Implementation of a CMS Based on ISO 37301
This domain tests clauses 7 and 8 - whether the plan actually operates and whether you can evidence it.
Support (clause 7)
- Resources determined and provided for the CMS.
- Competence - determine what competence is needed for roles affecting compliance, ensure people are competent, act to acquire competence, and evaluate the effectiveness of that action. A training-completion percentage is not evidence of competence.
- Awareness - people know the compliance policy, their contribution to the CMS's effectiveness, and the implications of not complying.
- Communication - internal and external, defining what, when, with whom and how, including how concerns are raised.
- Documented information - created, updated and controlled for availability, protection, retention and version.
Operation (clause 8)
Operational planning and control means setting criteria for processes, controlling them against those criteria, controlling outsourced processes and managing planned changes. In practice: due diligence on third parties proportionate to risk, with contractual compliance clauses and audit rights; confidential channels for raising concerns; and a documented investigation process with independence, records and remediation.
Worked example
A logistics company requires anti-bribery training; completion is 98%, yet a bribery incident occurs in a high-risk country. The finding: the training covered policy text but not the gifts-and-hospitality scenarios those staff actually face, and competence was never evaluated - only attendance was. Corrective action is scenario-based assessment for high-risk roles plus a register of hospitality approvals.
Traps
Equating training delivery with competence. Speak-up channels employees do not trust, or where retaliation is unaddressed. Ignoring third parties, who are a frequent source of compliance failure. Uncontrolled documented information, so the auditor sees three "current" policies.