ISO 37301 LI flashcards
ISO 37301 LI · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Compliance obligation
- Any requirement that the organization must comply with, plus any requirement it voluntarily chooses to comply with, including legal, regulatory, contractual, and self-imposed requirements.
- Compliance management system
- A set of interrelated or interacting elements used to establish compliance policy and objectives and to achieve those objectives, structured around clauses 4-10 of ISO 37301.
- Compliance risk
- The effect of uncertainty on compliance objectives, assessed in terms of likelihood and consequence and treated through controls rather than eliminated entirely.
- Harmonized Structure clauses
- Clauses 4-10 of ISO 37301: Context, Leadership, Planning, Support, Operation, Performance evaluation, and Improvement, shared with other ISO management system standards.
- PDCA in ISO 37301
- Plan covers clauses 4-6, Do covers 7-8, Check covers 9, and Act covers 10, providing the continuous improvement cycle underlying the standard.
- Compliance culture
- Shared values, beliefs, and behaviors regarding compliance, shaped by leadership example, incentives, training, and the perceived consequences of noncompliant conduct.
- Certifiable standard
- A standard containing requirements, such as ISO 37301, against which an accredited certification body can audit and issue a certificate, unlike purely guidance standards.
- Top management commitment
- The highest-level leadership decision to establish the CMS, providing authority, resources, and visible sponsorship, and a prerequisite for initiation.
- CMS scope definition
- The documented boundaries of the compliance management system, covering functions, locations, legal entities, processes, products, and third-party interfaces.
- Gap analysis
- A structured comparison of the organization's current compliance practices against the requirements of ISO 37301 clauses 4-10, used to set the baseline.
- Compliance function
- The organizational unit or role with assigned responsibility and authority for the compliance management system, as required by clause 5.3.
- Implementation roadmap
- A phased plan listing milestones, owners, budget, dependencies, and quick wins versus structural changes needed to build the CMS.
- Interested parties
- Persons or organizations that can affect, be affected by, or perceive themselves affected by the organization's compliance performance and obligations.
- Compliance obligations register
- A documented, maintained record of the organization's compliance obligations, their sources, owners, and related controls, required by clause 6.1.3.
- Compliance objectives
- Measurable targets set to achieve compliance, monitored, communicated, and supported by plans specifying what, who, when, and how.
- Risk treatment options
- Ways of addressing compliance risk: avoid the activity, reduce likelihood, reduce consequence, transfer via insurance, or accept with authority and rationale.
- Risk assessment methodology
- The documented approach defining risk criteria, likelihood and consequence scales, and the process for identifying and evaluating compliance risks.
- Planned change
- A change to the CMS carried out deliberately and systematically under clause 6.3, considering consequences and unintended effects before implementation.
- Compliance policy
- A top management statement appropriate to purpose, providing a framework for objectives and commitment to meet compliance obligations, communicated and available.
- Due diligence
- Risk-based investigation and monitoring of third parties before and during the relationship, covering integrity, compliance obligations, and contractual requirements.
- Competence and awareness
- Clause 7 requirements that people doing work affecting compliance be competent, trained, aware of the policy, and that records of competence be retained.
- Documented information control
- Clause 7.5 requirements for creation, review, approval, version control, distribution, access, retention, and disposal of compliance documentation.
- Speak-up channel
- A confidential mechanism allowing workers and others to report suspected or actual noncompliance without fear of retaliation, supporting the compliance culture.
- Segregation of duties
- An operational control separating incompatible responsibilities, such as initiation and approval, to reduce the likelihood of error or fraud.
- Monitoring and measurement
- Clause 9.1 requirements to determine what to monitor, the methods, timing, responsible persons, and when results are analyzed and evaluated.
- Internal audit program
- A planned schedule of objective, impartial audits considering process importance, changes, and prior results, with auditors not auditing their own work.
- Management review
- A top management evaluation of CMS suitability, adequacy, and effectiveness, using defined inputs and producing decisions on improvement and change.
- Nonconformity
- A failure to meet a requirement, which must be reacted to, with the need for corrective action evaluated and its effectiveness reviewed.
- Corrective action
- Action taken to eliminate the root cause of a nonconformity so that it does not recur, with documented evidence of the cause and the action.
- Continual improvement
- The recurring process of enhancing the suitability, adequacy, and effectiveness of the CMS, fed by audit, monitoring, incidents, and management review.
- Stage 1 audit
- A readiness assessment by the certification body reviewing documentation, scope, context, and completion of internal audit and management review.
- Stage 2 audit
- The certification audit verifying implementation and effectiveness of the CMS through sampling of evidence, graded findings, and a certification decision.