ISO 37001 Lead Auditor Training — Lesson 4: Reporting on Reporting, Nonconformity, Corrective Action, Follow-Up, and Assurance

Learning Objectives

• Interpret the purpose, responsibilities, inputs, and decision points shaping reporting on reporting, nonconformity, corrective action, follow-up, and assurance.
• Apply the workflow and produce anti-bribery audit report that another practitioner can review.
• Analyze “a control failure closes without testing related transactions” and recommend a proportionate, evidence-based response.

Detailed Topics

• audit conclusions
• closing meeting
• audit report
• nonconformity
• root cause
• corrective action
• follow-up verification
• assurance reporting
• Governance, competence, communication, documentation, validation, risk, and follow-up considerations

Instructor Demonstration

The instructor demonstrates the reporting on reporting, nonconformity, corrective action, follow-up, and assurance workflow, identifies applicable responsibilities, records checkpoints in anti-bribery audit report, and contrasts the accepted state with a condition where a control failure closes without testing related transactions.

Hands-On Exercise

Complete a controlled implementation, management, audit, assessment, foundation, introduction, awareness, or transition exercise for Reporting on Reporting, Nonconformity, Corrective Action, Follow-Up, and Assurance. Establish scope and criteria, collect or create evidence, examine “a control failure closes without testing related transactions,” reach a supported conclusion, and preserve the result in anti-bribery audit report.

1. Confirm objectives, scope, roles, criteria, stakeholders, and expected outputs.
2. Perform the planned activities while recording assumptions, evidence, and decisions.
3. Test a normal case, an exception, and a follow-up or improvement condition.
4. Document conclusions, owners, due dates, escalation, and verification requirements.

Scenario Analysis

• Identify the requirement or principle with the strongest influence on reporting on reporting, nonconformity, corrective action, follow-up, and assurance.
• Compare two defensible responses and explain their governance, risk, and evidence trade-offs.
• Determine how the anti-bribery audit report should be approved, retained, reviewed, and updated.

Troubleshooting Guidance

Separate missing evidence from ineffective practice, and distinguish a documentation issue from a control, process, governance, or competence failure. Use anti-bribery audit report to trace the earliest divergence. Treat “a control failure closes without testing related transactions” as a hypothesis until the response is validated against the applicable requirement and intended outcome.

Validation Checklist

• The scope, criteria, stakeholders, and intended outcome for reporting on reporting, nonconformity, corrective action, follow-up, and assurance are explicit.
• The anti-bribery audit report links statements and decisions to objective, reviewable support.
• Responsibilities, competence, communication, risk, legal duties, and change impact were considered where relevant.
• Findings, corrective actions, monitoring, review triggers, and improvement ownership are clear.

Lesson Outcome

Learners can apply Reporting on Reporting, Nonconformity, Corrective Action, Follow-Up, and Assurance, explain the reasoning used, and defend the result through anti-bribery audit report.