Scope, normative references and terms of ISO 37000
Domain focus
This domain tests whether you can state what ISO 37000:2021 covers, what it does not cover, and use its vocabulary precisely. ISO 37000 is guidance on the governance of organizations. It is not a management system standard, contains no certification requirements and has no normative references. It applies to organizations of all sizes, sectors and legal forms.
Core rules and terms
- Governance is the system by which the whole organization is directed, controlled and held to account; it is broader than management.
- The governing body is the person or group accountable for governance; it may be a board, council, trustee body or equivalent, not necessarily called a board.
- A stakeholder is a person or group that can affect, be affected by, or perceive itself to be affected by the organization’s decisions or activities.
- A governance framework is the arrangement of policies, processes, roles, decision rights and information flows used to govern. Do not treat guidance verbs such as should as auditable shall requirements.
Worked example
A candidate is asked whether an organization can be ISO 37000 certified. Reasoning: ISO 37000 provides guidance, not requirements; conformity certification is not part of its scope. The correct answer is no-an organization may use it to evaluate and improve governance, but certification claims are not supported by the standard itself.
Traps
Confusing ISO 37000 with ISO/IEC 38500 on IT governance, or with certifiable management system standards; assuming the governing body is always a listed-company board; inventing normative references; treating governing body and CEO as interchangeable.