ISO 37301 LI key terms

A structured set of interrelated policies, processes, roles and controls an organization uses to direct, support and govern compliance with its compliance obligations and to achieve intended compliance outcomes.

Requirements that an organization must or chooses to comply with, including legal and regulatory requirements, contractual terms, industry standards, and voluntary commitments such as codes of conduct or internal policies.

The likelihood and consequence of failing to meet a compliance obligation, usually expressed as uncertainty of outcome combined with potential legal, financial, operational or reputational harm.

The shared values, beliefs, attitudes and behaviours across an organization that determine how seriously compliance is taken and whether people speak up about concerns.

The visible commitment and behaviour of governing bodies and senior management that signals how compliance expectations should be interpreted and prioritized throughout the organization.

The person or team responsible for operating and coordinating the compliance management system, advising the business, and monitoring compliance performance independently of operational pressures.

The highest-level person or group with authority and accountability for the organization's strategic direction and oversight, such as a board of directors or equivalent.

The person or group that directs the organization at the highest operational level and has authority to deploy resources, establish policy and integrate compliance requirements into business processes.

A governance concept in which operational management owns and manages risk, a risk and compliance function provides oversight and advice, and internal audit provides independent assurance.

A documented statement of the organization's commitment to meet compliance obligations, providing the framework and principles for setting compliance objectives and managing compliance risk.

The documented boundaries of the compliance management system, defining which functions, locations, activities, products, services and compliance obligations are covered and which are excluded.

The external and internal issues, interested-party needs and expectations, and organizational characteristics that are relevant to the organization's purpose and affect its compliance management system.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision, activity or compliance outcome of the organization, such as regulators, customers, employees or owners.

A way of prioritizing compliance effort and controls according to the likelihood and severity of harm from non-compliance, so that resources focus on the most significant compliance risks.

A structured process of identifying, analysing and evaluating compliance risks, taking into account obligations, business activities, past incidents and changes in the internal and external environment.

The selection and application of measures to address assessed compliance risks, such as avoiding an activity, reducing likelihood or impact through controls, sharing risk, or accepting residual risk.

The level of compliance risk that remains after existing and planned controls have been applied, which must be understood and accepted by an accountable decision-maker.

The amount and type of compliance risk an organization is willing to accept or retain in pursuit of its objectives, providing a benchmark for evaluating whether treatment is sufficient.

A maintained record listing identified compliance risks with their owners, assessment results, controls, treatment actions, status and review dates.

A measure that modifies or manages compliance risk, ranging from preventive steps such as approvals and training to detective steps such as monitoring and corrective action.

Measurable goals the organization sets to achieve compliance outcomes, consistent with the compliance policy and assigned to responsible functions with defined timeframes.

Demonstrated engagement by top management in the compliance management system through resourcing, communication, decision-making and personal example rather than delegation alone.

The documented assignment of who is accountable for which compliance activities, who may approve decisions, and how responsibilities are communicated and understood within the organization.

The combination of education, training, experience and skills needed by a person to perform compliance-related work effectively, including awareness of the risks in their own role.

Planned activities that ensure people understand the compliance policy, their obligations, the consequences of non-compliance, and how to raise concerns or reports.

A confidential and protected channel through which employees and others can report suspected or actual non-compliance, with safeguards against retaliation for good-faith reporting.

Legal and organizational safeguards that shield people who report wrongdoing from dismissal, demotion, harassment or other detrimental treatment.

Information the organization must control and maintain, including the compliance policy, procedures, records of risk assessment, training records, monitoring results and evidence of corrective action.

The investigative and preventive steps an organization takes before and during a business relationship to assess and address compliance risks posed by third parties and transactions.

The process of assessing, contracting with, monitoring and reviewing suppliers, agents, distributors and other partners so that their conduct does not create compliance exposure.

The ongoing determination of what needs to be monitored, the methods used, when results are analysed, and who evaluates compliance performance against objectives and obligations.

A quantifiable measure chosen to track progress toward a compliance objective, such as training completion rates, overdue corrective actions, or number of substantiated reports.

An independent and objective review activity that evaluates whether the compliance management system conforms to planned arrangements and is effectively implemented and maintained.

The confidence provided to interested parties, through audit, review or other independent evaluation, that the compliance management system is operating as intended.

A periodic top-management evaluation of the compliance management system's suitability, adequacy and effectiveness, using monitoring, audit and risk information to decide on improvements.

A failure to meet a requirement of the compliance management system standard or of the organization's own compliance arrangements, which must be recorded and addressed.

Action taken to eliminate the cause of a detected nonconformity so that it does not recur, including root-cause analysis, implementation and verification of effectiveness.

A structured method for identifying the underlying reason a nonconformity occurred, distinguishing it from immediate symptoms so that corrective action addresses the real problem.

The recurring activity of enhancing compliance performance by learning from monitoring results, incidents, audits and reviews, and by adjusting the management system accordingly.

An independent third-party audit conducted to determine whether the compliance management system conforms to ISO 37301 and is effectively implemented, leading to certification if successful.

An accredited organization that performs audits and issues certificates confirming that an organization's compliance management system meets the requirements of a standard.

Formal recognition by a national accreditation body that a certification body is competent to carry out certification activities within a defined scope.

The initial certification audit phase that reviews documentation and readiness, confirms the scope, and identifies whether the organization is prepared for the stage 2 audit.

The certification audit phase that evaluates implementation and effectiveness of the compliance management system through sampling, interviews and examination of evidence.

Records, observations, interviews and other verifiable information an auditor uses to determine whether requirements are met and the management system is effective.

The result of evaluating collected audit evidence against audit criteria, classified as conforming, nonconforming, or an observation or opportunity for improvement.