Continual Improvement of a CMS Based on ISO 37301
This domain tests clauses 10.1 and 10.2, and the maturity mindset behind them.
Nonconformity and corrective action (10.1)
When a nonconformity occurs: react (contain and correct the immediate problem), evaluate the need to eliminate the cause, determine the root cause, implement the action, review its effectiveness, and update the compliance risk assessment if risks have changed. The nature of nonconformities and the results of any action are retained as documented information.
Continual improvement (10.2)
The organization continually improves the suitability, adequacy and effectiveness of the CMS. Improvement is not only failure repair - sources include audit themes, near-misses, culture surveys, benchmarking, technology change, new regulation, and lessons from other organizations' enforcement actions.
Worked example
Two gift-register breaches occur in a sales team. Containment: gifts declined and recorded. Root cause analysis (5 Whys) shows the approval workflow lives in email, so approvals are invisible. Action: system-based approval with automatic escalation plus a monthly exception report. Effectiveness is verified three months later by sampling - no unapproved hospitality recorded, all exceptions escalated. The compliance risk score for that process is then re-scored downward, and other manual workflows are reviewed for the same defect.
Traps
Closing a nonconformity with "retrain staff" without root cause analysis. Not verifying effectiveness, so the same issue recurs. Treating improvement as advice-only without updating the risk assessment or register. Missing the link back to 6.1 - improvement findings should feed the next planning cycle, not sit in a separate log.