The short version
- The pathway is short: official PECB training, one exam, then experience tiers you climb over time.
- You do not need years of anti-bribery experience to start — passing the exam allows an application for Provisional Auditor, subject to the application, Code of Ethics and PECB approval.
- Open-book, multiple-choice — stand-alone and scenario-based questions. Duration: 3 hours. 80 multiple-choice questions worth 100 points in total, across 7 competency domains — fundamental principles and concepts of an ABMS (10 questions, 12.5 points), anti-bribery management system requirements (10 questions, 12.5 points), fundamental audit concepts and principles (15 questions, 18.75 points), preparing an ISO 37001 audit (10 questions, 12.5 points), conducting an ISO 37001 audit (19 questions, 23.75 points — the heaviest domain), closing an ISO 37001 audit (8 questions, 10 points), and managing an ISO 37001 audit programme (8 questions, 10 points). Confirmed against PECB Candidate Handbook version 1.5. Passing requirements: 70%. Check the current PECB examination record and assigned examination before booking.
- The second experience column is the real constraint: years specifically in anti-bribery management, not general audit years.
- ISO 37001 was revised in 2025, and certified organisations have to transition — which is creating audit work now rather than later.
What an ISO 37001 Lead Auditor actually is
ISO 37001 is the international management-system standard for anti-bribery management. A Lead Auditor is the person who judges whether that system actually works: testing whether controls trace back to an actual bribery risk assessment, checking that due diligence depth matches the risk rating it claims, testing whether worker consultation under Clause 5.4 changed anything, writing defensible nonconformities, and managing an audit programme across a certification cycle. If you want the detail on the standard itself and how organisations get certified, that is covered in our ISO 37001 certification guide. This page is about the individual credential and the career behind it.
Two clarifications worth making early, because they are where most of the confusion sits. First, the Lead Implementer builds the system and the Lead Auditor assesses it — separate credentials, separate career tracks, so see the ISO 37001 Lead Implementer course if assessment is where you are headed. Second, a great deal of published guidance still describes the 2019 edition, which required ISO 27001 first and split the controls across Annex A and Annex B. Neither is true of the 2025 edition, so check which version anything you read is describing.
The step-by-step pathway
- 01
Get the management-system grounding
Foundation is optional preparation. PECB expects knowledge of anti-bribery concepts and a thorough understanding of auditing principles. Credential education and experience requirements are assessed separately by PECB; they are not the course-attendance prerequisite. Choose preparation based on your existing knowledge and the specific course requirements.
- 02
Take the official Lead Auditor course
The official PECB ISO 37001 Lead Auditor course teaches the audit lifecycle end to end — audit principles, initiating the audit, Stage 1 and Stage 2, evidence collection and verification, audit test plans, drafting findings and nonconformity reports, closing the audit, and managing an audit programme. It is built on ISO 19011 and ISO/IEC 17021-1, with over 450 pages of material and 31 CPD credits.
- 03
Sit and pass the PECB exam
Open-book, multiple-choice — stand-alone and scenario-based questions. Duration: 3 hours. 80 multiple-choice questions worth 100 points in total, across 7 competency domains — fundamental principles and concepts of an ABMS (10 questions, 12.5 points), anti-bribery management system requirements (10 questions, 12.5 points), fundamental audit concepts and principles (15 questions, 18.75 points), preparing an ISO 37001 audit (10 questions, 12.5 points), conducting an ISO 37001 audit (19 questions, 23.75 points — the heaviest domain), closing an ISO 37001 audit (8 questions, 10 points), and managing an ISO 37001 audit programme (8 questions, 10 points). Confirmed against PECB Candidate Handbook version 1.5. Passing requirements: 70%. Check the current PECB examination record and assigned examination before booking. PECB credential ladder: Provisional Auditor (no experience required) → Auditor (two years of professional experience, one in anti-bribery management, plus 200 hours of audit activity) → Lead Auditor (five years, two in anti-bribery management, plus 300 hours) → Senior Lead Auditor (ten years, seven in anti-bribery management, plus 1,000 hours). All tiers require signing the PECB Code of Ethics. Accreditation is program- and scope-specific; verify the applicable credential before enrolment. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
- 04
Log your experience and audit hours
PECB counts two things separately — years of professional experience with a minimum specifically in anti-bribery management, and hours of hands-on audit activity. Keep a running log with dates, the organisation, your role on the audit team and the hours. Start from your first internal audit: the hours are the slow part, not the exam.
- 05
Sign the Code of Ethics and apply for your tier
Every tier requires signing the PECB Code of Ethics and submitting an application with references. PECB evaluates submitted experience evidence and issues a digital credential that can be checked in its public directory. Accreditation is program- and scope-specific.
- 06
Maintain it, and consider the pairing
PECB credential ladder: Provisional Auditor (no experience required) → Auditor (two years of professional experience, one in anti-bribery management, plus 200 hours of audit activity) → Lead Auditor (five years, two in anti-bribery management, plus 300 hours) → Senior Lead Auditor (ten years, seven in anti-bribery management, plus 1,000 hours). All tiers require signing the PECB Code of Ethics. Accreditation is program- and scope-specific; verify the applicable credential before enrolment. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
Aegentra Academy is an official PECB authorised training partner and delivers the ISO 37001 Lead Auditor course online and self-paced, with instructor-led delivery available on request. Foundation-level grounding is available through the ISO 37001 Foundation course.
Credential tiers & the experience each one needs
“Lead Implementer” is not a single pass/fail credential — it is the third rung of a four-tier ladder. All four tiers sit the same exam. What separates them is the professional experience and the hours of hands-on anti-bribery audit work you can evidence. You pass the exam once, then climb as your career grows.
| Credential tier | Total experience | In anti-bribery management | ABMS project hours |
|---|---|---|---|
| Provisional Auditor | None | — | 0 |
| Auditor | 2 years | 1 yr | 200 |
| Lead Auditorthe target | 5 years | 2 yrs | 300 |
| Senior Lead Auditor | 10 years | 7 yrs | 1,000 |
Audit hours required, by tier
These are PECB scheme requirements, not requirements of the ISO standard itself — confirm the current criteria on the official PECB ISO 37001 page. Every tier also requires signing the PECB Code of Ethics.
What counts as ISO 37001 audit hours
Two things are counted separately. Professional experience is your years of work, with a minimum specifically in anti-bribery management — one year for Auditor, two for Lead Auditor, seven for Senior Lead Auditor. That second column is the constraint people miss: general audit years do not satisfy it. Audit activity hours are hands-on hours doing the audit work itself.
This is the part people underestimate and then, later, cannot evidence. The activities below are PECB’s own published list of qualifying audit activity. If you are already doing any of them — in a compliance, ethics, internal audit or compliance role — you are banking hours right now and should be logging them with dates and outputs.
Planning an audit
Establishing objectives, scope and criteria, reviewing documented information in advance, and building a plan that samples by risk. On an ABMS that means sampling the jurisdictions, counterparties and transaction types where bribery exposure actually sits — not the entities with the tidiest files.
Testing the bribery risk assessment
The activity specific to this standard. Clause 4.5 requires the risk assessment before controls are chosen, so the question is whether controls trace back to assessed risk or were simply adopted. A uniform control set is not itself a finding; evaluate whether it is supported by the assessed risks and applicable criteria.
Sampling due diligence files
Clause 8.2 requires due diligence proportionate to assessed risk. Auditors pull files for high-risk counterparties and check whether the depth matches the rating, whether beneficial ownership was actually established, and whether the file was ever refreshed.
Testing financial and non-financial controls
Evaluate financial and non-financial controls against the applicable requirements and actual risk. Payment approvals and segregation of duties are the easy part; the contracting, procurement and operational controls that stop an associate creating exposure are where findings are raised.
Conducting Stage 1 and Stage 2
Stage 1 reviews scope justification hard — an excluded subsidiary in a high-risk market is the first thing a competent auditor asks about. Stage 2 tests whether the system operates: gifts registers, training completion, contract clauses, concern-raising records.
Testing the concern-raising channel
Not whether a channel exists, but whether people use it and what happened when they did. A channel with no reports in three years is a finding waiting to be written, not evidence of a clean organisation.
Drafting nonconformity reports
Findings that cite the standard, the clause and the objective evidence, graded defensibly. A finding written as “the culture is weak” is not actionable; one citing Clause 8.2 and naming three high-risk counterparties with no due diligence file is.
Managing an audit programme
Running the programme across a certification cycle — risk-weighting the schedule, auditor competence and independence, surveillance planning, recertification at three years. Its own exam domain and the part that separates an auditor from a lead auditor.
One caution: hours spent preparing for an internal audit count, and so do hours supporting one — but an organisation generally needs an independent pair of eyes on its own ABMS before a certification audit. The wider picture is in the ISO 37001 certification guide for Australia, precisely because the person who built the system cannot credibly audit it.
Why the role is emerging in Australia
No Australian law requires ISO 37001 — it is voluntary. What changed is that the 2024 reforms made a company’s procedures the thing in question. The demand arrives through that door. Five pressures account for most of it.
Requirements depend on the engagement
Anti-bribery management knowledge may support relevant organisational roles. Check the actual legislation, contract, tender and certification scope; this guide is not a vacancy or salary survey.
Audit and implementation are distinct
The organisation must assign competent people and protect audit objectivity and impartiality. A course or individual credential does not itself appoint a certification-body auditor, confer statutory authority or establish organisational compliance.
Confirm the applicable edition
Use the edition and transition arrangements relevant to the organisation and confirm the delivered course-material and examination edition before enrolment. A standard publication does not create an automatic training upgrade.
Course learning may support relevant work, but appointment depends on competence, experience, impartiality and the requirements of the employer, client or certification body. No vacancy or salary outcome is promised.
Roles and career pathways in Australia
The credential maps onto a cluster of roles that barely existed three years ago and now appear regularly in Australian job ads. Most sit inside risk, GRC, or security functions rather than engineering ones, and most are filled by people who converted from an adjacent compliance discipline rather than by AI specialists.
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
Lead Auditor vs Lead Implementer
The two standards share the Annex SL high-level structure that ISO uses across all its management-system standards. Clauses 4 to 10 are the same skeleton in both: context, leadership, planning, support, operation, performance evaluation, improvement. That is why experienced ISO 27001 practitioners convert quickly — the machinery is familiar, and what changes is what you are testing. An implementer builds the system; an auditor decides whether the evidence supports what it claims.
| ISO 37001 Lead Implementer | ISO 37001 Lead Auditor | |
|---|---|---|
| What you do | Build and run the ABMS | Judge whether an ABMS conforms |
| Reference standards | ISO 37001 and PECB’s IMS2 methodology | ISO 19011 and ISO/IEC 17021-1 |
| Exam | Open-book, multiple-choice — stand-alone and scenario-based questions. Duration: 3 hours. 80 multiple-choice questions worth 100 points in total, across 7 competency domains — fundamental principles and concepts of an ABMS (10 questions, 12.5 points), anti-bribery management system requirements (10 questions, 12.5 points), fundamental audit concepts and principles (15 questions, 18.75 points), preparing an ISO 37001 audit (10 questions, 12.5 points), conducting an ISO 37001 audit (19 questions, 23.75 points — the heaviest domain), closing an ISO 37001 audit (8 questions, 10 points), and managing an ISO 37001 audit programme (8 questions, 10 points). Confirmed against PECB Candidate Handbook version 1.5. Passing requirements: 70%. Check the current PECB examination record and assigned examination before booking. | Check the separate Lead Implementer course record; do not assume identical examination conditions. |
| Heaviest domain | Planning the implementation (21 of 80 questions) | Conducting the audit (19 of 80 questions) |
| Key artefact | Bribery risk register, due diligence files, gifts register | Audit plan, nonconformity reports, audit report |
| Experience counted | 300 hours of ABMS project activity for the full tier | 300 hours of audit activity for the full tier |
| Typical background | Compliance, legal, ethics, risk | Internal audit, compliance, consulting, certification bodies |
A great many practitioners hold both, and many organisations integrate ISO 37001 inside an ISO 37301 compliance management system rather than running two — one internal audit programme, one management review, one corrective action process. How far that integration actually goes is covered in our integrated management systems guide. If you want the information-security credential instead, the companion guide is how to become a certified ISO 27001 Lead Auditor. If your organisation needs the ABMS built rather than a person trained, that is our ISO 37001 Lead Implementer course.
FAQs
Is the ISO 37001 Lead Auditor credential worth it?
The credential may support progression into risk, governance, implementation, audit and consulting roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
What is on the ISO 37001 Lead Auditor exam?
Open-book, multiple-choice — stand-alone and scenario-based questions. Duration: 3 hours. 80 multiple-choice questions worth 100 points in total, across 7 competency domains — fundamental principles and concepts of an ABMS (10 questions, 12.5 points), anti-bribery management system requirements (10 questions, 12.5 points), fundamental audit concepts and principles (15 questions, 18.75 points), preparing an ISO 37001 audit (10 questions, 12.5 points), conducting an ISO 37001 audit (19 questions, 23.75 points — the heaviest domain), closing an ISO 37001 audit (8 questions, 10 points), and managing an ISO 37001 audit programme (8 questions, 10 points). Confirmed against PECB Candidate Handbook version 1.5. Passing requirements: 70%. Check the current PECB examination record and assigned examination before booking.
How hard is the ISO 37001 Lead Auditor exam?
Open-book, multiple-choice — stand-alone and scenario-based questions. Duration: 3 hours. 80 multiple-choice questions worth 100 points in total, across 7 competency domains — fundamental principles and concepts of an ABMS (10 questions, 12.5 points), anti-bribery management system requirements (10 questions, 12.5 points), fundamental audit concepts and principles (15 questions, 18.75 points), preparing an ISO 37001 audit (10 questions, 12.5 points), conducting an ISO 37001 audit (19 questions, 23.75 points — the heaviest domain), closing an ISO 37001 audit (8 questions, 10 points), and managing an ISO 37001 audit programme (8 questions, 10 points). Confirmed against PECB Candidate Handbook version 1.5. Passing requirements: 70%. Check the current PECB examination record and assigned examination before booking.
How many hours of audit experience do I need?
PECB credential ladder: Provisional Auditor (no experience required) → Auditor (two years of professional experience, one in anti-bribery management, plus 200 hours of audit activity) → Lead Auditor (five years, two in anti-bribery management, plus 300 hours) → Senior Lead Auditor (ten years, seven in anti-bribery management, plus 1,000 hours). All tiers require signing the PECB Code of Ethics. Accreditation is program- and scope-specific; verify the applicable credential before enrolment. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
Internal auditor or lead auditor — which do I need?
An internal auditor audits their own organisation’s ABMS to satisfy Clause 9.2, and on an anti-bribery system that independence bar is higher than most — independent of the functions where bribery risk sits, not merely from another team. A lead auditor plans and leads audits of other organisations, manages a team and owns the conclusions, under ISO 19011 and ISO/IEC 17021-1. PECB issues no separate ISO 37001 internal auditor credential: this course covers internal auditing thoroughly, and managing an audit programme is its own exam domain.
How much does the ISO 37001 Lead Auditor course cost in Australia?
Self-Study: A$ 857.00 excluding GST. eLearning: A$ 937.00 excluding GST. Published inclusions (subject to the credential and retake clarification immediately below): PECB ISO 37001 Lead Auditor slide deck (digital); Over 450 pages of training material with information and practical examples; 12 months access via myPECB; Attestation of course completion worth 31 CPD credits; Certification and examination fees included in the course price; Three-hour exam across seven competency domains; First exam attempt plus one free retake within 12 months; PECB Provisional / Auditor / Lead Auditor credential on pass; Audit plan and audit test plan templates for an ABMS; Nonconformity report worked examples — major and minor; Stage 1 and Stage 2 evidence checklists for anti-bribery controls; Due diligence sampling approach for third-party relationships. Clarification: references to a credential or certificate on pass do not mean automatic award. The eligible PECB credential requires an application and PECB approval, including applicable experience and ethics requirements. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. A retained inclusion referring to the initial examination date does not extend or restart this policy cycle. Australian GST follows the billing address. Check the course page for the full inclusions and current booking options. This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply.
Does ISO 37001 certification protect a company legally?
No, and it is important to be exact about this. Under the Crimes Legislation Amendment (Combatting Foreign Bribery) Act 2024 the defence available to a body corporate is that it had adequate procedures in place designed to prevent the conduct. Certification to ISO 37001 is not that defence and no standard could be. What an ABMS built to ISO 37001 does is produce documented, tested, independently audited evidence that such procedures existed and operated. Whether they were adequate in a particular case is a legal question, and one for lawyers rather than a training provider.
Should I take ISO 37001 or ISO 37301?
PECB credential ladder: Provisional Auditor (no experience required) → Auditor (two years of professional experience, one in anti-bribery management, plus 200 hours of audit activity) → Lead Auditor (five years, two in anti-bribery management, plus 300 hours) → Senior Lead Auditor (ten years, seven in anti-bribery management, plus 1,000 hours). All tiers require signing the PECB Code of Ethics. Accreditation is program- and scope-specific; verify the applicable credential before enrolment. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
More practitioner guides in the Aegentra Insights library.