ISO 37001 Lead Implementer — course at a glance
- Course
- PECB Certified ISO 37001 Lead Implementer
- Standard
- ISO 37001:2025 — anti-bribery management systems
- Duration
- 5-day equivalent, 35–45 hours self-paced
- Exam
- 3 hours, open book, 80 multiple-choice questions, 100 points, 70% to pass
- Materials
- 450+ pages
- CPD
- 31 credits
- Price
- $857 + GST self-paced; $937 + GST eLearning
How is the ISO 37001 Lead Implementer exam structured?
Three hours, open book, 80 multiple-choice questions worth 100 points, 70% to pass. Questions are stand-alone or scenario-based — a scenario presents a short case followed by five questions about it.
This is not an essay exam. Some ISO families at this level are (ISO 9001, 14001, 45001 and 50001 all use a 12-question written format), which is why course listings sometimes state the wrong one. PECB Candidate Handbook version 1.5 is unambiguous for ISO 37001.
Planning is more than a quarter of the exam on its own — 21 of 80 questions. That is where the bribery risk assessment lives, and it is the single highest-value area to study.
The bribery risk assessment is the artefact everything downstream is justified against. Our free ISO 37001 bribery risk and due diligence register is a worked example — twelve worked risks, with the columns a competent auditor tests hardest.
How do you implement an ABMS with PECB’s IMS2 methodology?
The course is organised around PECB’s IMS2 implementation methodology and runs in the order a real implementation does.
- Context and scope. Which entities, functions, countries and business relationships the ABMS covers. Scope decisions here are the ones most regretted at Stage 2.
- Bribery risk assessment. The heart of the standard — identify where bribery could occur, by whom, to whose benefit, and evaluate it against defined criteria. Everything downstream is justified by reference to this.
- Anti-bribery policy and function. A documented policy, and an anti-bribery function with the competence, resources and direct access to the governing body that the standard requires.
- Due diligence. Applied to transactions, projects, business associates and personnel wherever assessed risk is more than low — proportionate, recorded, and refreshed.
- Financial and non-financial controls. Approvals, segregation of duties, payment controls; and procurement, contracting and operational controls. Both are required; most organisations arrive with only the first.
- Gifts, hospitality, donations and business associates. Thresholds, registers, approvals, and anti-bribery commitments flowed down by contract.
- Raising concerns and investigation. A channel people will actually use, protection from retaliation, and a documented investigation process.
- Performance evaluation and improvement. Monitoring, internal audit, and review by top management and the anti-bribery function.
What changed in ISO 37001:2025, and does it affect this course?
ISO 37001 was revised in 2025, updating the 2016 edition. PECB describes the changes as strengthened governance requirements, expanded due diligence provisions, and improved whistleblower protections — an evolution of the same structure rather than a rewrite.
Organisations already certified to the 2016 edition will need to transition within the period their certification body sets, which is normally around three years from publication. PECB lists a separate ISO 37001:2025 Transition course for people who already hold the credential and need only the delta. Aegentra does not currently sell that transition course — if that is what you need rather than the full Lead Implementer, ask before enrolling.
Why ISO 37001 matters in Australia right now
Australia strengthened its foreign bribery laws through the Crimes Legislation Amendment (Combatting Foreign Bribery) Act 2024, which commenced in September 2024. Two changes matter for anyone running an anti-bribery programme.
- A corporate offence of failing to prevent foreign bribery. A company can now be liable where an associate — an employee, contractor, agent, subsidiary or other party performing services for it — bribes a foreign public official for the company’s benefit. Liability does not require the company to have known.
- A defence of “adequate procedures”. It is a defence for a body corporate to prove it had adequate procedures in place designed to prevent the conduct. The Attorney-General’s Department publishes guidance on what adequate procedures look like.
Be precise about what that means. ISO 37001 certification is not the defence and no standard can be. The defence is adequate procedures, judged on the facts. What an ABMS built to ISO 37001 does is produce the documented, tested, independently audited evidence that such procedures existed and operated — a bribery risk assessment, due diligence records, financial and non-financial controls, a whistleblowing channel, training records, and management review minutes. That is the evidence a company would need to point at. Whether it is sufficient in any given case is a legal question for lawyers, not a training provider.
Alongside the Commonwealth offence, AUSTRAC’s AML/CTF regime, ASIC’s oversight, whistleblower protections under the Corporations Act, and the Commonwealth Procurement Rules all push in the same direction: an organisation is expected to be able to show its controls, not assert them.
Lead Implementer or Lead Auditor — which should you take?
Same length, same price, same exam format, opposite jobs.
Compliance officers and consultants commonly hold both, because the two log different experience toward the PECB ladder. If you only take one, take the one matching the work you are actually paid to do.
What is included for $857 + GST
Aegentra Academy is an official PECB authorised training partner. Courses are bought online and studied at your own pace from anywhere in Australia — Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra or regional — with the exam sat under remote proctoring. For group enrolments, email Academy@aegentra.com.au to request a written quote confirming the current price, payment terms and inclusions before purchase.