ISO 37000 Lead CG Manager common mistakes
ISO 37000 Lead CG Manager · Understand the traps and how to avoid them.
Treating ISO 37000 as a certifiable management system standard and answering questions as if it prescribes audit, certification, or a clause-by-clause 'shall' structure like ISO 37001 or ISO 37301.
Candidates transfer habits from certifiable ISO management system standards they have implemented, and the word 'ISO' triggers that pattern; ISO 37000 is guidance on the governance of organizations, not a requirements standard for certification.
What to do instead
Memorize the distinction explicitly: ISO 37000 gives principles and guidance for governing bodies, while ISO 37301 (compliance) and ISO 37001 (anti-bribery) are certifiable requirements standards. For every question, ask 'is this asking what a governing body should do, or what a management system must contain?' and answer from the guidance perspective unless the stem names a certifiable standard.
Confusing the governing body with executive management, so answers assign oversight duties (setting purpose, values, strategy approval, holding management to account) to the CEO or to management committees.
In day-to-day practice the same people often discuss strategy and operations in one room, and candidates from executive roles default to 'who actually does the work' rather than 'who is accountable for oversight'.
What to do instead
For each scenario, draw two boxes: governing body and management. Place purpose, values, strategy direction, oversight, accountability, and stakeholder identification in the first box; place implementation, execution, and reporting upward in the second. Re-read the stem for words like 'accountable', 'approve', and 'oversee' versus 'implement' and 'deliver'.
Listing governance principles from memory as a loose set of buzzwords (transparency, ethics, fairness) without connecting each to the specific outcome it is meant to produce, so answers miss the principle the question is testing.
Candidates memorize labels but not the purpose-outcome logic behind each principle, and many governance words overlap in everyday usage, making them interchangeable in the candidate's mind.
What to do instead
Build a one-line card per principle: principle name, the behaviour it requires of the governing body, and the outcome it enables. When a scenario describes a symptom (for example, stakeholders surprised by a decision), work backwards from the symptom to the principle whose outcome is missing rather than forward from a keyword.
Describing a governance framework as an org chart plus a policy manual, omitting the elements that make it a system: delegated authority, decision rights, information flows, and the interaction between structures.
Org charts and policy lists are the visible artefacts candidates see at work, while authority matrices and reporting lines are less visible and rarely documented in the materials people actually read.
What to do instead
When asked to design or evaluate a framework, always cover four layers: structures (boards, committees), processes (how decisions are made and escalated), authority (who decides what, and limits), and information (what flows to whom and when). Check that your answer names at least one artefact for each layer.
Designing governance structures that mirror a textbook model (for example, a full committee set) without tailoring them to the organization's size, ownership, complexity, and risk profile described in the scenario.
Candidates study idealized models and assume a complete committee structure is always the 'correct' answer, and exam scenarios often bury the tailoring cues in a single sentence about size or ownership.
What to do instead
Before answering design questions, extract the scenario facts: size, sector, ownership, regulatory context, complexity. Then justify each structural element by reference to a specific fact, and explicitly state what you would not create and why. Answers that name a proportionality rationale score better than lists of committees.
Ignoring decision quality mechanisms in favour of decision outcomes, so answers focus on whether a decision was good rather than whether the process, information, conflicts, and challenge were sound.
Hindsight bias makes people judge governance by results, and case discussions in training often reward 'the right call' rather than 'the right process'.
What to do instead
For any decision scenario, evaluate the process: was authority clear, was information sufficient and independent, were conflicts declared and managed, was there constructive challenge, and was the decision recorded with rationale. Practice writing answers that assess these five points even when the outcome described was favourable.
Treating the three lines model and assurance providers as interchangeable, so internal audit is described as owning risk management or the board is described as performing assurance itself.
Titles vary across organizations and candidates conflate 'oversight', 'management control', and 'independent assurance' because the same words appear in job descriptions.
What to do instead
Fix the roles: management owns and manages risk (first line), a risk or compliance function supports and monitors (second line), internal audit provides independent assurance (third line), and the governing body oversees all of it and relies on assurance rather than producing it. In every answer, name who owns, who monitors, who assures, and who oversees.
Answering stakeholder questions with a generic 'engage stakeholders' statement instead of identifying material stakeholders, their legitimate interests, and the mechanism and escalation route for engagement.
Stakeholder engagement is often reduced in practice to communications and PR, so candidates default to messaging language when the question is about governance accountability.
What to do instead
Use a fixed sequence: identify stakeholders and their legitimacy and influence, determine materiality of their interests, define the engagement channel and frequency, define how input reaches the governing body, and define how the governing body reports back. Include at least one example of a conflict between stakeholder interests and how the governing body would resolve it.
Treating reporting as a compliance output (publish the annual report) rather than as evidence that governance is working, so answers omit the link between reported information, the decisions it informs, and its reliability.
In many organizations reporting is owned by finance or communications and is seen as a year-end deliverable, so candidates never learn to evaluate its governance purpose.
What to do instead
For reporting questions, answer three things: what the governing body needs to know to discharge its duties, how the reliability of that information is assured, and how reported outcomes feed back into strategy and oversight. Distinguish internal decision-useful reporting from external accountability reporting and say which the question is about.
Describing continual improvement as 'review annually and update policies' without a measurable loop: no performance indicators, no evaluation criteria, no corrective action, and no verification that the change took effect.
Annual review cycles are the most common real-world practice, so candidates reproduce them and never practise the full improve-measure-verify loop that exam questions probe.
What to do instead
Use a four-step template for every improvement question: define governance performance measures, evaluate against them at a defined cadence, assign corrective action with an owner and date, and verify effectiveness at the next cycle. Add how the governing body itself is evaluated, since self-evaluation of the board is frequently the missing element in candidate answers.