Fundamental Concepts and Principles of Corporate Governance (ISO 37000)
This domain tests whether you can define governance in ISO 37000:2021 terms, distinguish it from management, and apply the standard's principles as an integrated set rather than a checklist.
What governance is
ISO 37000 describes governance of organizations as the system by which the whole organization is directed, controlled and held to account. It sits with the governing body - the person or group accountable for the organization's purpose and for its governance - and is deliberately separated from management, which executes within delegated authority. The standard is guidance applicable to any organization, public, private or not-for-profit, whatever its size.
The principles are a set, not a menu
Eleven principles frame the standard: purpose, value generation, strategy, oversight, accountability, engagement, leadership, data and decisions, risk governance, social responsibility and ethical behaviour. Purpose anchors the rest; value generation is broader than financial return; engagement covers stakeholders, not only shareholders; data and decisions addresses the quality of information behind choices. They interlock, so selective adoption fails.
Worked example
A founder-CEO runs the company with a board of personal acquaintances, no reserved-matters schedule, and financial reports prepared only for the bank. Diagnostic: purpose is not articulated for stakeholders (purpose, engagement); the board ratifies rather than challenges (oversight); accountability is diffuse; value is measured only financially (value generation). Remedies: a documented purpose statement, one genuinely independent director, a written reserved-matters list, a stakeholder map, and non-financial value measures reviewed each quarter. The reasoning is principle-led diagnosis, not a compliance audit.
Traps that cost marks
- Assuming ISO 37000 is certifiable - it contains guidance and recommendations, not auditable requirements.
- Equating governance with board paperwork instead of a whole-organization system.
- Quoting one principle as sufficient, ignoring interactions (e.g. strong oversight with no purpose is empty control).
- Confusing the governing body's accountability with management's operational responsibility.