PECB ISO 37301 Foundation flashcards
PECB ISO 37301 Foundation · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- ISO 37301 type
- A Type A management system standard containing auditable requirements, so an organization can be certified against it; ISO 19600 was only guidance and could not be certified.
- Compliance definition
- Meeting all of the organization's compliance obligations; obligations include mandatory legal and regulatory requirements and voluntary commitments such as standards, contracts and codes.
- Compliance obligation
- A requirement that the organization must comply with, or one it voluntarily chooses to comply with, such as laws, regulations, contracts, industry standards or its own commitments.
- Compliance management system
- A set of interrelated elements used to direct, operate and control compliance across the organization, built on the Plan-Do-Check-Act continual improvement cycle.
- Plan-Do-Check-Act
- The improvement cycle underlying the CMS: establish objectives and processes, implement them, monitor and measure results against policy, then take actions to improve.
- Risk-based compliance
- Allocating controls and effort according to assessed likelihood and impact of non-compliance, so higher-risk obligations receive proportionally stronger treatment.
- Compliance culture elements
- Seven elements: governance, proportionality, transparency, sustainability, accountability, responsibility and ethical behaviour, all driven and modelled by top management.
- Compliance function independence
- The compliance function has separate authority and reporting lines, direct access to top management, and is not subordinated to the functions it monitors.
- Prevention detection response
- The three pillars of compliance work: preventing breaches through policies and training, detecting them through monitoring, and responding through investigation and corrective action.
- Proportionality principle
- The CMS is designed to be proportionate to the organization's size, structure, sector, nature and complexity of its compliance risks, not a one-size template.
- External and internal issues
- Clause 4 requires identifying issues from the organization's context, such as legal, regulatory, market, social and internal cultural factors, that affect compliance outcomes.
- Interested parties
- Clause 4 requires determining relevant interested parties and their relevant requirements, then deciding which of those become compliance obligations for the CMS.
- CMS scope
- The documented boundaries and applicability of the compliance management system, stating the organization, functions, locations and obligations it covers.
- Top management leadership
- Clause 5 requires top management to demonstrate leadership by establishing policy, ensuring resources, assigning responsibilities, and promoting a compliance culture.
- Compliance policy
- A documented statement, established by top management, that is appropriate to purpose and context and includes commitments to meet obligations and to continual improvement.
- Compliance objectives
- Measurable targets set at relevant functions and levels, consistent with the compliance policy, with plans for what will be done, by whom, when and how evaluated.
- Compliance risk assessment
- A Clause 6 process that identifies, analyses and evaluates compliance risks so that controls and objectives can be planned and prioritized.
- Compliance obligations register
- A maintained record of the organization's compliance obligations, their sources, owners and related controls, used as the basis for monitoring and evaluation.
- Competence requirement
- Clause 7 requires determining necessary competence, ensuring persons are competent through education, training or experience, and retaining documented evidence.
- Awareness Clause 7.3
- Persons doing work under the organization's control must be aware of the compliance policy, their contribution to CMS effectiveness, and implications of non-compliance.
- Communication Clause 7.4
- The organization determines what, when, with whom and how to communicate about the CMS, including internal and external reporting of compliance matters.
- Documented information
- Information the organization must control and maintain, including the compliance policy, obligations register, risk assessments, training records and audit evidence.
- Operational controls
- Clause 8 requires processes and controls that meet compliance obligations, including controls over externally provided processes, products and services.
- Raise concern mechanism
- A confidential channel enabling personnel and others to report suspected or actual non-compliance without fear of retaliation, supporting detection and improvement.
- Monitoring and measurement
- Clause 9 requires determining what to monitor, methods, timing, who analyses results, and evaluation of compliance performance and CMS effectiveness.
- Internal audit
- A planned, objective evaluation of whether the CMS conforms to the organization's own requirements and ISO 37301, and is effectively implemented and maintained.
- Management review
- A planned top-management review of CMS status and performance, using defined inputs such as audit results and risk changes, producing decisions on improvement and resources.
- Nonconformity
- Failure to meet a requirement; the organization reacts, evaluates the need to eliminate the cause, implements corrective action and reviews its effectiveness.
- Corrective action
- Action taken to eliminate the cause of a nonconformity so it does not recur, with the results recorded and compliance risks updated accordingly.
- Continual improvement
- Clause 10 requires the organization to continually improve the suitability, adequacy and effectiveness of the compliance management system.
- Compliance performance indicators
- Measurable metrics established to evaluate compliance performance, such as training completion, incident closure rates, audit findings and reporting channel usage.
- Third-party compliance controls
- Controls applied to outsourced and externally provided processes so that the organization's compliance obligations remain met when work is performed by others.