Monitoring and Measurement of a CMS Based on ISO 37301
This domain tests clause 9 - how you know the CMS works and how you prove it to an auditor or the board.
Monitoring, measurement, analysis and evaluation (9.1)
The organization determines what needs monitoring, the methods used, when monitoring and measurement occur, and when results are analysed and evaluated. Strong programmes mix lagging indicators (incidents, breaches, fines, complaints) with leading indicators (control-testing results, training effectiveness scores, overdue obligations, third-party reviews completed, regulatory-change turnaround). Sources include hotline data, audit findings, testing, complaints, regulator correspondence and horizon scanning.
Internal audit (9.2)
A risk-based audit programme with frequency, methods, responsibilities, criteria and reporting defined. Auditors must be objective and impartial - the compliance function should not audit its own work. Results are reported to relevant management and to the governing body.
Management review (9.3)
Top management reviews the CMS at planned intervals. Inputs include status of previous actions, changes in context and obligations, performance against objectives, nonconformities and corrective actions, audit results and stakeholder feedback. Outputs are decisions on improvement and on changes needed.
Worked example
A bank reports zero compliance incidents for four quarters - a lagging measure only. The review adds control testing: spot checks find 12% of advisory files lack a documented suitability check. Both datasets go to management review, which decides to add a second-line review. Without the leading indicator, an undetected failure would have gone unreported.
Traps
Reporting only incident counts. Audit programmes that cover clauses 4–7 but never clause 8. Management reviews minuted as a slide deck with no decisions or owners. Failing to check whether the monitoring methods themselves still yield valid information.