I85PREP
⌘ K
PECB ISO 37301 Foundation study materials
PECB ISO 37301 Foundation study resources

PECB ISO 37301 Foundation practice questions

One question at a time. Build your PECB ISO 37301 Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of compliance and the CMS based on ISO 37301

In ISO 37301, what does the term "compliance management system" (CMS) primarily describe?

  1. A list of legal requirements maintained by the organization's legal department
  2. A structured set of interrelated elements an organization uses to direct and control its compliance obligations Correct answer.
  3. A one-time audit performed by an external certification body
  4. A software platform for tracking regulatory changes

Explanation

ISO 37301 defines a CMS as a set of interrelated or interacting elements used to establish policy and objectives and to achieve those objectives in relation to compliance obligations. It is a management system, not a document list, a tool, or a single audit activity. The elements interact and are subject to continual improvement.

Question 2Fundamental concepts and principles of compliance and the CMS based on ISO 37301

According to ISO 37301, what is the meaning of "compliance obligation"?

  1. A voluntary commitment made by an individual employee
  2. A requirement the organization must comply with Correct answer.
  3. A financial penalty imposed by a regulator
  4. A recommendation published by a standards body

Explanation

The standard defines a compliance obligation as a requirement that an organization has to comply with. Requirements may come from laws, regulations, contracts, or binding commitments the organization adopts. The obligation is the requirement itself, not the consequence of failing it.

Question 3Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best describes the relationship between ISO 37301 and governance in an organization?

  1. Compliance is positioned as a governance responsibility of the organization's governing body Correct answer.
  2. Compliance is delegated entirely to front-line operational staff
  3. Compliance is limited to the finance function
  4. Compliance is optional for public sector entities

Explanation

ISO 37301 places compliance within the organization's governance arrangements, with the governing body accountable for establishing and overseeing compliance. Top management provides leadership and commitment, but the governing body sets the tone at the top. Operational staff implement compliance but do not own it exclusively.

Question 4Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which of the following is a guiding principle behind the design of a compliance management system under ISO 37301?

  1. Compliance should be outsourced entirely to external counsel
  2. Compliance should be integrated into the organization's processes and business practices Correct answer.
  3. Compliance should be reviewed only after a regulatory breach occurs
  4. Compliance should be managed as a standalone activity isolated from operations

Explanation

ISO 37301 emphasizes that compliance is embedded in the organization's processes and business practices rather than treated as a separate activity. Integration supports a compliance culture and helps obligations be identified and managed in daily operations. Reactive review or full outsourcing does not meet the standard's intent.

Question 5Fundamental concepts and principles of compliance and the CMS based on ISO 37301

What is the role of a compliance policy in an ISO 37301 management system?

  1. It is issued only by the legal department without management approval
  2. It establishes the organization's commitment to compliance and provides a framework for setting compliance objectives Correct answer.
  3. It lists every law applicable to the organization in full text
  4. It replaces the need for a compliance risk assessment

Explanation

A compliance policy is established by top management and expresses the organization's commitment to meeting compliance obligations. It provides a framework for setting and reviewing compliance objectives. It does not substitute for risk assessment or reproduce legislation verbatim.

Question 6Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which concept refers to the shared values, beliefs, and behaviors within an organization that support compliance?

  1. Compliance charter
  2. Compliance culture Correct answer.
  3. Compliance audit
  4. Compliance register

Explanation

Compliance culture refers to the shared values, attitudes, and behaviors that encourage compliance with obligations. ISO 37301 treats culture as a key enabler of an effective CMS. Audits, registers, and charters are tools or documents that may support culture but are not the culture itself.

Question 7Fundamental concepts and principles of compliance and the CMS based on ISO 37301

In ISO 37301 terminology, what is a "compliance risk"?

  1. The number of compliance obligations an organization holds
  2. The likelihood that an auditor will find a nonconformity
  3. The effect of uncertainty on compliance objectives Correct answer.
  4. The total cost of regulatory fines in a financial year

Explanation

Compliance risk is the effect of uncertainty on compliance objectives, consistent with the standard's risk-based approach. It is not a count of obligations or a measure of audit findings. Understanding compliance risk helps prioritize controls and resources.

Question 8Fundamental concepts and principles of compliance and the CMS based on ISO 37301

What does the term "interested party" mean in the context of an ISO 37301 CMS?

  1. Only a regulatory authority with enforcement powers
  2. Only an internal employee of the organization
  3. A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity Correct answer.
  4. A supplier who has signed a contract with the organization

Explanation

An interested party is a person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. Interested parties include regulators, customers, employees, and others, not only one category. Identifying them helps the organization understand its compliance context.

Question 9Fundamental concepts and principles of compliance and the CMS based on ISO 37301

An organization is deciding how to structure its CMS. Which approach is most consistent with ISO 37301?

  1. Apply identical controls to every obligation regardless of significance
  2. Defer all compliance decisions until an external audit is scheduled
  3. Focus only on obligations that have previously resulted in penalties
  4. Adopt a risk-based approach that prioritizes obligations with the greatest potential impact Correct answer.

Explanation

ISO 37301 promotes a risk-based approach in which controls and resources are proportionate to the significance of compliance risks. Treating all obligations identically ignores differences in impact and likelihood. Focusing only on past penalties or deferring decisions is reactive and inconsistent with the standard.

Question 10Fundamental concepts and principles of compliance and the CMS based on ISO 37301

A compliance officer is mapping the organization's context before designing the CMS. Which activity best reflects the ISO 37301 requirement to understand the organization and its context?

  1. Recruiting new compliance staff
  2. Selecting the audit software to be used
  3. Identifying external and internal issues relevant to compliance objectives Correct answer.
  4. Drafting the compliance policy before understanding the business environment

Explanation

Understanding the organization and its context involves identifying external and internal issues relevant to the organization's purpose and compliance objectives. This informs the design of the CMS. Policy drafting, tool selection, and staffing come later and should be informed by context analysis.

Question 11Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best explains the difference between compliance and legal compliance in ISO 37301?

  1. Compliance covers only contractual obligations while legal compliance covers regulations
  2. Compliance covers only voluntary commitments while legal compliance covers all obligations
  3. Compliance and legal compliance are identical terms in the standard
  4. Compliance covers all compliance obligations, including voluntary commitments, while legal compliance covers only legal requirements Correct answer.

Explanation

Compliance in ISO 37301 is broader than legal compliance because it covers all compliance obligations, including contractual and voluntary commitments the organization adopts. Legal compliance is limited to legal requirements. The standard uses the broader concept to reflect that organizations face obligations beyond legislation.

Question 12Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Top management wants to demonstrate leadership and commitment to the CMS. Which action best aligns with ISO 37301?

  1. Leaving the compliance policy to be developed by external auditors
  2. Delegating all compliance decisions to junior staff without oversight
  3. Approving the compliance policy only after certification is achieved
  4. Ensuring the compliance policy and objectives are compatible with the organization's strategic direction Correct answer.

Explanation

ISO 37301 expects top management to ensure the compliance policy and objectives are established and compatible with strategic direction. Leadership also includes providing resources and promoting continual improvement. Delegating without oversight or postponing policy approval does not demonstrate commitment.

Question 13Fundamental concepts and principles of compliance and the CMS based on ISO 37301

A company identifies a new data protection regulation applicable to its operations. In ISO 37301 terms, what has the company identified?

  1. A compliance culture
  2. A management review input
  3. A compliance obligation Correct answer.
  4. A nonconformity

Explanation

A new regulation applicable to the organization is a compliance obligation, which the organization must identify, assess, and manage. It is not itself a nonconformity or a culture. It may later become an input to management review, but its primary classification is an obligation.

Question 14Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best describes the principle of "continual improvement" in an ISO 37301 CMS?

  1. The CMS is frozen once certification is obtained
  2. The CMS is enhanced over time to improve compliance performance Correct answer.
  3. Improvement is limited to updating the policy document
  4. Improvement happens only when a regulator issues a fine

Explanation

Continual improvement means the organization enhances its compliance performance over time through monitoring, evaluation, and corrective action. Certification is not an endpoint, and improvement is not limited to document updates. Regulatory penalties may trigger action but are not the basis of the principle.

Question 15Fundamental concepts and principles of compliance and the CMS based on ISO 37301

An organization wants to ensure its CMS reflects the principle of "proportionate" controls. Which action best demonstrates this?

  1. Applying the same control intensity to every obligation in the register
  2. Applying controls only to obligations that are easy to monitor
  3. Reducing controls whenever budgets are constrained
  4. Allocating more rigorous controls to obligations with higher compliance risk Correct answer.

Explanation

Proportionality means controls and resources are matched to the level of compliance risk. Higher-risk obligations warrant more rigorous controls. Uniform intensity ignores risk differences, and reducing controls based on budget or ease of monitoring undermines the risk-based approach.

Question 16Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which of the following best describes the role of the governing body in an ISO 37301 CMS?

  1. It performs every compliance task personally
  2. It delegates all oversight to external auditors
  3. It provides oversight and accountability for the effectiveness of the CMS Correct answer.
  4. It approves only the annual financial statements

Explanation

The governing body provides oversight and holds accountability for the effectiveness of the compliance management system. It does not perform every task itself, nor does it delegate oversight entirely to external auditors. Its role is to set direction and hold management accountable.

Question 17Fundamental concepts and principles of compliance and the CMS based on ISO 37301

A compliance manager is explaining why compliance should be embedded in business processes. Which argument best reflects ISO 37301 principles?

  1. Embedding compliance in processes helps ensure obligations are addressed during routine operations Correct answer.
  2. Embedding compliance replaces the need for a compliance policy
  3. Embedding compliance means only managers need to be aware of obligations
  4. Embedding compliance eliminates the need for monitoring and measurement

Explanation

Embedding compliance into processes ensures obligations are identified and addressed as part of routine operations rather than as an afterthought. It does not replace the policy, nor does it remove the need for monitoring. Awareness of obligations is expected at all relevant levels of the organization.

Question 18Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best captures the meaning of "tone at the top" in a compliance management system?

  1. Leaders visibly demonstrate commitment to compliance through decisions and behavior Correct answer.
  2. Leaders issue a policy and then delegate compliance entirely
  3. Leaders focus on compliance only during audits
  4. Leaders communicate compliance requirements only to external stakeholders

Explanation

Tone at the top refers to leaders visibly demonstrating commitment to compliance through their decisions, behavior, and communications. Issuing a policy without ongoing commitment or focusing only on audits does not establish the right tone. Communication should reach internal stakeholders as well.

Question 19Fundamental concepts and principles of compliance and the CMS based on ISO 37301

In ISO 37301, which term describes the outcome of an organization failing to fulfil a requirement?

  1. Interested party
  2. Compliance objective
  3. Nonconformity Correct answer.
  4. Compliance obligation

Explanation

A nonconformity is the non-fulfilment of a requirement, including a requirement of the management system standard or a compliance obligation. It is distinct from the obligation itself or from interested parties. Identifying nonconformities supports corrective action and improvement.

Question 20Fundamental concepts and principles of compliance and the CMS based on ISO 37301

An organization is setting compliance objectives. Which approach best aligns with ISO 37301?

  1. Objectives are kept confidential from all employees
  2. Objectives are expressed only as general aspirations without measures
  3. Objectives are measurable, monitored, and consistent with the compliance policy Correct answer.
  4. Objectives are set only after a regulator investigation

Explanation

Compliance objectives should be consistent with the compliance policy, measurable where practicable, monitored, and communicated as appropriate. General aspirations without measures or objectives set only after investigations do not support effective management. Confidentiality should not prevent relevant staff from understanding objectives.

Question 21Fundamental concepts and principles of compliance and the CMS based on ISO 37301

A company has operations in several countries with differing regulatory regimes. How should its CMS address this under ISO 37301?

  1. Identify and manage the full range of compliance obligations applicable across all jurisdictions Correct answer.
  2. Rely on local staff to manage obligations without a system
  3. Apply the least stringent obligations across all locations
  4. Apply only the obligations of the headquarters country

Explanation

The CMS must identify and manage all compliance obligations applicable to the organization, including those arising in each jurisdiction where it operates. Applying only headquarters obligations or the least stringent rules leaves gaps. Local staff may support implementation but a system is still required.

Question 22Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best explains why ISO 37301 is described as applicable to all types of organizations?

  1. Its requirements are generic and can be adapted to different sizes, sectors, and legal environments Correct answer.
  2. It applies only to organizations operating in a single country
  3. It applies only to organizations with more than 500 employees
  4. It applies only to publicly listed companies

Explanation

ISO 37301 uses generic requirements that can be adapted to organizations of different sizes, sectors, and legal environments. It is not limited by employee count, listing status, or geography. This flexibility is a core feature of management system standards.

Question 23Fundamental concepts and principles of compliance and the CMS based on ISO 37301

An organization claims its CMS is "certified to ISO 37301." What does this most accurately indicate?

  1. The organization has written a compliance policy
  2. The organization has never had a compliance incident
  3. The organization's legal team has approved all contracts
  4. An independent certification body has assessed the CMS against the standard's requirements Correct answer.

Explanation

Certification to ISO 37301 involves assessment by an independent certification body against the standard's requirements. Writing a policy or having no incidents does not constitute certification. Contract approval by legal staff is unrelated to management system certification.

Question 24Fundamental concepts and principles of compliance and the CMS based on ISO 37301

A compliance function is being designed. Which arrangement best reflects the principle of independence in ISO 37301?

  1. The compliance function is staffed only by temporary contractors
  2. The compliance function has sufficient authority and access to report concerns to top management and the governing body Correct answer.
  3. The compliance function reports only to the sales department
  4. The compliance function can be overruled by any business unit manager without escalation

Explanation

Independence and authority allow the compliance function to raise concerns and report to top management and the governing body without undue influence. Reporting only to a business function or being overruled without escalation undermines independence. Staffing arrangements should support the function's objectivity.

Question 25Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best distinguishes a compliance management system from a compliance program in the sense used by ISO 37301?

  1. A CMS is a management system with interrelated elements subject to continual improvement, while a program often refers to a set of activities without the full management system structure Correct answer.
  2. A CMS is a document while a program is a process
  3. A CMS applies only to regulated industries while a program applies to all
  4. A CMS is a short-term project while a program is permanent

Explanation

ISO 37301 defines a CMS as a management system with interrelated elements that is subject to continual improvement through the Plan-Do-Check-Act cycle. A compliance program is commonly used to describe a set of compliance activities, which may lack the full management system structure. The distinction is about systemic integration and improvement, not duration or industry.

Question 26Fundamental concepts and principles of compliance and the CMS based on ISO 37301

In ISO 37301, which term refers to the set of interrelated or interacting elements an organization uses to establish compliance policy and compliance objectives and the processes to achieve those objectives?

  1. Compliance programme
  2. Compliance culture
  3. Compliance management system Correct answer.
  4. Compliance function

Explanation

ISO 37301 defines a compliance management system as the set of interrelated or interacting elements of an organization used to establish compliance policy and compliance objectives, and the processes to achieve those objectives. The other terms describe organizational units, time-bound initiatives, or behavioural patterns rather than the formal management system itself.

Question 27Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best describes the relationship between ISO 37301 and other ISO management system standards such as ISO 9001 and ISO 14001?

  1. It is structured to be compatible and integrable with them through common high-level structure. Correct answer.
  2. It replaces them for organizations that also manage quality or environment.
  3. It applies only to organizations that hold no other management system certification.
  4. It conflicts with them because compliance cannot be integrated with quality or environment.

Explanation

ISO 37301 follows the harmonized high-level structure used by other ISO management system standards, so its requirements can be aligned or integrated with systems such as ISO 9001 and ISO 14001. This shared structure covers context, leadership, planning, support, operation, performance evaluation, and improvement.

Question 28Fundamental concepts and principles of compliance and the CMS based on ISO 37301

A newly appointed compliance officer asks what ISO 37301 requires before the organization designs compliance processes. Which prerequisite best reflects the standard's logic?

  1. Appointing an external legal counsel as the permanent compliance function
  2. Understanding the organization and its context, including compliance obligations and risks Correct answer.
  3. Obtaining third-party certification of the compliance policy
  4. Completing a full internal audit of all business units

Explanation

The standard places understanding the organization and its context, including the external and internal issues and the compliance obligations relevant to it, ahead of designing the CMS. Context analysis and identification of obligations and risks inform the policy, objectives, and processes that follow.

Question 29Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best explains why ISO 37301 emphasizes that compliance is the responsibility of all personnel rather than only the compliance function?

  1. Because the standard requires every employee to be a member of the compliance committee.
  2. Because the compliance function is prohibited from advising business units under the standard.
  3. Because external auditors require each employee to hold a compliance certification.
  4. Because compliance obligations attach to the organization's activities, so every person whose work creates or manages obligations must fulfil them. Correct answer.

Explanation

Compliance obligations arise from the organization's activities, products, and services, so the people performing and managing those activities are best placed to ensure obligations are met. The compliance function supports, advises, and monitors, but cannot substitute for operational accountability.

Question 30Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which term in ISO 37301 describes a person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity?

  1. Governing body
  2. Compliance obligation
  3. Compliance risk source
  4. Stakeholder equivalent, referred to as an interested party Correct answer.

Explanation

ISO management system standards use "interested party" for a person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. Interested parties include regulators, customers, employees, owners, and others whose needs and expectations the organization considers.

Question 31Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which characteristic best distinguishes the ISO 37301 approach to compliance from a purely reactive legal-response approach?

  1. It relies exclusively on external counsel to interpret regulations.
  2. It treats compliance as a one-time project completed at certification.
  3. It establishes a proactive, risk-based system for identifying and meeting obligations on an ongoing basis. Correct answer.
  4. It focuses only on criminal law obligations.

Explanation

ISO 37301 promotes a proactive, risk-based management system that identifies obligations, assesses compliance risk, and monitors performance continually rather than reacting after a breach. This forward-looking cycle is central to the standard's philosophy.

Question 32Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best describes the role of compliance obligations within an ISO 37301 CMS?

  1. They are optional references used only during internal audits.
  2. They are the same as compliance risks and are recorded as such.
  3. They apply only to obligations imposed by the organization's customers.
  4. They are requirements the organization must comply with, and they are identified and managed as an input to the CMS. Correct answer.

Explanation

ISO 37301 defines compliance obligations as requirements the organization must comply with, and requires the organization to identify and have access to them and to determine how they apply. They include legal, regulatory, contractual, and voluntary commitments and feed into risk assessment and controls.

Question 33Fundamental concepts and principles of compliance and the CMS based on ISO 37301

An organization's compliance officer states that the CMS must be "appropriate to the organization." Which ISO 37301 principle does this most directly reflect?

  1. Centralization
  2. Outsourcing
  3. Certification
  4. Proportionality Correct answer.

Explanation

The principle of proportionality means the CMS is designed to fit the organization's size, complexity, context, and risk profile, so controls and resources are commensurate with its obligations. A small entity and a multinational will therefore implement the same requirements at different scales.

Question 34Fundamental concepts and principles of compliance and the CMS based on ISO 37301

A compliance team is defining the scope of its CMS. Which action best aligns with ISO 37301 requirements for determining scope?

  1. Exclude all high-risk activities so that the scope statement is easier to audit.
  2. Limit the scope to the legal department's own activities.
  3. Consider external and internal issues, compliance obligations, and the nature of the organization's activities when defining boundaries. Correct answer.
  4. Adopt the scope statement of a competitor in the same sector.

Explanation

ISO 37301 requires the scope of the CMS to be defined considering the external and internal issues, compliance obligations, and the organization's activities, products, and services. The scope must be documented and reflect what the system actually covers.

Question 35Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best describes how ISO 37301 treats the concept of "compliance culture"?

  1. It is an outcome supported by leadership, values, and behaviour that the CMS should foster and monitor. Correct answer.
  2. It is the sole responsibility of the compliance function.
  3. It is a documented procedure that must be audited annually.
  4. It is a synonym for the compliance policy document.

Explanation

ISO 37301 treats compliance culture as an outcome of leadership, shared values, and behaviour throughout the organization, which the CMS should encourage and evaluate. It is not a document or a single department's duty, but a system-wide characteristic.

Question 36Fundamental concepts and principles of compliance and the CMS based on ISO 37301

An auditor asks how the organization ensures that compliance obligations are kept current. Which mechanism best reflects ISO 37301 expectations?

  1. Freezing the obligations register after initial approval.
  2. Reviewing obligations only when a regulator issues a fine.
  3. Establishing a process to identify and update compliance obligations on a planned and triggered basis. Correct answer.
  4. Relying on individual employees to report changes they happen to notice.

Explanation

ISO 37301 expects a systematic process for identifying compliance obligations and keeping them up to date, including planned reviews and triggers such as regulatory change. This ensures the CMS remains aligned with the organization's evolving obligations.

Question 37Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best explains the relationship between compliance risk and the organization's objectives in ISO 37301?

  1. Compliance risk is eliminated entirely once a compliance policy is issued.
  2. Compliance risk is relevant only to financial objectives.
  3. Compliance risk is managed independently of objectives and never linked to them.
  4. Compliance risk is the potential for non-compliance, which can affect the achievement of the organization's objectives. Correct answer.

Explanation

Compliance risk is the effect of uncertainty on objectives arising from the possibility of failing to meet compliance obligations. Because it can undermine the achievement of objectives, the standard requires it to be addressed in planning.

Question 38Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which action best demonstrates that top management is integrating compliance requirements into the organization's business processes, as ISO 37301 expects?

  1. Issuing a policy statement once and delegating all further action to the compliance function.
  2. Embedding compliance controls and considerations into operational workflows and decision-making. Correct answer.
  3. Commissioning a legal opinion on a single regulation.
  4. Holding an annual awareness session for senior managers only.

Explanation

ISO 37301 expects compliance to be integrated into the organization's processes rather than treated as a parallel activity, so controls and considerations are built into workflows and decisions. This integration is a hallmark of leadership commitment in the standard.

Question 39Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best describes the purpose of the compliance policy in an ISO 37301 CMS?

  1. It is a confidential document that must not be communicated internally.
  2. It lists every compliance obligation in full detail.
  3. It replaces the need for compliance objectives.
  4. It establishes top management's commitment, direction, and framework for compliance objectives. Correct answer.

Explanation

The compliance policy is established by top management and provides the commitment, direction, and framework for setting compliance objectives. It is communicated within the organization and made available to relevant interested parties as appropriate.

Question 40Fundamental concepts and principles of compliance and the CMS based on ISO 37301

An organization is assessing whether its CMS is effective. Which evidence best indicates effectiveness under ISO 37301?

  1. The compliance policy is the longest document in the organization.
  2. The compliance function has the largest headcount among support functions.
  3. The organization has held a launch event for the CMS.
  4. Compliance objectives are achieved and monitoring shows obligations are being met. Correct answer.

Explanation

Effectiveness in ISO 37301 is judged by whether the CMS achieves intended results, meaning compliance objectives are met and monitoring demonstrates that obligations are fulfilled. Inputs such as document length, headcount, or events do not by themselves evidence effectiveness.

Question 41Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best explains why ISO 37301 requires a risk-based approach to compliance?

  1. Because risk assessment removes the need for monitoring and measurement.
  2. Because risk assessment is a one-time activity performed before certification only.
  3. Because resources are limited and effort should be directed where the potential impact of non-compliance is greatest. Correct answer.
  4. Because all compliance obligations carry identical risk and require identical controls.

Explanation

A risk-based approach allows the organization to prioritize controls and resources where the likelihood and impact of non-compliance are highest. ISO 37301 expects risk to be assessed and addressed on an ongoing basis, not just once.

Question 42Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which term describes the organization's highest-level authority that has the power to delegate authority and provide resources within the organization?

  1. Compliance function
  2. Top management team
  3. Governing body Correct answer.
  4. Interested party

Explanation

ISO 37301 uses "governing body" for the person or group of people who direct and control the organization at the highest level. Top management is the person or group directing the organization at the highest level of management, which may be the same or different depending on governance arrangements.

Question 43Fundamental concepts and principles of compliance and the CMS based on ISO 37301

An organization wants to ensure its compliance function has the authority and access it needs. Which arrangement best aligns with ISO 37301?

  1. Giving the compliance function direct access to the governing body and top management. Correct answer.
  2. Placing the compliance function under the sales director to ensure commercial alignment.
  3. Rotating the compliance function among business units every month without a defined mandate.
  4. Requiring the compliance function to obtain approval from business units before reporting issues.

Explanation

ISO 37301 expects the compliance function to have the authority, access, and resources needed to perform its role, including direct access to top management and the governing body. This access supports independence and escalation of significant issues.

Question 44Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best explains the principle of "continual improvement" as applied to a CMS under ISO 37301?

  1. Improvement is optional and applies only to organizations seeking certification.
  2. Improvement is limited to correcting audit findings after certification.
  3. The organization should continually enhance the suitability, adequacy, and effectiveness of the CMS. Correct answer.
  4. Improvement means periodically replacing the entire compliance team.

Explanation

Continual improvement means enhancing the suitability, adequacy, and effectiveness of the CMS over time, informed by monitoring, audit, and management review. It applies to all organizations implementing the standard, regardless of certification ambitions.

Question 45Fundamental concepts and principles of compliance and the CMS based on ISO 37301

A multinational identifies that a subsidiary's local law is stricter than the group's global compliance baseline. What is the most appropriate action under an ISO 37301 CMS?

  1. Suspend the subsidiary's operations until all laws are harmonized.
  2. Apply the stricter local requirement where it applies, while maintaining the group baseline as a minimum. Correct answer.
  3. Require the subsidiary to seek an exemption from the local regulator as standard practice.
  4. Apply the group baseline everywhere and disregard stricter local requirements.

Explanation

An ISO 37301 CMS must address the compliance obligations applicable to each part of the organization, so stricter local requirements apply locally while the group baseline serves as a minimum. This reflects proportionality and context sensitivity across jurisdictions.

Question 46Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best describes the difference between a compliance management system and a compliance programme as those terms are commonly used alongside ISO 37301?

  1. A programme is always certified, while a CMS is never certified.
  2. A CMS and a programme are identical terms with no meaningful distinction.
  3. A programme is a legal requirement, while a CMS is a voluntary internal preference.
  4. A programme is a set of planned actions or initiatives, while a CMS is the broader management system that governs them. Correct answer.

Explanation

A compliance programme is commonly understood as a set of planned activities or initiatives, whereas a CMS is the broader management system of interrelated elements that establishes policy, objectives, and processes. ISO 37301 formalizes the CMS concept, within which programmes and initiatives operate.

Question 47Fundamental concepts and principles of compliance and the CMS based on ISO 37301

An organization asserts that its CMS is "certified to ISO 37301." What is the most accurate interpretation of this claim?

  1. The organization has received a legal opinion confirming compliance with all laws.
  2. The organization has self-declared conformity without any external review.
  3. An accredited certification body has independently verified conformity to the standard's requirements. Correct answer.
  4. The organization's compliance function has been licensed by ISO.

Explanation

ISO 37301 is a certifiable management system standard, so a claim of certification means an accredited certification body has independently assessed and verified conformity. Certification is distinct from self-declaration and from legal opinions on compliance with specific laws.

Question 48Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best explains why ISO 37301 is described as applicable to all types of organizations, regardless of size, sector, or location?

  1. Because it prescribes a fixed set of controls that every organization must adopt identically.
  2. Because it exempts small organizations from identifying compliance obligations.
  3. Because it sets out generic requirements that can be tailored to the organization's context, obligations, and risks. Correct answer.
  4. Because it applies only to publicly listed companies with formal compliance departments.

Explanation

ISO 37301 contains generic requirements intended to be applied proportionately, allowing any organization to tailor its CMS to its context, obligations, and risks. This is what makes the standard usable across sectors, sizes, and jurisdictions.

Question 49Fundamental concepts and principles of compliance and the CMS based on ISO 37301

A compliance officer argues that independence of the compliance function means the function must never interact with business units. Which analysis best reflects ISO 37301?

  1. The argument is incorrect because independence concerns freedom from undue influence and conflicts of interest, not isolation from the business. Correct answer.
  2. The argument is correct because business units cannot be trusted with compliance information.
  3. The argument is incorrect because ISO 37301 requires the compliance function to be outsourced.
  4. The argument is correct because independence requires complete isolation from operations.

Explanation

Independence in ISO 37301 concerns the ability to act free from undue influence and conflicts of interest, while still collaborating closely with business units to embed compliance. Isolation would undermine the function's ability to advise and monitor effectively.

Question 50Fundamental concepts and principles of compliance and the CMS based on ISO 37301

Which statement best captures how ISO 37301 treats the relationship between compliance and the organization's overall governance?

  1. Compliance is a standalone technical activity isolated from governance structures.
  2. Compliance is delegated entirely to external regulators who direct the CMS.
  3. Compliance is a governance matter, with the governing body overseeing the CMS and its integration with strategy and risk management. Correct answer.
  4. Compliance is relevant only to the internal audit function.

Explanation

ISO 37301 positions compliance as a governance matter: the governing body oversees the CMS, ensures it is integrated with the organization's strategy and risk management, and holds top management accountable. This elevates compliance beyond a purely technical or audit activity.