Five days. One skill that separates a good ABMS audit from a paper one. This ISO 37001 lead auditor training course is built around clause 8.2 and the third parties it covers. Delivered by IAS with EAS. Browse the wider lead auditor training range or read on.
Most anti-bribery management systems fail in the same place. Not in the policy, and not in the training register. They fail in the folder marked "business associates". ISO 37001 lead auditor training exists to teach you how to open that folder and read it properly. This course runs five days, forty hours of instruction, and it puts due diligence at the centre of the week, so you spend real classroom time deciding which agents to sample, how deep to go on each one, and how to defend that decision in a report. That is the work, and everything else in the week supports it.
- Five days, 40 hours
- Classroom, virtual or self-paced
- No prior audit experience needed
- Certificate from IAS with EAS
Why does clause 8.2 decide the outcome of most ABMS audits?
An organisation rarely bribes anyone directly. It pays a commission, or appoints a local representative. It hires a consultant to "assist with a tender". ISO 37001 recognises this plainly. The standard addresses bribery in four directions: by the organisation itself, by its own personnel, by business associates acting on its behalf, and bribery aimed at the organisation. The third of those is where the money usually moves.
Clause 8.2 requires due diligence on business associates where the bribery risk is more than low. That single qualifier — more than low — is what makes the clause hard to audit. It is not a rule you can tick but a judgement the organisation made; your job is to test whether it was reasonable and whether it was applied.
Delegates arrive expecting a checklist. They leave with a method for sampling under uncertainty. That shift takes about three days and is uncomfortable for most of them, which is deliberate.
What does ISO 37001 lead auditor training prepare you to do?
A lead auditor course is not a longer version of an awareness course. It prepares you to audit organisations other than your own, to a professional standard. You plan the audit, lead a team, and gather evidence to evaluate. You write findings that survive challenge, and you report them.
That is a different job from internal auditing, and the difference matters. An internal auditor course is shorter and points inward, at your own management system. Both are useful. They are not interchangeable, and choosing wrongly wastes a week.
On this course you audit a fictional organisation's anti-bribery management system, and its problems are real ones. There is a sales agent in a country it barely understands, a distributor owned through a holding company elsewhere, and a consultant paid a success fee. The scenario gives you two days of audit time against forty-one business associates. You cannot look at all of them. Deciding what to look at is the real exam, long before the written one arrives.
Is this anti-bribery lead auditor week a fit for your work?
| This course fits you if | Look elsewhere if |
|---|---|
| You audit or will audit suppliers, agents and third parties | You only need awareness of the standard for your own role |
| You work in compliance, procurement, legal or internal audit | You want a short refresher on clause numbering |
| You are a consultant advising clients on ABMS design | You need a certification audit for your employer, not training |
| You lead or expect to lead audit teams | You will only ever audit your own department |
| You already audit to ISO 9001 or ISO 27001 and want a third scheme | You expect a qualification that comes with a role attached |
| You handle third-party onboarding and want to test it properly | You need a food safety or laboratory scheme instead |
You can book a place here having never audited anything in your life. That surprises people. It is true because the week teaches audit method from the ground up, starting with first principles. Our one suggestion is different: know your way around the standard before you start. Read ISO 37001:2025 before you arrive, even loosely. Delegates who have read clause 8 once follow the sampling exercises far more easily than those meeting the text for the first time on Tuesday.
Hold a lead auditor qualification in another scheme and the audit mechanics will feel familiar. The anti-bribery content will not. Bribery evidence behaves differently from quality evidence, and is often absent by design.
How deep should you tier business associates?
Risk-proportionate due diligence means depth of enquiry matches risk. Without a mental model of what "proportionate" looks like, every finding becomes an opinion. We hand delegates a working model on day two and then attack it.
Here is the tiering structure we use in the room. It is a teaching tool, not a requirement — organisations design their own, and your job is to understand theirs and test whether it holds.
| Risk tier | Expected depth of due diligence | Evidence you should expect to see |
|---|---|---|
| Low — domestic supplier of commodity goods, no public-sector contact, no discretion | Screening only, refreshed on a set cycle | Sanctions and adverse media check, dated; signed anti-bribery clause in contract |
| Moderate — supplier with occasional interface with officials, or acting under limited delegated authority | Screening plus a structured questionnaire and a review of the answers | Completed questionnaire, reviewer's notes, ownership confirmation, contract with audit rights |
| Elevated — agent, distributor or intermediary earning commission on won business | Documented enquiry into ownership, track record and remuneration basis | Beneficial ownership records, commercial justification for the appointment, commission rationale, references checked and recorded |
| High — third party interacting with officials on the organisation's behalf, or paid a success fee | Enhanced enquiry, approved at a level above the sponsoring manager, with defined review triggers | Enhanced report, decision record naming the approver, conditions imposed, evidence those conditions were monitored |
| Unacceptable without mitigation — refusal to disclose ownership, or a relationship the organisation cannot justify | Escalation and a documented decision to proceed, decline or restrict | Escalation record, rationale, and evidence of the controls applied if the relationship continued |
Two things about that table matter more than its contents. First, the depth column and the evidence column must agree; an organisation claiming enhanced due diligence while producing a screening printout has a gap you can state cleanly. Second, the tier must have been assigned before the relationship started, not reconstructed afterwards. Dates carry the finding, so delegates learn to check them first.
How do you choose your sample and defend the choice?
This is the section delegates remember. Audit time is short and the register is long. A random sample looks defensible and usually is not: randomness assumes a uniform population, and a business associate register never is.
We teach a stratified approach and make delegates write the reason for every selection. That written justification is the point — an unexplained sample is an unauditable one.
| Selection basis | What you are testing | How you justify it in the report |
|---|---|---|
| Highest-risk tier, all or most of it | Whether enhanced due diligence actually happened where the organisation said it must | The organisation's own risk criteria identified these; failure here is systemic, not incidental |
| Newest appointments in the last cycle | Whether the current process works, not the historical one | Recent records reflect the system as it operates today |
| Relationships approaching or past a review date | Whether refresh triggers fire, or quietly lapse | The organisation defined the trigger; testing it tests its own control |
| Highest-value or highest-commission arrangements | Whether financial exposure attracts proportionate scrutiny | Value concentrates risk; a sample ignoring it under-tests the system |
| Associates onboarded through an exception or fast track | Whether the override path has controls of its own | Exceptions bypass the normal route and are therefore the weakest link |
| Anything acquired through a merger or acquisition | Whether inherited relationships were re-assessed | ISO 37001:2025 treats M&A as a control area under clause 8.4 |
| One or two low-tier records, deliberately | Whether tiering itself is honest, or used to avoid work | Confirms the classification, not just the file behind it |
That last row is the one experienced auditors nod at. If everything on a register sits in the low tier, the tiering rule is the finding, not the files. Delegates draft that finding on day three and most write it as an accusation; we rework it until it reads as evidence.
You also learn when to stop. A sample expands when you hit a defect and contracts when you do not, and we drill that mid-audit decision — plus the note recording it — under time pressure.
What do the five days cover?
The week runs in a deliberate order. Method first, standard second, practice third, and the ISO 37001 exam at the end.
Day one establishes what an anti-bribery management system is and how audits of one differ from quality audits. You cover the four directions of bribery risk, the role and independence of the anti-bribery function, and the vocabulary you will use all week. Terminology matters here: imprecise language produces weak findings.
Day two works through ISO 37001:2025 clause by clause, with disproportionate time on clauses 4, 6 and 8. You build the risk tiering model and test it against sample scenarios.
Day three is audit planning. You cover scope, criteria, sampling strategy, team roles, and the audit plan itself. You then produce a plan for the case study organisation and defend your sampling choices to a room that will challenge them.
Day four is fieldwork. It covers interviews, document review, tracing a payment and following an approval chain. You practise interviewing a nervous sponsor and an evasive one, then write findings under time pressure.
Day five is reporting, the closing meeting, follow-up and corrective action, and then the written examination.
Assessment is continuous, not only at the end. Your contribution to exercises counts, as does the quality of the findings you write on days three and four. The final-day written examination covers the standard, audit method and the judgement calls you have practised.
What did ISO 37001:2025 change for third-party work?
February 2025 brought the current text, ISO 37001:2025, and with it the retirement of the 2016 edition. Certificates issued to the 2016 version must transition by 28 February 2027. If you audit organisations still holding a 2016 certificate, you need to know both editions and where they diverge.
The changes that touch business associate auditing most directly:
- Clause 8.4 has taken in mergers and acquisitions as one of the non-financial control areas. Inherited third parties become an explicit audit target.
- Anti-bribery culture is no longer left to inference; clause 5.1.3 states it as a requirement outright. Culture shows up in how staff talk about their agents, rather than in the wording of a policy.
- Awareness of conflicts of interest has been written into employment processes by clause 7.2.2. Conflicts of interest and third-party appointments are very often the same story told twice.
- The anti-bribery function's role and independence are now stated more clearly. When due diligence decisions are overridden, you look for that function's fingerprints.
- Clauses 4.1 and 4.2 require climate change to be considered among external and internal issues, and among the needs of interested parties.
- "Stakeholders" has become "interested parties" throughout, and the standard now follows the harmonized structure shared across ISO management system standards.
- Clause 10 runs in the reverse order to the one you may remember. Continual improvement takes the 10.1 slot, and nonconformity and corrective action drop down to 10.2.
That harmonized structure is a quiet advantage. If you have trained on ISO 9001 lead auditing or information security lead auditing, the clause skeleton will already be familiar. The subject matter is what you are learning here, not the architecture around it.
Lead auditor or internal auditor: which should you choose?
| Question | Lead auditor course | Internal auditor course |
|---|---|---|
| Who do you audit? | Companies outside your own — suppliers and clients among them | The employer whose payroll you are on |
| Do you run the team? | Yes — planning, allocation, closing meeting | Usually not |
| How long is it? | Five days, 40 hours | Shorter |
| Depth on sampling and evidence | Extensive, with defended sampling exercises | Introductory |
| Typical attendee | Consultant, second-party auditor, compliance lead, prospective audit team leader | Staff member auditing their own management system |
If your task this year is to audit your own ABMS and report internally, ISO 37001 internal auditor training is the right length and the right depth. If you will audit suppliers, or work as a consultant, or lead a team, take the lead auditor route. Some delegates do both, in that order.
How is the course delivered?
There are three routes, carrying the same content and the same assessment.
Classroom. At an IAS training centre, or in-house at your own premises if you have a group. In-house sessions can use your own business associate categories in the exercises, within reason, which makes the sampling land harder.
Virtual instructor-led. The full five days over web conferencing, live with the tutor. Breakout rooms handle the group exercises. This is the common choice for teams spread across Riyadh, Jeddah and the Eastern Province who cannot lose a week of travel.
Self-paced. If fixed hours are impossible, this route gives you 30 days of access to the course material. It suits disciplined evening learners and asks more of you: nobody challenges your sampling logic at 11pm, so you have to do it yourself.
Weighing ISO 37001 training online against a classroom week? Be honest about how you learn. The sampling exercises thrive on argument, and only some people supply their own.
Other schemes are available through the same delivery routes, including environmental, occupational health and safety and business continuity lead auditor courses. The full training catalogue lists the rest.
What is the certificate, exactly?
Finish the week successfully and a certificate of completion comes to you, issued jointly by IAS and EAS. Those two bodies run the course between them, under an accreditation held by IAS — UQAS — whose scope reaches training schemes as well as certification work.
One structural point worth stating. Whoever teaches you belongs to a different team from the people who conduct audits. Impartiality rules require that split; it is not a housekeeping arrangement chosen for convenience. It means your tutor has no stake in any certification decision affecting you or your employer, and cannot have one.
What does this course not do?
Finishing the week will not turn you into an auditor working for IAS. There is no appointment attached to it, no place on a panel, and no route into an audit team implied by attendance. It is training in an audit method, assessed through the week and certificated at the end.
The course does not certify your employer either. Say it plainly: your company gains no certificate, no registration and no approved status because you sat the five days. If your organisation wants a certified anti-bribery management system, that is a separate process with a separate team, and it begins at ISO 37001 certification. Sending three people on a training course does not move a certification application forward by one step.
It is also worth saying what certification itself does not prove. A certified ABMS does not demonstrate that no bribery has occurred, and cannot demonstrate that none will. It shows a management system was found to conform against defined criteria at a point in time. Auditors who understand that limit write more honest reports.
A note on local requirements
This page makes no statement about the law in Saudi Arabia or anywhere else. Nothing here says ISO 37001 is required, expected or approved by any authority, or that attending satisfies any obligation. It is a voluntary international standard. Whether your organisation adopts it, and what your legal obligations are, are questions for your own legal advisers. We teach auditing against the standard; we do not advise on legislation.
How do you get the most out of the week?
A few small preparations cost little and help a great deal.
- Read clause 8 of ISO 37001:2025 before day one. Twice if you can.
- Bring a real problem. Anonymise it. Tutors will work it into a discussion if it fits.
- Look at how your own organisation classifies third parties. You will compare it to the course model, usually unfavourably, and that is the useful part.
- Practise writing one finding in three sentences. Most delegates write six and say less.
- Sleep on day three. Day four is the long one.
Delegates who already hold ISO 22301 or ISO 50001 lead auditor training tend to find the planning day straightforward and the interviewing day harder. Anti-bribery interviews tend to carry a rather different temperature in the room.
Ready to audit clause 8.2 properly? Take the anti-bribery lead auditor course in Saudi Arabia in a classroom, live online, at your own premises, or at your own pace. Explore all lead auditor programmes, compare the internal auditor route, or view the online course platform to get started.
Frequently asked questions
What is ISO 37001 lead auditor training?
It is a five-day, 40-hour course that teaches you to audit an anti-bribery management system in organisations other than your own. You learn to plan an audit, lead a team, sample evidence, evaluate it and report.
How many days should I block out for the ISO 37001 lead auditor course?
Five of them, adding up to forty hours of instruction. Classroom, in-house and virtual delivery all run to that same length. Choose the self-paced route instead and you get 30 days of access to the material rather than fixed hours.
Must I have audited before to book a place on ISO 37001 lead auditor training?
No — nobody is asked to show prior auditing experience. Knowing your way around ISO 37001:2025 is recommended, and it makes the second and third days considerably easier.
Is there an exam?
Yes. You are assessed all the way through the week, and a written paper closes the final day. Your work in the sampling and findings exercises counts too, not just the paper.
Will I be an auditor for IAS once I have passed?
No. This is training, nothing more. No appointment comes with it, no panel place, and no auditor registration of any kind.
How do I audit due diligence when the files look complete but feel thin?
Test the classification before the file. Ask why the associate sits in the tier it sits in, who decided, and when. Thin files usually follow a tiering decision made to reduce work rather than to reflect risk.
What if the organisation says a relationship is low risk because it has used the agent for years?
Longevity is not a control. It may even be a risk factor, because long relationships accumulate informality. You should look for a documented reassessment, not a reassurance offered in an interview.
I already hold a lead auditor qualification in another scheme. Do I still need five days?
Yes. The audit mechanics will feel familiar, but the anti-bribery evidence base will not. Delegates arriving from ISO 13485, ISO 17025, ISO 22000 or FSSC 22000 courses consistently say the interviewing and sampling days were the ones they needed.