I85PREP
⌘ K
ISO 37301 LI study materials
ISO 37301 LI study resources

ISO 37301 LI practice questions

One question at a time. Build your ISO 37301 LI understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of a compliance management system

In ISO 37301, what does a compliance management system (CMS) primarily exist to do?

  1. Document only the sanctions that regulators have already imposed
  2. Replace the organisation's legal department with an external adviser
  3. Establish a structured, risk-based framework for governing compliance obligations Correct answer.
  4. Guarantee that no compliance failure can ever occur in the organisation

Explanation

A CMS is a structured management framework that helps an organisation govern its compliance obligations in a risk-based, systematic way. It is built on the Plan-Do-Check-Act cycle and integrates compliance into decision-making rather than promising perfection. The standard explicitly recognises that no system can eliminate all compliance failures.

Question 2Fundamental principles and concepts of a compliance management system

Which of the following best describes a 'compliance obligation' as the term is used in ISO 37301?

  1. Any recommendation issued by an external consultant to the organisation
  2. Only obligations imposed by the national law of the headquarters country
  3. A financial target set by the organisation's board of directors
  4. A requirement that the organisation has to comply with, including legal, regulatory and self-imposed requirements Correct answer.

Explanation

ISO 37301 defines compliance obligations broadly as requirements the organisation must comply with. These include mandatory legal and regulatory requirements plus voluntary commitments such as contracts, industry codes and internal policies the organisation has adopted. The scope is therefore wider than statute law alone.

Question 3Fundamental principles and concepts of a compliance management system

According to ISO 37301, who within the organisation owns the compliance management system?

  1. The individual employees, since each person decides their own obligations
  2. Only the compliance function, working in isolation from the rest of the business
  3. Governing bodies and top management, with compliance embedded across all levels Correct answer.
  4. The external auditor who certifies the system

Explanation

ISO 37301 places responsibility for the CMS on the governing body and top management, who must demonstrate leadership and commitment. Compliance is intended to be embedded in the organisation's culture and processes at every level, supported by a compliance function. Ownership is therefore a governance responsibility, not a delegated technical task.

Question 4Fundamental principles and concepts of a compliance management system

Which cycle underpins the structure of ISO 37301 and its clauses on planning, support, operation, performance evaluation and improvement?

  1. The Six Sigma DMAIC cycle
  2. The McKinsey 7S framework
  3. The waterfall development lifecycle
  4. The Plan-Do-Check-Act (PDCA) cycle Correct answer.

Explanation

ISO 37301 follows the Harmonized Structure used by ISO management system standards, which is organised around Plan-Do-Check-Act. Planning and support correspond to Plan, operation to Do, performance evaluation to Check, and improvement to Act. This makes the CMS compatible with other ISO management systems such as quality or information security.

Question 5Fundamental principles and concepts of a compliance management system

Which statement best captures the relationship between compliance and an organisation's culture under ISO 37301?

  1. Culture is irrelevant once written policies have been issued
  2. Culture is the sole responsibility of the compliance officer and not of managers
  3. Culture can be treated as satisfied once a whistleblowing hotline is installed
  4. Compliance culture is a core element that top management must actively promote and model Correct answer.

Explanation

ISO 37301 treats a culture of compliance as integral to the system, and top management is expected to promote and exemplify it. Values, ethics and behaviour are addressed alongside formal rules and controls. A hotline or policy set alone does not create culture.

Question 6Fundamental principles and concepts of a compliance management system

What is the role of a compliance function in an ISO 37301 CMS?

  1. To replace the internal audit function entirely
  2. To make all operational business decisions on behalf of line managers
  3. To guarantee that regulators will not investigate the organisation
  4. To provide support, advice and oversight so that compliance obligations are met across the organisation Correct answer.

Explanation

The compliance function supports the organisation by advising, coordinating and overseeing compliance activities, while operational managers remain accountable for compliance in their areas. It enables rather than replaces line management. Independence and access to the governing body are important attributes of this function.

Question 7Fundamental principles and concepts of a compliance management system

Which of the following is an example of a voluntary compliance obligation that an organisation may adopt under ISO 37301?

  1. A contractual commitment to a customer's supplier code of conduct Correct answer.
  2. A court order requiring production of documents
  3. A statutory tax filing deadline set by national legislation
  4. A licensing condition imposed by a sector regulator

Explanation

Voluntary compliance obligations are commitments the organisation chooses to accept, such as contractual terms, industry codes or its own policies. Contractual supplier codes are a typical example. Statutory deadlines, court orders and licence conditions are imposed externally and are not voluntary.

Question 8Fundamental principles and concepts of a compliance management system

What does 'proportionate' mean when designing compliance controls under ISO 37301?

  1. Controls should be sized to the organisation's compliance risk and context Correct answer.
  2. Controls must be identical in every business unit regardless of risk
  3. Controls should be designed only after a regulator has issued a penalty
  4. Controls must always be the cheapest option available

Explanation

Proportionality means the effort and formality of controls should reflect the nature, scale and complexity of the organisation's compliance risks. Higher-risk activities warrant stronger controls, while lower-risk ones may need lighter measures. This risk-based logic runs throughout the standard.

Question 9Fundamental principles and concepts of a compliance management system

An organisation identifies a new data-protection regulation affecting one business unit. Which step best reflects ISO 37301's risk-based approach?

  1. Wait until a regulator issues guidance specific to the organisation before acting
  2. Delegate the matter entirely to the external legal counsel and take no internal action
  3. Apply the same generic control used for all other regulations without analysis
  4. Assess the obligation, evaluate the associated compliance risk and update controls and processes accordingly Correct answer.

Explanation

ISO 37301 requires organisations to identify compliance obligations and assess the risks of failing to meet them, then design controls proportionate to that risk. The process is iterative and feeds back into planning and operation. Simply waiting or applying generic controls bypasses this analysis.

Question 10Fundamental principles and concepts of a compliance management system

Which pair of concepts does ISO 37301 use to describe how compliance risk is evaluated and then addressed?

  1. Marketing and sales
  2. Budgeting and forecasting
  3. Recruitment and dismissal
  4. Risk assessment and risk treatment Correct answer.

Explanation

The standard follows the familiar risk-management logic in which risks are first identified and assessed, then treated through controls, mitigation or acceptance. This links compliance obligations to concrete actions in the CMS. The other pairs are unrelated business processes.

Question 11Fundamental principles and concepts of a compliance management system

What is the purpose of the 'scope' of a compliance management system in ISO 37301?

  1. To define the boundaries and applicability of the CMS, including the obligations and organisational units it covers Correct answer.
  2. To specify the exact wording of every contract the organisation signs
  3. To list every employee's job description in detail
  4. To record the financial results of the previous year

Explanation

The scope statement sets the boundaries of the CMS, clarifying which organisational units, activities and compliance obligations are covered. It prevents ambiguity about what the system does and does not address. It is a governance and planning document, not an operational or financial record.

Question 12Fundamental principles and concepts of a compliance management system

Which statement best describes 'interested parties' in the context of an ISO 37301 CMS?

  1. Only the organisation's shareholders and lenders
  2. Exclusively the regulators that license the organisation
  3. Persons or organisations that can affect, be affected by, or perceive themselves to be affected by the organisation's compliance performance Correct answer.
  4. Only the employees who work in the compliance department

Explanation

Interested parties are those who can affect, be affected by, or perceive themselves affected by the organisation's decisions and activities, which in a compliance context includes regulators, customers, employees, communities and others. Understanding their needs helps the organisation determine relevant compliance obligations. The concept is intentionally broad.

Question 13Fundamental principles and concepts of a compliance management system

A compliance officer proposes a control that is far stricter than the risk warrants, imposing heavy burdens on a low-risk process. What does ISO 37301 suggest?

  1. Controls should be proportionate to the compliance risk, so the design should be reconsidered Correct answer.
  2. The decision should be left to the external auditor to make
  3. Stricter controls are always better, so the proposal should be approved unchanged
  4. Controls should be removed entirely from low-risk processes

Explanation

ISO 37301 expects controls to be proportionate to the level of compliance risk. Over-controlling low-risk activities can waste resources and create unnecessary bureaucracy. The officer should reassess the risk and scale the control accordingly.

Question 14Fundamental principles and concepts of a compliance management system

Which of the following best reflects the principle of 'continual improvement' in ISO 37301?

  1. Replacing the entire compliance team every year to introduce fresh thinking
  2. Treating a single successful audit as proof that no further work is needed
  3. Reviewing compliance performance and correcting weaknesses so the CMS becomes more effective over time Correct answer.
  4. Avoiding any change to the CMS once it has been certified

Explanation

Continual improvement means using performance evaluation, audits, management review and corrective actions to strengthen the CMS over time. It is a recurring, evidence-based process rather than a one-off event. Certification is a point-in-time assessment, not a reason to stop improving.

Question 15Fundamental principles and concepts of a compliance management system

How does ISO 37301 relate to ISO 19600, the earlier guidance standard on compliance management?

  1. ISO 37301 is a sector-specific standard that applies only to financial institutions
  2. ISO 37301 addresses only environmental compliance
  3. ISO 37301 and ISO 19600 are unrelated and address different subjects
  4. ISO 37301 replaces ISO 19600 and upgrades the guidance into a certifiable requirements standard Correct answer.

Explanation

ISO 37301 superseded ISO 19600 and converted the earlier guidance into a requirements standard against which organisations can be certified. It retains the core principles while adding auditable requirements. It is generic and applicable to organisations of all types and sizes.

Question 16Fundamental principles and concepts of a compliance management system

An organisation's compliance policy is written but managers routinely ignore it in practice. Which ISO 37301 concept is most directly undermined?

  1. The organisation's product pricing model
  2. The selection of external legal counsel
  3. The culture of compliance and the integration of compliance into business processes Correct answer.
  4. The organisation's marketing strategy

Explanation

ISO 37301 stresses that compliance must be embedded in the organisation's culture and operational processes, not merely written down. When managers disregard the policy, the gap between stated rules and actual behaviour weakens the CMS. Leadership commitment and consistent enforcement are essential to close that gap.

Question 17Fundamental principles and concepts of a compliance management system

Under the PDCA logic of ISO 37301, which activity belongs to the 'Check' phase?

  1. Establishing compliance objectives and planning controls
  2. Monitoring, measuring and evaluating compliance performance Correct answer.
  3. Taking corrective action to address a detected nonconformity
  4. Implementing training and communication programmes

Explanation

In the PDCA cycle, Check corresponds to performance evaluation, which includes monitoring, measurement, analysis and evaluation of compliance performance. Planning sits in Plan, implementation in Do, and corrective action in Act. This mapping clarifies where each clause fits.

Question 18Fundamental principles and concepts of a compliance management system

What does ISO 37301 mean by 'embedding' compliance into the organisation?

  1. Storing all compliance documents in a single electronic folder
  2. Restricting compliance responsibilities to the compliance department
  3. Outsourcing compliance activities to an external provider
  4. Integrating compliance requirements into everyday roles, processes and decision-making across the organisation Correct answer.

Explanation

Embedding means compliance is built into how the organisation normally operates, so obligations are considered in routine decisions and processes at every level. It is not achieved by document storage or by isolating the work in one department. This integration is central to a functioning CMS.

Question 19Fundamental principles and concepts of a compliance management system

An organisation is small and operates in a single jurisdiction with limited resources. How does ISO 37301 apply to it?

  1. It applies, but the CMS can be proportionately simpler to match its size and risk profile Correct answer.
  2. It applies only after the organisation has been fined for a compliance breach
  3. It does not apply because the standard is reserved for large multinationals
  4. It applies only if the organisation has a dedicated compliance department

Explanation

ISO 37301 is generic and intended for organisations of all sizes and types. The design and documentation of the CMS can be scaled to the organisation's context, size and risk. A small organisation may therefore operate a simpler but still effective system.

Question 20Fundamental principles and concepts of a compliance management system

Which element most directly supports the 'evidence-based' nature of an ISO 37301 CMS?

  1. Relying on anecdote and informal verbal assurances from staff
  2. Maintaining documented information and performance data to demonstrate compliance Correct answer.
  3. Assuming compliance is achieved because no complaints have been received
  4. Relying solely on the compliance officer's personal judgement

Explanation

A functioning CMS depends on documented information and performance data that can demonstrate conformity and support decisions. Evidence allows the organisation to monitor obligations, evaluate risk and show assurance to interested parties. Anecdote and assumption are not reliable substitutes.

Question 21Fundamental principles and concepts of a compliance management system

A multinational discovers that a local subsidiary's practices conflict with the group's stated compliance commitments. Which ISO 37301 principle is most relevant to resolving this?

  1. Consistency of leadership commitment and a coherent CMS across the organisation Correct answer.
  2. Delegating the issue entirely to the subsidiary without group oversight
  3. Abandoning the group-wide compliance policy to accommodate local practice
  4. Treating the conflict as a purely reputational matter with no process change

Explanation

ISO 37301 expects top management to provide consistent leadership and a coherent CMS, including across different units and locations. Where local practice diverges from stated commitments, the organisation should align behaviour with the policy through oversight and corrective action. Delegation without oversight or abandoning the policy undermines the system.

Question 22Fundamental principles and concepts of a compliance management system

Why does ISO 37301 emphasise understanding the organisation's context before designing the CMS?

  1. Because it replaces the need for performance evaluation later
  2. Because it is a formality with no effect on the rest of the system
  3. Because it allows the organisation to avoid identifying any obligations
  4. Because context analysis determines the compliance obligations, risks and interested-party needs the system must address Correct answer.

Explanation

Understanding external and internal context reveals the legal, regulatory, market and cultural factors that shape the organisation's compliance obligations and risks. This analysis informs the scope, objectives and design of the CMS. It is a substantive input, not a formality, and does not remove later evaluation steps.

Question 23Fundamental principles and concepts of a compliance management system

Two business units interpret the same compliance obligation differently, producing inconsistent controls. What does ISO 37301 suggest about this situation?

  1. The conflict should be resolved by whichever unit has the larger budget
  2. The organisation should harmonise interpretation and controls through a coordinated CMS while allowing for proportionate differences Correct answer.
  3. Inconsistency is acceptable because each unit is free to set its own standards
  4. The obligation should be ignored until a regulator clarifies it

Explanation

A CMS provides a coordinated framework so that compliance obligations are interpreted consistently and controls are aligned, while still allowing proportionality to local risk. Inconsistent interpretation without coordination is a governance weakness. Harmonisation supports both effectiveness and fairness across the organisation.

Question 24Fundamental principles and concepts of a compliance management system

An organisation has strong written procedures but no mechanism to detect emerging regulatory changes. Which aspect of an ISO 37301 CMS is weakest?

  1. Its document formatting standards
  2. Its recruitment and onboarding practices
  3. Its ability to identify and keep up to date with changing compliance obligations Correct answer.
  4. Its product distribution channels

Explanation

ISO 37301 requires organisations to identify their compliance obligations and keep them current as laws, regulations and commitments change. Without a mechanism to track emerging requirements, even well-written procedures can become outdated. Monitoring the regulatory environment is therefore a core CMS activity.

Question 25Fundamental principles and concepts of a compliance management system

A board wants assurance that its compliance programme is genuinely effective rather than merely documented. Which combination of ISO 37301 elements best provides that assurance?

  1. A statement in the annual report that the organisation complies with all laws
  2. A lengthy compliance manual stored on the intranet
  3. A single annual training session for senior managers
  4. Performance monitoring, internal audit and management review feeding into improvement Correct answer.

Explanation

ISO 37301 builds assurance from ongoing performance evaluation, independent internal audit and management review, all feeding corrective action and improvement. These mechanisms test whether the CMS actually works, not just whether it exists on paper. Documentation and declarations alone provide much weaker assurance.

Question 26Fundamental principles and concepts of a compliance management system

ISO 37301 describes compliance as an outcome of an organisation's culture and behaviour, not only of documented rules. Which statement best captures what the standard means by a 'compliance culture'?

  1. A disciplinary procedure that sanctions employees who breach any legal or regulatory requirement
  2. Shared values, ethics and behaviour across the organisation that make compliance with obligations a normal part of daily work Correct answer.
  3. A dedicated compliance department that reviews and approves all business decisions before they are taken
  4. A published code of conduct signed by every employee at induction and stored in the personnel file

Explanation

ISO 37301 treats culture as the values, ethics and behaviour demonstrated across the organisation, which determine whether obligations are actually met in practice. Documents, a compliance function and sanctions can support that culture but do not by themselves constitute it. The standard therefore expects leadership to actively promote and model the desired behaviour.

Question 27Fundamental principles and concepts of a compliance management system

An organisation's governing body approves the compliance policy and receives regular reports on compliance performance, while day-to-day operation of the CMS is delegated to management. How does ISO 37301 describe this arrangement?

  1. Full transfer of compliance accountability from the governing body to the compliance function
  2. An optional arrangement that only applies to listed companies in regulated financial sectors
  3. Governance body oversight and accountability for the CMS, with operational responsibility delegated to management Correct answer.
  4. A temporary arrangement that ends once the CMS has been certified by an external body

Explanation

ISO 37301 places accountability for the CMS with the governing body, which provides oversight and direction, while management is responsible for operating the system. Delegation of operation does not remove that accountability. Certification confirms conformity at a point in time and does not end the governing body's continuing role.

Question 28Fundamental principles and concepts of a compliance management system

A compliance manager wants to distinguish a 'compliance obligation' from a 'compliance risk' when briefing staff. Which distinction is consistent with ISO 37301?

  1. An obligation applies only to legal requirements, whereas a risk applies only to voluntary commitments such as industry codes
  2. An obligation is a requirement the organisation must or chooses to meet, whereas a risk is the effect of uncertainty on meeting those requirements Correct answer.
  3. An obligation is recorded in the compliance register, whereas a risk is recorded only in the financial statements
  4. An obligation is a risk that has already materialised, whereas a risk is an obligation that has not yet been identified

Explanation

ISO 37301 defines compliance obligations as requirements the organisation must comply with, including legal and regulatory requirements and other requirements it commits to. Compliance risk is the effect of uncertainty on those objectives, arising from the possibility of failing to meet an obligation. Keeping the two concepts distinct is essential for building a coherent compliance obligation register and risk assessment.

Question 29Fundamental principles and concepts of a compliance management system

A company has identified its compliance obligations and assessed its compliance risks, but has not defined who is responsible for each control or how performance will be measured. Which pair of ISO 37301 elements is most directly missing?

  1. Operational planning and control, together with performance evaluation and monitoring Correct answer.
  2. Context of the organisation, together with leadership commitment
  3. Management review, together with continual improvement
  4. Scope of the CMS, together with interested party identification

Explanation

Assigning responsibility for controls and measuring performance are core features of operational planning and control and of performance evaluation and monitoring. Without them, identified obligations and risks cannot be translated into managed, measurable activity. The other pairs address framing and review, not the operational execution and measurement gap described.

Question 30Initiation of a CMS implementation

An organization has just decided to implement a compliance management system based on ISO 37301. According to the standard, which element must be addressed first when initiating the CMS?

  1. Publishing the compliance policy
  2. Selecting a certification body
  3. Conducting the internal audit programme
  4. Understanding the organization and its context Correct answer.

Explanation

ISO 37301 follows the harmonized structure, so the sequence begins with understanding the organization and its context, which determines the external and internal issues relevant to the CMS. Internal audit and certification activities occur much later in the lifecycle, and the policy is developed after context and scope are established.

Question 31Initiation of a CMS implementation

Before defining the scope of its compliance management system, a company maps regulators, customers, industry bodies, and competitors. In ISO 37301 terms, these are best described as which of the following?

  1. Compliance risk sources
  2. Top management commitments
  3. Interested parties relevant to the CMS Correct answer.
  4. Compliance obligations

Explanation

Interested parties are the persons or organizations that can affect, be affected by, or perceive themselves to be affected by a decision or activity. Mapping them precedes determining which of their requirements become compliance obligations. Compliance obligations and risk sources are derived outputs, not the parties themselves.

Question 32Initiation of a CMS implementation

A compliance officer is drafting the initial scope statement for the CMS. Which input is most directly required by ISO 37301 to determine that scope?

  1. The projected budget for compliance software
  2. The names of certified competitors in the sector
  3. The list of past audit findings from other management systems
  4. The external and internal issues identified in the context analysis Correct answer.

Explanation

The scope of the CMS must be determined with reference to the external and internal issues identified during context analysis, along with compliance obligations and the organization's activities. Budgets, competitor data, and unrelated audit findings do not define the CMS boundary.

Question 33Initiation of a CMS implementation

When initiating a CMS, top management must demonstrate leadership. Which action best evidences this at the initiation stage?

  1. Delegating all compliance decisions to an external consultant
  2. Approving the compliance policy and assigning clear roles and responsibilities Correct answer.
  3. Distributing the standard's text to staff without further direction
  4. Waiting for the first internal audit before engaging with compliance

Explanation

ISO 37301 requires top management to establish the compliance policy and ensure responsibilities and authorities are assigned. Delegating everything or waiting for audit results does not demonstrate active leadership. Simply distributing the standard does not constitute direction or commitment.

Question 34Initiation of a CMS implementation

A newly appointed compliance manager is defining the compliance function's mandate. Which ISO 37301 concept describes the authority to operate the CMS independently of operational pressures?

  1. Compliance function independence and authority Correct answer.
  2. Compliance obligation register
  3. Compliance performance evaluation
  4. Compliance culture

Explanation

ISO 37301 addresses the compliance function's independence and authority so it can act objectively. Culture, performance evaluation, and obligation registers are related concepts but do not describe the mandate and autonomy of the function itself.

Question 35Initiation of a CMS implementation

During initiation, a team builds a register of laws, regulations, and contractual requirements applicable to its operations. What is this register called in ISO 37301?

  1. Compliance obligations register Correct answer.
  2. Nonconformity log
  3. Compliance maturity matrix
  4. Risk treatment plan

Explanation

The compliance obligations register records the requirements the organization must comply with, together with related information. Risk treatment plans address risks, nonconformity logs track failures, and maturity matrices assess capability, so none of these fits the described artifact.

Question 36Initiation of a CMS implementation

An organization wants to assess where non-compliance could arise before designing controls. Which ISO 37301 activity should it perform during initiation?

  1. Certification audit
  2. Management review
  3. Compliance risk assessment Correct answer.
  4. Compliance training delivery

Explanation

Compliance risk assessment identifies, analyzes, and evaluates risks of non-compliance so controls can be designed proportionately. Training, management review, and certification audits are later activities that depend on the risk picture already being understood.

Question 37Initiation of a CMS implementation

A board asks why the CMS scope statement matters so much at the start. Which answer best reflects ISO 37301?

  1. It lists every employee by name who must comply
  2. It replaces the need for a compliance policy
  3. It defines the boundaries within which compliance obligations and risks are managed Correct answer.
  4. It guarantees certification once published

Explanation

The scope statement establishes the organizational and functional boundaries to which the CMS applies, guiding which obligations and risks are managed. It does not guarantee certification, substitute for policy, or enumerate individuals.

Question 38Initiation of a CMS implementation

Which output is most appropriately produced when an organization first identifies its compliance obligations?

  1. A final certification decision
  2. An annual financial statement
  3. A documented register linking each obligation to its source and responsible owner Correct answer.
  4. A list of employee performance ratings

Explanation

Identifying obligations should result in a documented register that records the requirement, its source, and accountability. Certification decisions, financial statements, and performance ratings are unrelated to obligation identification.

Question 39Initiation of a CMS implementation

A company's context analysis reveals new sector regulation. How should this finding feed into the CMS initiation?

  1. It should be added directly to the compliance policy without assessment
  2. It should be ignored until the next certification cycle
  3. It should be handled only by the legal department outside the CMS
  4. It should be evaluated as a compliance obligation and considered in the risk assessment Correct answer.

Explanation

Changes in the context, including new regulation, must be translated into compliance obligations and assessed for risk so the CMS remains current. Ignoring it, handling it outside the CMS, or skipping assessment undermines the system's effectiveness.

Question 40Initiation of a CMS implementation

Which statement best describes the role of governance in initiating a CMS?

  1. Governance bodies set direction, approve the framework, and oversee its effectiveness Correct answer.
  2. Governance bodies only review results after certification
  3. Governance bodies perform all compliance risk assessments personally
  4. Governance bodies replace the compliance function entirely

Explanation

Governance provides direction, approves the compliance framework, and oversees effectiveness, while operational work is delegated to the compliance function. Governance does not conduct every assessment, replace the function, or limit itself to post-certification review.

Question 41Initiation of a CMS implementation

A compliance manager is planning resources at the start of implementation. Which combination is most aligned with ISO 37301's resource requirements?

  1. Competent people, adequate infrastructure, and appropriate technology and budget Correct answer.
  2. Only a policy document and a signed declaration
  3. External legal counsel alone with no internal capability
  4. A single part-time volunteer with no defined authority

Explanation

ISO 37301 requires the organization to determine and provide the resources needed for the CMS, including competent personnel, infrastructure, and technology. A document alone, sole reliance on external counsel, or an unsupported volunteer does not satisfy the resource requirement.

Question 42Initiation of a CMS implementation

When first establishing the CMS, what is the most appropriate way to address the organization's compliance culture?

  1. Delay culture work until after the first external audit
  2. Outsource culture change entirely to the compliance department
  3. Assess the current culture and plan leadership-driven actions to strengthen it Correct answer.
  4. Assume culture will develop automatically once a policy exists

Explanation

ISO 37301 treats compliance culture as something to be actively promoted, starting with an assessment and leadership-driven actions. Assuming automatic development, isolating the work, or postponing it weakens the CMS foundation.

Question 43Initiation of a CMS implementation

Which document typically expresses top management's commitment and the organization's compliance objectives at the highest level?

  1. The training attendance sheet
  2. The nonconformity register
  3. The compliance policy Correct answer.
  4. The internal audit report

Explanation

The compliance policy is the top-level statement of commitment, direction, and objectives established by top management. Audit reports, nonconformity registers, and attendance sheets are operational records, not policy-level commitments.

Question 44Initiation of a CMS implementation

An organization is determining which interested parties' requirements become compliance obligations. What is the key criterion in ISO 37301?

  1. Whether the party has previously requested information
  2. Whether the requirement is mandatory for the organization to comply with Correct answer.
  3. Whether the party is a competitor
  4. Whether the party is located in the same country

Explanation

Compliance obligations are requirements the organization must comply with, whether legal, regulatory, or self-imposed. Competitor status, location, or prior information requests do not determine whether a requirement becomes an obligation.

Question 45Initiation of a CMS implementation

During initiation, a company decides to integrate its CMS with existing quality and information security management systems. What is the primary benefit emphasized by ISO 37301?

  1. Automatic certification across all management systems
  2. Elimination of the need for compliance risk assessment
  3. Removal of the compliance function's independence
  4. A more coherent and efficient use of shared processes and resources Correct answer.

Explanation

ISO 37301 encourages alignment with other management systems through its harmonized structure, enabling shared processes and efficient resource use. Integration does not confer automatic certification, remove risk assessment, or compromise independence.

Question 46Initiation of a CMS implementation

At the outset, a compliance officer must decide how to communicate the new CMS internally. Which approach best reflects ISO 37301 expectations?

  1. Plan what, when, how, and to whom compliance information is communicated Correct answer.
  2. Communicate only after a non-compliance incident occurs
  3. Restrict all CMS information to the board
  4. Rely solely on informal conversations

Explanation

ISO 37301 expects a planned approach to internal and external communication, covering content, timing, method, and audience. Reactive, overly restricted, or purely informal communication does not meet that expectation.

Question 47Initiation of a CMS implementation

Which factor most strongly suggests that a compliance function has been properly positioned at initiation?

  1. It is staffed entirely by temporary contractors with no oversight
  2. It reports to the same manager who owns the highest-risk business unit
  3. It reports at a level where it can influence decisions and act without undue operational pressure Correct answer.
  4. It has no documented responsibilities

Explanation

Independence and authority require positioning the function where it can influence decisions and operate free from undue pressure. Reporting into the highest-risk business unit, lacking documented responsibilities, or relying on unsupervised contractors undermines that positioning.

Question 48Initiation of a CMS implementation

A company's initial risk assessment identifies bribery as a high compliance risk. What is the most appropriate next step in the initiation phase?

  1. Remove bribery from the scope of the CMS
  2. Define proportionate controls and assign owners to treat the risk Correct answer.
  3. Immediately seek certification without further action
  4. Wait for an incident to confirm the risk exists

Explanation

Once a compliance risk is assessed as high, the organization should design proportionate treatment and assign accountability. Seeking certification prematurely, excluding the risk, or waiting for an incident all contradict a risk-based approach.

Question 49Initiation of a CMS implementation

An organization operating in multiple jurisdictions must reconcile conflicting legal requirements during CMS initiation. What is the soundest approach under ISO 37301?

  1. Identify each obligation and adopt the most stringent applicable requirement where conflicts arise Correct answer.
  2. Apply only the least demanding jurisdiction's rules everywhere
  3. Ignore conflicts and let local managers decide informally
  4. Adopt a single global policy without referencing local law

Explanation

A robust CMS identifies obligations across all jurisdictions and, where requirements conflict, generally applies the more stringent standard to remain compliant everywhere. Choosing the weakest rule, leaving decisions informal, or ignoring local law creates compliance gaps.

Question 50Initiation of a CMS implementation

What distinguishes the initiation of a CMS from its ongoing operation?

  1. Initiation removes the need for monitoring, which operation reintroduces
  2. Initiation performs certification audits, while operation writes the policy
  3. Initiation establishes context, scope, policy, and risk baseline, while operation executes controls and monitors performance Correct answer.
  4. Initiation is optional, while operation is mandatory

Explanation

Initiation lays the foundation through context analysis, scope definition, policy, and risk assessment, whereas operation executes the designed controls and monitors performance. Certification audits, policy drafting, and monitoring are not correctly assigned by the other options.