Fundamental Principles and Concepts of a Compliance Management System
This domain tests whether you can use ISO 37301's vocabulary precisely and explain why the standard is shaped as it is. Most lost marks come from imprecise definitions rather than from unknown clauses.
The four definitions everything else hangs on
- Compliance - fulfilling all of the organization's compliance obligations. It is an outcome, not a department.
- Compliance obligations - requirements the organization has to comply with (laws, regulations, permits, regulatory decisions) plus those it chooses to comply with (contracts, customer commitments, industry codes, voluntary standards, publicly accepted expectations).
- Compliance risk - the likelihood of non-compliance and its consequences; always likelihood combined with impact, never a list of statutes.
- Compliance management system (CMS) - interrelated elements (policy, objectives, processes, roles, records, culture) used to direct and control the organization with respect to compliance.
Principles carried into every clause
Proportionality (controls matched to risk and size), transparency, good governance, sustainability, a risk-based approach, and the Plan–Do–Check–Act cycle. Accountability rests with the governing body and top management; the compliance function supports and challenges, it does not absorb accountability.
Worked example
A software firm signs a contract promising EU-only data hosting. Is that a compliance obligation? Yes - it was voluntary, but once accepted it binds exactly like a statute. The register records the clause, the contract owner and the affected process. The compliance risk is different: the likelihood and impact of data being hosted outside the EU (say, a misconfigured backup), scored against the firm's documented risk criteria.
Traps
Treating compliance as legal-only. Listing laws as "risks" without likelihood or impact scoring. Assuming ISO 19600:2014 and ISO 37301:2021 are interchangeable - 19600 was guidance, 37301 contains requirements and is certifiable. Saying the Compliance Officer is "accountable for compliance".