build an internal audit programme on the afternoon of day one. The exercise starts from a register, not from a calendar. You decide which lines need annual coverage, which need more, and which can sit on a longer cycle.
You also set the trigger conditions. A new business associate in a high-rated category, a significant change in the register, a concern raised through the reporting channel, or an acquisition — each may justify an unplanned audit. Writing triggers in advance saves an argument later.
The programme you draft is deliberately short. One page of scope, criteria, frequency and auditor assignment beats twelve pages nobody reads.
How do you keep the highest-rated areas out of the skip pile?
Programmes drift. The areas that get skipped are rarely the unimportant ones. They are the busy ones, the ones with a difficult manager, or the ones where last year's audit was uncomfortable. This table is the control you take back to work.
| How coverage gets lost | What it looks like in practice | The countermeasure you build in |
|---|---|---|
| Deferral | A high-rated area is postponed "to next quarter", repeatedly | Carry-forward log with a limit: no high-rated area moves twice without management sign-off |
| Convenience sampling | The auditor takes whatever records are easiest to obtain | Sample selected before the visit, from a population list requested in advance |
| Auditor unavailability | The only auditor who knows that area is tied up | At least two trained auditors per high-rated area; the course is a reasonable way to get the second |
| Comfortable substitution | A low-rated area is audited instead, to fill the slot | Programme records rating against every scheduled audit, so substitutions are visible |
| Scope shrinkage | The audit happens, but only the easy control is tested | Scope fixed in the audit plan and signed before fieldwork begins |
| Silent closure | Findings in a high-rated area are closed without evidence | Closure requires evidence of effectiveness, verified by someone other than the action owner |
| Register drift | A new high-rated activity never reaches the programme | Programme reviewed whenever the risk assessment is updated, not only annually |
Run this table across your last two audit cycles.
Which controls do you test where the rating is highest?
The standard sets out the control areas. Your ratings decide which of them get your hours.
Due diligence. Under clause 8.2, the depth of due diligence has to track the level of risk. You test whether checks ran before commitment, who reviewed them, and what happened when something adverse appeared. A completed form with no evidence of review is a weak control, however neat it looks.
Business associates. Clause 8.5 covers controls over those acting for the organisation. You test contract terms, communication of the policy, and what happens when an associate refuses to commit. Look hardest at the refusal cases.
Gifts, hospitality and donations. Clause 8.7 covers these. You test thresholds, approvals, the register, and whether refusals are recorded. An empty register in a high-rated area is a finding, not a clean result.
Financial and non-financial controls. Clauses 8.3 and 8.4. Segregation of duties, dual approval, payment routing, procurement selection, and — in the 2025 edition — mergers and acquisitions. You test whether the control actually blocks anything.
Raising concerns and investigation. Clauses 8.9 and 8.10. You test awareness of the channel, protection of the person raising, and whether reports go anywhere. You do not investigate cases yourself.
Culture, competence and awareness. At 5.1.3 the standard puts anti-bribery culture in writing as a requirement. Awareness of conflicts of interest has to run through employment processes, which is clause 7.2.2. You test whether people in high-rated roles were trained on the controls they operate. ISO 37001 internal auditor training also covers the anti-bribery function's role and independence, which the 2025 edition states more clearly.
How much evidence and sampling is enough where the stakes are highest?
Evidence is what separates an audit from an opinion. On day two you spend most of the morning on it.
Documents are the easiest evidence to collect and the easiest to overrate. A signed procedure proves a procedure exists. It proves nothing about operation. Records of the control running — dated, attributable, in sequence — are what you want.
Interviews add what records cannot show. Ask people to describe what they do, not to confirm what the procedure says. "Walk me through the last approval you handled" beats "do you follow the approval process". Note the answer, then find the record behind it.
Sampling deserves its own discipline in higher-rated areas. Take a larger sample. Select it yourself, from a population list requested before the visit. Include the awkward cases deliberately — the largest values, the rushed approvals, the transactions just under a threshold, the associates onboarded fastest.
Write evidence down as you collect it. A finding you cannot trace to a record and a date will be argued away in the closing meeting.
How do you stay objective when the auditee sits two desks away?
This is the hard part of internal auditing. You already know these people. You will still know them next week.
Clause 9.2 asks that auditors be selected to ensure objectivity and impartiality. The practical rule is simple: you do not audit work you own, manage or perform. Everything else is manageable with care. The course works the awkward cases as a group exercise.
| Situation | Can you audit it? | What you do |
|---|---|---|
| Your own department's process | No | Ask for another trained auditor; record why you were excluded |
| A process you designed two years ago | No, not on your own | Pair with a second auditor who leads on that element |
| A close colleague's process, no reporting line | Yes, with care | Declare the relationship in the audit plan; keep evidence tighter than usual |
| A process your manager owns | Not advisable | Escalate to whoever owns the programme; a peer auditor from another unit is cleaner |
| An area where you raised a concern previously | No | Declare it; the objectivity risk runs both ways |
| A small organisation with few auditors | Sometimes unavoidable | Document the constraint, use cross-review of findings, consider an external reviewer |
Two habits help most. First, write findings against the control, never against the person. Second, agree the facts in the room before you leave it. Disagreement about a conclusion is normal. Disagreement about what the record said is avoidable.
What did ISO 37001:2025 change for your programme?
Since its publication in February 2025, ISO 37001:2025 has been the current edition, replacing ISO 37001:2016. A 2016 certificate now runs only as far as the transition deadline of 28 February 2027.
Here is what an internal auditor has to absorb. The harmonized structure common to management system standards is what the text is now built on. "Stakeholders" became "interested parties". Clauses 4.1 and 4.2 require climate change to be considered in context and in interested party requirements. The standard names anti-bribery culture outright at 5.1.3. Employment processes must now cover awareness of conflicts of interest, under 7.2.2. How independent the anti-bribery function is, and what it does, are both spelled out with more clarity. Buying or merging with another business becomes a non-financial control area at 8.4. Clause 10 is reordered, with 10.1 continual improvement and 10.2 nonconformity and corrective action.
The course covers them against the clauses, so you leave with a current checklist rather than an old one. The route to certification itself is a separate matter, described on the ISO 37001 certification page for Iraq and in the general certification process overview.
How are the two days spent?
The two days hold sixteen hours of instruction between them. The balance sits heavily on practice.
| Session | Focus | What you produce |
|---|---|---|
| Day 1, morning | ISO 37001:2025 structure, the four directions of bribery, the clauses an internal auditor uses most | Annotated clause map |
| Day 1, late morning | Reading a bribery risk assessment as an auditor | Control-to-rating mapping for a worked example |
| Day 1, afternoon | Clause 9.2 and programme design driven by ratings | A draft internal audit programme |
| Day 1, close | Audit planning, scope and criteria for one high-rated area | An audit plan for that area |
| Day 2, morning | Evidence, sampling, interviewing, document review | Working papers from a simulated audit |
| Day 2, midday | Writing findings; nonconformity, observation and opportunity | Three written findings |
| Day 2, afternoon | Reporting to management, corrective action and follow-up under clause 10.2 | A short audit report |
| Day 2, close | Objectivity scenarios and written examination | Completed assessment |
Your work is judged throughout, with a written examination at the end.
Who should attend, and how does this differ from lead auditor training?
The course suits anyone who will audit the ABMS from inside: compliance staff, internal audit team members, quality and management system coordinators, finance and procurement staff, legal and HR people who own parts of the system, and managers who need to understand what an audit will ask of them.
No prior auditing experience is required. Familiarity with ISO 37001 is recommended, and knowing your own risk assessment beforehand helps.
One distinction, then we move on. This is a two-day course for auditing your own organisation. A lead auditor course is a longer, separate product for auditing other organisations — see the lead auditor training range if that is what you need. Colleagues often combine internal auditor competence across several standards; IAS offers ISO 9001, ISO 27001, ISO 45001, ISO 14001 and ISO 22301 lead auditor courses, among others in the full training listing.
How is the course delivered and assessed?
ISO 37001 internal auditor training runs by three routes. Classroom or in-house training takes place at your premises or at an IAS training centre. Virtual instructor-led training runs over web conferencing, with the same tutor and exercises. A self-paced route gives 30 days of access to the material through the EAS online learning platform.
In-house delivery has one clear advantage here. Exercises can run against your own risk assessment rather than a worked example, so the programme you draft is one you can use.
Continuous assessment across the two days is followed by a written examination. IAS and EAS then issue the certificate of completion jointly. Behind the delivery — by IAS with EAS — sits the UQAS accreditation held by IAS, which reaches training schemes as well as certification.
Training and auditing are handled by separate teams. Impartiality is what forces that arrangement, rather than any in-house preference.
What this page does not claim
Nothing about completing this course makes you an IAS auditor. It does not appoint you to any auditor register. It does not certify your employer to ISO 37001. Certification is a separate process, carried out by a certification body under its own rules, and internal audits are not a substitute for it. Certification also never proves that no bribery has occurred or will occur; it addresses the management system, not every act of every person.
This page makes no statement about the law in Iraq or anywhere else. It describes no legal requirement, regulator, approval regime or obligation. Nothing here is legal advice. If you need to know how any legal duty applies to your organisation, take qualified legal advice. Everything on this page concerns a voluntary international standard and a training course about auditing against it.
Where "high risk" appears above, it means a rating your own organisation assigned in its own risk assessment — not a description of any country, region, market or industry.
Ready to aim your internal audits properly? Bring your own risk assessment to an in-house session, or join a scheduled classroom, virtual or self-paced course. Contact IAS to discuss delivery, or browse the IAS home page and the ISO 9001 certification page for Iraq for related services.
Frequently asked questions
What is ISO 37001 internal auditor training?
It is training that prepares you to plan and carry out internal audits of an anti-bribery management system inside your own organisation, gather evidence, write findings and report to your own management.
How many hours of instruction are there in total?
Sixteen, delivered across two days.
What does clause 9.2 require?
Internal audits at planned intervals, a programme that considers process importance and previous results, defined criteria and scope, auditors chosen to protect objectivity, reporting to relevant management, and retained records as evidence.
How do I know where to focus the audit?
Start from your organisation's own risk assessment. The areas it rated highest get the deepest coverage, the largest samples and the most frequent revisits.
What if an area is rated high but no controls are recorded against it?
Audit it early and write it up. A high rating with no listed control is a finding in its own right.
Can I audit my own department?
No. You should not audit work you own, manage or perform. Use another trained auditor, and record why you were excluded.
What if we only have one trained auditor?
Document the constraint, pair auditors where possible, and use cross-review of findings. Training a second person is usually the simplest fix.
How often must internal audits be done?
A fixed frequency is not what the standard sets; planned intervals are. Most organisations audit higher-rated areas at least annually and lower-rated areas on a longer cycle.
Do I need experience to attend?
No prior auditing experience is required. Familiarity with the standard is recommended.
Internal auditor or lead auditor — which do I need?
This two-day course is for auditing your own organisation. The longer lead auditor course is for auditing other organisations.
Does my internal audit work get looked at by anyone else?
Yes. A certification body's auditor will examine your internal audit records as evidence that clause 9.2 is being met. Well-kept working papers are worth the effort.
Can I take the course online?
Yes. There is a virtual instructor-led option and a self-paced option with 30 days of access to the material.
What certificate do I get?
The certificate of completion carries both IAS and EAS. It follows the continuous assessment run across the two days and the written examination.
Does completing the course certify my organisation?
No. It does not certify your employer and it does not make you an IAS auditor. Certification is handled separately, as set out in the system certification and ISO certification pages.
Who should attend?
Compliance, internal audit, quality, finance, procurement, legal and HR staff, plus managers who want to understand what an ABMS audit will ask of them.
Where can I read more about how audits are conducted?
The ISO audit procedure page explains the general approach, and the FAQ section answers wider questions about IAS services. Rules on the use of marks are set out in the logo usage guideline.
