ISO 37301 LI study plan

Map the ISO 37301 clause structure (4-10 plus Annex A) from memory on a one-page diagram, labelling each clause with its PDCA phase.

Distinguish compliance risk from compliance obligation, compliance culture, and compliance function by writing definitions plus one contrasting example for each.

Explain the difference between ISO 37301 and ISO 37001/ISO 19600 lineage without consulting notes, listing three practical consequences for a CMS design.

Identify the inputs, outputs, and decision points of the CMS initiation phase, including scope triggers and leadership sponsorship.

Draft five exam-style multiple-choice items on fundamental principles and self-score them against the standard text.

Analyse an organisation's internal and external context using a PESTLE-plus-stakeholder grid, then derive at least six compliance-relevant issues.

Identify interested parties and classify their compliance requirements and expectations into mandatory, contractual, and voluntary categories.

Determine an appropriate CMS scope for a fictional mid-size manufacturer, justifying inclusions and exclusions against clause 4 requirements.

Assess leadership commitment evidence by writing a checklist of observable behaviours a certification auditor would accept.

Produce a gap-analysis questionnaire of at least 25 questions covering clauses 4 and 5.

Derive compliance obligations from at least three regulatory regimes and record source, owner, and review frequency for each.

Build a compliance risk assessment using likelihood and consequence scales, scoring at least eight risks and ranking them.

Write two compliance objectives that are measurable, time-bound, and traceable to identified risks.

Draft a compliance policy outline that satisfies clause 5.2 content expectations and links to objectives.

Explain how planning actions are integrated into business processes rather than kept as a standalone document.

Design a three-lines-of-defence model for a fictional organisation and assign compliance responsibilities to each line.

Specify competence, training, and awareness requirements for at least four role families, including evidence of effectiveness.

Draft a documented information control procedure covering creation, approval, versioning, retention, and access.

Describe how compliance concerns are raised, escalated, and protected under a speak-up mechanism, including retaliation safeguards.

Distinguish controls that are preventive, detective, and corrective, and assign each type to at least three identified risks.

Build a monitoring plan that defines what is measured, the method, frequency, threshold, and responsible owner for at least ten indicators.

Differentiate compliance performance indicators from compliance risk indicators and give three examples of each.

Design an internal audit programme for the CMS covering scope, criteria, auditor competence, and reporting line.

Explain how root cause analysis feeds management review, using one worked example from a simulated finding.

Draft a management review agenda and the minimum input and output set required by the standard.

Analyse a set of simulated nonconformities and classify each as minor, major, or observation with justification.

Write corrective action records that address containment, root cause, corrective action, and effectiveness verification.

Describe how continual improvement is evidenced over time, including trend analysis and maturity progression.

Evaluate when a compliance failure requires CMS change versus process-level correction, using two contrasting scenarios.

Produce a lessons-learned loop that feeds back into risk assessment and obligation updates.

Explain the certification audit sequence from application and Stage 1 to Stage 2, surveillance, and recertification.

Prepare a documentation readiness checklist mapping required documented information to clause references.

Anticipate at least ten likely auditor interview questions and draft concise, evidence-backed answers.

Identify common causes of Stage 1 failure and the corrective steps an organisation can take before Stage 2.

Describe the auditor's sampling logic and how to present objective evidence efficiently.

Complete two full timed practice exams of 60 questions each, scoring at least 80 percent on both.

Re-teach the three weakest domains from memory using a blank page, then verify against the standard.

Consolidate a one-page formula and definition sheet covering risk scoring, audit types, and corrective action steps.

Review every missed item and record the underlying concept gap rather than the answer.

Simulate a 30-minute verbal walkthrough of a full CMS implementation as if presenting to a certification lead auditor.