PECB ISO 37301 Foundation key terms

The state of meeting an organization's obligations, which arise from mandatory requirements such as laws and regulations and from voluntary commitments such as contracts, policies, and standards.

A structured set of interrelated policies, processes, roles, and controls an organization uses to direct, monitor, and improve its compliance with obligations across the whole organization.

A requirement the organization must satisfy, including legal and regulatory requirements and other requirements it has agreed to, such as contractual, industry, or self-imposed commitments.

The effect of uncertainty on compliance objectives, typically expressed as the likelihood and consequences of failing to meet an obligation, including legal, financial, and reputational harm.

The shared values, attitudes, and behaviors across an organization that make meeting obligations a normal expectation, supported visibly by leaders and reinforced through incentives and everyday practice.

The signals leaders send through their own conduct, decisions, and communications, which shape whether employees treat compliance as a genuine priority or a formality.

The person or group with ultimate authority and accountability for the organization's strategy and oversight, responsible for ensuring the compliance management system is established and effective.

The person or group that directs and controls the organization at the highest level, responsible for integrating compliance into business processes and providing resources and leadership.

The role or team responsible for operating and coordinating the compliance management system day to day, including advice, monitoring, and reporting, while remaining independent of operational decision-making.

The individual accountable for leading the compliance function, with authority to raise concerns, access the governing body, and coordinate compliance activities across the organization.

A way of allocating assurance work: operational management owns and manages risk, a compliance or risk function supports and monitors, and internal audit provides independent assurance.

The internal and external factors, including legal, regulatory, market, cultural, and organizational issues, that affect the organization's ability to achieve its compliance objectives.

A person or organization that can affect, be affected by, or perceive itself to be affected by the organization's compliance performance, such as regulators, customers, employees, and owners.

The documented boundaries of the compliance management system, stating which functions, locations, activities, and obligations it covers and why excluded areas are not included.

A top-level statement of the organization's commitment to comply with its obligations, providing a framework for setting compliance objectives and defining principles for acceptable behavior.

A measurable result the organization intends to achieve to improve compliance, set at relevant levels and functions and consistent with the compliance policy.

The documented assignment of who does what in the compliance management system, ensuring every relevant activity has an owner with sufficient authority to act.

Prioritizing compliance effort and controls according to the likelihood and impact of non-compliance, so that scarce resources focus on the obligations that matter most.

A structured process of identifying, analyzing, and evaluating compliance risks, then deciding whether and how to treat them, repeated periodically and when circumstances change.

Investigation and evaluation carried out before and during a relationship with a third party, to confirm that the party's conduct and obligations align with the organization's compliance expectations.

An external individual or organization whose actions can create compliance risk for the organization, including suppliers, agents, distributors, consultants, and joint venture partners.

The people, competence, awareness, communication, and documented information the organization provides so the compliance management system can operate as designed.

The combination of education, training, and experience needed for a person to perform compliance-related tasks effectively, verified and recorded where it affects compliance performance.

Employees' understanding of the compliance policy, their own contribution to the system's effectiveness, and the implications of failing to meet obligations.

Planned learning activities that build the knowledge and skills employees and third parties need to recognize compliance risks and act in line with the organization's obligations.

The planned internal and external exchange of compliance information, covering what is communicated, when, by whom, and to whom, so expectations and concerns flow in both directions.

Information the organization must control and maintain, including policies, procedures, records, and evidence of results, kept available and protected as the standard requires.

Planning and running processes so compliance requirements are met in practice, using criteria, controls, and management of outsourced processes to prevent deviation.

A measure that modifies compliance risk, such as an approval step, segregation of duties, monitoring activity, or automated check, chosen according to the assessed risk.

A channel and culture that let employees and others report suspected misconduct or compliance concerns without fear of retaliation, supported by protection for good-faith reporters.

The act of reporting wrongdoing or a compliance concern, internally or to an external authority, typically protected by law and by the organization's non-retaliation commitments.

A failure to meet a requirement of the compliance management system or an applicable obligation, which must be identified, corrected, and analyzed for its underlying cause.

Action taken to eliminate the cause of a nonconformity so it does not recur, including investigating why it happened and checking that the action worked.

Ongoing activities that determine what compliance performance is measured, how and when it is measured, and how results are analyzed to show whether the system works.

An independent, systematic review of whether the compliance management system conforms to the organization's own requirements and the standard, and whether it is effectively implemented.

A periodic top-management examination of the compliance management system's suitability, adequacy, and effectiveness, producing decisions on improvement and resource needs.

The combined use of monitoring, measurement, internal audit, and management review to judge whether the compliance management system is achieving its intended outcomes.

The ongoing process of enhancing compliance performance and the management system itself, driven by evaluation results, nonconformities, and changes in the organization's context.

Rules defining how long compliance evidence such as reports, training logs, and investigation files are kept, and how they are stored, protected, and disposed of.