Zero-incident target at a logistics group
Northwind Logistics has 2,400 employees across five countries. Its board chair has promised investors that the company will be certified to ISO 37301 within 90 days and defines success as zero regulatory breaches. The compliance function sits inside the legal department; the same senior lawyer approves major sales contracts and investigates compliance incidents. A code of conduct has been signed by 92% of staff, annual e-learning takes 20 minutes, and the policy library contains 60 documents. No compliance risk assessment has ever been performed. Six months ago a customs broker misclassified goods and triggered a fine; legal treated it as an isolated error. Third-party due diligence covers only the 12 largest freight forwarders. Business managers describe compliance as "legal's job." The compliance officer proposes commissioning a gap analysis and drafting 25 new procedures before the certification target is discussed. The board wants a yes-or-no answer on whether the company is ready.
1. Explain why Northwind's current arrangements do not yet demonstrate the fundamental principles of an ISO 37301 compliance management system. Avoid a clause-by-clause checklist; focus on what the board should understand about the system's purpose and design.
Read the worked answer
A compliance management system is not a policy library plus training. ISO 37301 principles include top-management responsibility, a risk-based approach, proportionality, integration into business processes, accountability, transparency and continual improvement. Here leadership has delegated compliance to legal, and the same function approves major sales contracts and investigates incidents. That weakens objectivity and blurs first-line and second-line accountability. There is no compliance risk assessment, so controls cannot be proportionate to the organisation's obligations. The customs incident was not analysed for root cause or systemic control failure, so the organisation lost the chance to learn. Third-party due diligence is based on size, not risk. Training completion is an output, not evidence of competence or culture. A gap analysis and 25 procedures would produce documents, not a functioning system. The board should see the CMS as an integrated decision-support and assurance system covering prevention, detection, response and improvement.
2. The board asks whether a 90-day certification target is realistic. What should the compliance officer recommend, and what should happen before any certification commitment is made?
Read the worked answer
The compliance officer should recommend against committing to a 90-day certification date until readiness is evidenced. Before any commitment, the organisation should secure an accountable executive sponsor and clarify the board's role; define the CMS scope in line with its context and interested parties; perform an initial compliance risk assessment and obligations mapping; validate the policy framework against those risks; establish incident, escalation, third-party and monitoring controls; run an internal audit and management review; and agree a remediation plan. Certification requires evidence of implementation and effectiveness, not just documentation. A 90-day window could be enough for a narrow scope with mature processes, but not for an organisation with no risk assessment and unresolved control failures. The compliance officer should present a staged plan with milestones, owners, budget and a certification decision gate, and ask the board to approve the plan rather than a date.
3. How should the compliance officer reframe the board's 'zero breaches' success measure so that it reflects a functioning CMS rather than an unrealistic guarantee?
Read the worked answer
Zero breaches is an aspiration, not a management measure. No CMS can guarantee that no employee or third party will ever breach an obligation. A functioning CMS aims to make breaches less likely, detect them earlier, respond consistently and learn from them. The board should adopt a balanced set of measures: completion of risk-based obligations mapping; percentage of high-risk controls tested and effective; time to close corrective actions; repeat findings; incident and near-miss reporting rates; third-party risk coverage; training effectiveness rather than attendance; regulatory change response time; and assurance coverage. It should also define risk appetite and escalation thresholds. Reframing success this way keeps executive attention on prevention and learning while avoiding a target that encourages concealment of incidents. The board can still state an ambition of zero breaches, but must not use it as the sole certification or performance criterion.