Initiation of a CMS Implementation
This domain tests how a CMS gets started: mandate, context, scope and baseline. Examiners look for sequence - context and scope before documentation.
Sequence of initiation
- Mandate - top management or the governing body formally authorises the programme, names a sponsor, and approves resources and a charter.
- Context (4.1) - external and internal issues: regulatory environment, sector regulators, jurisdictions, business model, structure, culture, existing incidents.
- Interested parties (4.2) - regulators, customers, employees and their representatives, shareholders, NGOs, business partners; capture relevant requirements and expectations.
- Scope (4.3) - functions, legal entities, locations and processes covered; interfaces with other management systems; justification for anything excluded.
- Baseline gap analysis - assess current arrangements against clauses 4–10, record evidence, rate maturity, and convert gaps into the implementation plan.
- Governance - steering committee, workstream owners, budget, milestones and a reporting line to the governing body.
Worked example
A group operating in three countries wants a scope covering head office only. The gap analysis shows its highest-risk activity - distributor onboarding - sits in a subsidiary. Excluding it makes the scope misleading and the certification body will challenge it. The correct move is to include the subsidiary, or to document the interfaces and controls that cover the excluded activity.
Traps
Writing policies before understanding context. Choosing a scope that conveniently excludes problem areas - the scope must be maintained as documented information and be defensible. Confusing the gap analysis with an internal audit (one designs, the other provides assurance). Leaving initiation to the legal team with no board-level sponsor or budget.