Five days, 40 hours, one skill. ISO 37001 lead auditor training from IAS with EAS teaches you to plan, lead and report an anti-bribery audit. See the wider lead auditor programme for delegates in Iraq or ask about an in-house group.
Every anti-bribery management system carries a risk assessment. In it, the organisation grades its own activities and counterparties. Some grades come back high. That grading is the organisation's own judgement, recorded in its own bribery risk assessment, and it changes what a competent auditor does next. This page is about that change in method. It is why this ISO 37001 lead auditor training takes the shape it does.
A high rating is not a verdict on anyone. It is an input. It tells you where the management system claims to be working hardest, and therefore where your evidence needs to be strongest.
- Five days, 40 hours
- Classroom, virtual or self-paced
- No prior auditing experience required
- Certificate issued by IAS with EAS
What is ISO 37001 lead auditor training?
An anti-bribery management system — ABMS, in most people's shorthand — is what ISO 37001 sets internationally agreed requirements for. A lead auditor course prepares you to audit other organisations against it, to a professional standard. That means planning the audit, leading a team, gathering and evaluating evidence, raising findings and writing a report that survives challenge.
The week is not a reading of the standard. You will read clauses, but the bulk of the time goes on method. How do you decide what to sample? How do you tell a control from a document about a control? When someone gives you an answer that cannot be checked, what do you do next?
Those questions get sharper when the organisation's own risk assessment rates an area high. That is the thread this course follows from Monday to Friday.
The four directions of bribery, and what each demands as evidence
The standard addresses bribery in four directions: by the organisation itself; by its own personnel; by business associates acting on its behalf; and bribery directed at the organisation. Delegates usually arrive thinking about the first three.
The fourth changes your sampling. Bribery aimed at an organisation shows up in tender evaluation, inspection acceptance and procurement scoring. The relevant controls are segregation, rotation, blind scoring and declaration. Our ISO 37001 lead auditor course exercises make you cover the incoming direction too. It is the one most audit plans miss.
Why does a high risk rating change the audit, not just the paperwork?
Auditors sometimes assume that risk ratings only affect the client. They affect you too. Where the organisation has decided a process, a product line or a counterparty type warrants enhanced control, three things follow for the audit team.
First, the controls you are testing are more elaborate. Enhanced due diligence, second approvals, mandatory declarations, monitored payment routes. Each layer has its own evidence, and each can fail quietly.
Second, the cost of a wrong conclusion is higher. Passing a weak control in a low-rated area is a mistake. Passing one in an area the organisation itself flagged is a bigger one.
Third, the people you interview may be under more pressure than usual. Not suspicion — pressure. Their process is watched. They may have been briefed. Handle that badly and you get careful answers instead of useful ones.
The evidence problem at the centre of the week
Anti-bribery controls produce a particular kind of record. Most of it is a statement that something was considered. A due diligence form says a check was done. A declaration says there was no conflict. A register entry says a gift was disclosed. An approval says a manager agreed.
None of those records contain the underlying facts. They contain conclusions about facts. That is fine in a lightly rated area. Where the rating is high, a conclusion on its own is thin evidence, and the course teaches you to say so politely and precisely.
The habit we build is simple. For any control that matters, ask what independent trace the activity would leave if it really happened. Then go and look for that trace. If it does not exist, you have found something worth writing about, whether or not anything went wrong.
How does the method shift when the rating is high?
Below is the core of the course, condensed. In the classroom we work each row as an exercise, on real-shaped documents rather than examples.
| Normal approach | Adjustment where the organisation rates the risk high | Why the adjustment matters |
|---|---|---|
| Accept a completed due diligence form as evidence the check was performed | Trace the form back to the source records it claims to summarise | A form records a conclusion. It does not record the work behind it |
| Sample the gifts and hospitality register at random | Stratify by counterparty, approver and value, then oversample just below approval thresholds | Amounts sitting just under a limit are where control design is really tested |
| Interview the process owner | Interview the owner and someone who performs the step daily | The person who wrote the procedure may not know how it runs |
| Walk through one payment in the system | Follow it end to end, including what was received and how it was confirmed | A trail can look complete on screen and be unsupported in fact |
| Take attendance records as evidence of awareness | Ask several attendees what they would do in a named situation | Attendance proves presence, not understanding |
| Use management's list of business associates | Reconcile the list against the supplier ledger and the contracts register | A list prepared for the audit may not match the list used for payments |
| Confirm a speak-up channel exists | Test how one actual report moved through it, start to finish | A channel becomes a control only when something travels through it |
| Fix the whole sample before arrival | Hold part of the sample back and select it on site | A sample announced in advance is easy to prepare for |
| Close a finding when a corrective action is documented | Check the action against the cause it was meant to remove | Documented actions often treat the symptom and leave the mechanism |
Delegates find the threshold row hardest. Looking for clustering just under an approval limit feels like an accusation. It is not. It tests whether the limit is doing its job, and the course gives you language to explain that before you start.
How do you corroborate evidence with a second source?
Corroboration is the technical heart of this angle. One source tells you what someone recorded. Two independent sources tell you what probably happened. The skill is knowing, quickly, what the second source would be — and whether it is genuinely independent of the first.
| A single source in front of you | What a second, independent source would be |
|---|---|
| Signed supplier due diligence questionnaire | Ownership information in the contract file, plus the payment history in the ledger |
| Approval email from a manager | The delegation of authority actually in force on that date |
| Entry in the gifts and hospitality register | The expense claim or invoice that paid for the item |
| Agent's commission invoice | The fee schedule in the contract and evidence of the deliverable it cites |
| Training attendance sheet | What people named on the sheet say when asked a scenario question |
| Statement that no bribery concerns were reported | Speak-up logs, disciplinary records and exit interview notes |
| Written facilitation payment position | Petty cash reconciliations and recurring small charges in expenses |
| Board minute recording ABMS oversight | The papers tabled at that meeting and the closure of the actions raised |
| Contract clause requiring anti-bribery compliance | Evidence the clause was communicated, monitored and enforced |
| Chart showing the anti-bribery function's reporting line | Records showing direct, unfiltered access to the governing body |
Two rules go with this table. A second source is only independent if a different person, system or time produced it. And two weak sources do not make one strong one — they make a finding about record quality.
How should you interview in a high-risk area?
Interviewing takes a large share of the week, and more of it than most delegates expect. Where an organisation has rated an area high, interviews carry weight that documents cannot.
We practise a few things repeatedly. Open the conversation by explaining scope and purpose, plainly. Ask about the process before asking about any transaction. Use the person's own words back to them rather than the standard's vocabulary. Ask for the exception, not the rule: "when does this not work?" tends to produce more than "does this work?"
We also practise what to do when an answer cannot be corroborated. You do not argue. You record the statement accurately, note that no supporting evidence was available, and move on. The report handles it later.
Confidentiality gets its own session. Auditors hear things. Knowing what belongs in a report, what belongs in a private word with the audit client, and what belongs nowhere is part of the competence taught.
What did ISO 37001:2025 change?
February 2025 brought ISO 37001:2025, superseding the 2016 edition; that newer text is the one in force. Certificates issued against the older edition run until a transition deadline of 28 February 2027, so both texts turn up in practice and you need to read both.
The changes that matter to your audit trail:
- Its clause layout has moved onto the harmonized structure that modern management system standards share.
- "Stakeholders" is replaced by "interested parties" throughout.
- Under 4.1 and 4.2, climate change has to be weighed as part of the organisation's context.
- Anti-bribery culture is now written into 5.1.3 as something the standard requires outright, where the 2016 text left it to be inferred.
- Employment processes have to cover conflict-of-interest awareness, which is where 7.2.2 comes in.
- What the anti-bribery function is for, and how independent it has to be, is set out with less ambiguity.
- Mergers and acquisitions join the non-financial control areas under 8.4.
- Clause 10 swaps its subclauses around: continual improvement moves to 10.1, nonconformity and corrective action to 10.2.
Culture, in 5.1.3, is the clause delegates worry about auditing. It is not unauditable. You audit it through consistency: what leaders say, what gets rewarded, what happened the last time someone raised something awkward. We spend a session building an evidence set for exactly that.
What actually happens across the five days?
Forty taught hours, laid out over five working days, is the frame. Roughly, the shape is this.
Early in the week you work through the standard clause by clause, with the 2025 changes marked. You also build the vocabulary of an ABMS: risk assessment, due diligence, financial and non-financial controls, the anti-bribery function, the governing body's role.
The middle of the week is audit process — planning, the audit programme, stage logic, checklists that help rather than hinder, and the discipline of writing an audit trail as you go.
Then the emphasis shifts. You plan an audit for an organisation whose own risk assessment rates several areas high. You choose samples. You conduct interviews under time pressure. You are handed documents that almost support a conclusion, and you decide what to do about the gap.
By Thursday you are grading findings. Major, minor, opportunity for improvement — and, more importantly, why. Delegates who over-grade and delegates who under-grade both get corrected here, with the wording of the clause in front of them.
Friday brings the report, the closing meeting, and the written examination.
How is the ISO 37001 lead auditor exam assessed?
You are marked the whole way through, and a written paper closes the week on the final day. The running assessment is not a formality. Your exercise work, your interview practice and your written findings are all assessed, because those are the things an auditor actually does.
The written paper on Friday tests understanding of the standard and of audit method. Delegates who have engaged with the exercises tend to find the paper follows naturally from the week. Those who treated the week as a lecture find it harder.
We give the same advice every time. Write findings in full sentences from Monday onwards. That habit is worth more than revision.
How can you take the course?
Three delivery routes are available, and they cover the same syllabus and the same assessment.
Classroom or in-house. Come to an IAS training centre, or have the tutor come to your premises when there are enough of you to fill a room. In-house works well when a team wants to build a shared audit approach, because the exercises can be pitched at the kind of operation you actually audit.
Virtual instructor-led. Delivered live over web conferencing. You are in the syndicate exercises, on camera, doing the interviews. It is not a video you watch.
Self-paced. The material stays open to you for 30 days, and the pace is yours to set. This route suits people who cannot clear five consecutive days. Material for online study sits on the EAS online course platform. If the calendar is the obstacle, ISO 37001 training online is a sensible choice.
Do I need experience to take ISO 37001 lead auditor training?
No prior auditing experience is required. Familiarity with the standard is recommended, and delegates who have read ISO 37001:2025 once before arriving get more from the first two days.
The course fits compliance officers, quality and risk managers, internal auditors moving into external work, consultants advising on anti-bribery management systems, and procurement or legal staff who own parts of the control set. It also fits people who already hold other lead auditor training and want the anti-bribery discipline added. That is a familiar route after ISO 9001 lead auditor training or ISO 27001 lead auditor training.
If your job is to audit your own employer's system, an internal auditor course is the shorter, better-matched product. Look at internal auditor training options instead, and come back to the lead auditor route when you need to audit organisations other than your own.
Lead auditor or internal auditor: which course do you need?
An ISO 37001 internal auditor training course teaches you to audit the system you work inside. You know the people, the history and the shortcuts. That knowledge helps you, and it also biases you, which is why internal audit has its own independence rules.
A lead auditor course assumes the opposite starting point. You arrive knowing nothing. You have days, not months. You must build a defensible picture from sampling and corroboration alone, then lead a team doing the same and reconcile their findings with yours.
That difference is why corroboration technique gets so much room in this ABMS audit training. An internal auditor can go and ask again next week. A lead auditor cannot.
What does your certificate actually mean, and what are its limits?
A certificate of completion is awarded once the week is behind you, and both IAS and EAS stand behind it. IAS runs the course with EAS, and the accreditation standing behind it is IAS's own UQAS accreditation — a scope that reaches training schemes as well as certification.
Two assumptions come up often enough to be worth heading off directly.
Finishing this course does not turn you into an IAS auditor. Joining an audit body is a separate process with its own competence, experience and impartiality requirements. Nothing about attending the course creates any entitlement to audit on behalf of IAS.
The course does not certify your employer. Your organisation's certification is an entirely separate exercise, carried out by an audit team that has nothing to do with the training. If certification is what your organisation actually needs, the route to look at is ISO 37001 certification.
That separation is deliberate. Trainers sit in one team and auditors in another; impartiality demands the split, and it is a rule imposed on us rather than a convenience we chose.
Remember what certification itself means. A certificate says a management system was found to conform to the standard at the time of audit. It does not prove that no bribery has occurred, and it cannot prove that none will. Any lead auditor who suggests otherwise has misunderstood the work.
On local law
What you have been reading about is a course and a voluntary international standard — nothing beyond that. It makes no statement about the law of any country. Nothing here should be read as guidance on legal obligations or official approvals in Iraq or anywhere else. Adopting ISO 37001 is a choice an organisation makes. Whether it interacts with legal duties that apply to you is a question for qualified legal advice, not for a course page.
How does the anti-bribery week fit alongside the other courses?
Audit method transfers even when the subject does not, so delegates often take more than one lead auditor course. The broader ISO training programme in Iraq covers environmental, safety, food, energy, continuity, laboratory and medical device schemes. Common pairings with anti-bribery work include ISO 45001 lead auditor training, ISO 14001 lead auditor training and ISO 22301 lead auditor training. Supply chain specialists often add ISO 22000 lead auditor training, FSSC 22000 lead auditor training or ISO 13485 lead auditor training. Energy and laboratory specialists look at ISO 50001 lead auditor training and ISO 17025 lead auditor training.
Ready to book, or want to talk it through first? Compare the full range of ISO lead auditor courses available in Iraq, browse the wider ISO training schedule, or ask about anti-bribery lead auditor course delivery for a group at your own site.
Frequently asked questions
What is ISO 37001 lead auditor training?
It is a course that teaches you to audit an anti-bribery management system in organisations other than your own. You learn to plan the audit, lead a team, sample and corroborate evidence, grade findings and report them.
How many days should I set aside, and how many hours is that?
Block out five days; the teaching inside them comes to 40 hours. Pick any of the three routes and the length is the same.
Does the course expect previous audit work from me?
No prior auditing experience is required. Reading ISO 37001:2025 beforehand is recommended and will make the first two days easier.
Is there an exam?
Yes — a written paper sat on day five. Your work during the week is marked as you go, too, so the paper is not the only thing that counts.
Is there a way to do this over the internet instead?
Two ways, in fact. Virtual instructor-led sessions run live over web conferencing, with full participation in exercises. The self-paced route hands you the material for 30 days.
What certificate do I get?
You receive a certificate of completion, issued by IAS and EAS between them. People searching for ISO 37001 auditor certification usually mean exactly that document.
Will I be auditing on IAS's behalf once I finish?
No. The week neither appoints you an IAS auditor nor certifies the company you work for. Separate teams, separate processes.
What does "high risk" mean on this page?
It always means a rating an organisation has assigned to something within its own risk assessment — a process, a counterparty type, a control area. It never refers to a place. The rating is the organisation's own judgement, and the audit responds to it.
Why does corroboration get so much attention?
Because most anti-bribery records state a conclusion rather than a fact. Where an organisation has rated an area high, a single conclusion is not enough. The course teaches you to identify the second, independent source quickly.
How do you audit an area where documentation is deliberately thin?
You widen the evidence base. Interviews, system logs, financial reconciliations, third-party records and observed practice all count. Absence of documentation is itself an auditable fact, and you record it as one.
How do you audit anti-bribery culture under clause 5.1.3?
Through consistency between what is stated, what is rewarded and what actually happened. Leadership communications, decisions on awkward cases, speak-up outcomes and disciplinary records together give you an evidence set.
What if an auditee's answers cannot be verified?
You do not challenge or accuse. You record the statement accurately, note that no corroborating evidence was available, and reflect that in the report. Unverifiable claims about key controls are findings in their own right.
Do the 2025 changes affect how I audit?
Yes. Climate change under 4.1 and 4.2, culture under 5.1.3, conflict-of-interest awareness under 7.2.2 and mergers and acquisitions under 8.4 all need evidence you may not have gathered before.
Which is right for me, lead auditor or internal auditor?
If you audit your own organisation, take the internal auditor course. If you audit others, or want to audit others, take the lead auditor course.
Can the course be run for a team at our own site?
Yes. In-house delivery is available at your premises, and the exercises can be shaped around the kind of operations your team audits.
