ISO 37301 requirements for a compliance management system – Clauses 4 to 10
Domain 2 tests the auditable requirements in Clauses 4–10 and how they connect. The exam expects you to place an activity in the right clause, recognise required evidence, and spot a system that has documents but no functioning control loop.
Clause map
- Clause 4 Context: determine external and internal issues, relevant interested parties and their requirements, define the CMS scope, and establish the CMS.
- Clause 5 Leadership: top management demonstrates leadership and commitment, establishes a compliance policy, and assigns roles, responsibilities and authorities.
- Clause 6 Planning: address risks and opportunities, set compliance objectives and plans, and plan changes.
- Clause 7 Support: provide resources, competence, awareness, communication and controlled documented information.
- Clause 8 Operation: plan and control processes, identify compliance obligations, assess compliance risk and apply controls, including for outsourced or changed activities.
- Clause 9 Performance evaluation: monitor and measure, conduct internal audits, and carry out management review.
- Clause 10 Improvement: handle nonconformity and corrective action, and continually improve.
Worked example
A retailer enters a new market with packaging and privacy rules. Clause 4 records the new legal environment, regulators, customers and scope covering stores and e-commerce. Clause 5 issues a policy signed by the CEO and gives the compliance officer authority across functions. Clause 6 sets an objective-complete high-risk supplier assessments-and actions for gaps. Clause 7 trains buyers and controls the obligations register. Clause 8 builds approval controls into procurement and marketing. Clause 9 tracks overdue assessments, audits the process and reviews results. Clause 10 corrects the root cause of missed checks. Reasoning: the same obligation moves through context, planning, support, operation, evaluation and improvement; auditors look for that trace.
Traps
A policy without implementation evidence fails leadership in practice. A scope that excludes the risky entity undermines the whole CMS. Internal audit is not the same as a compliance inspection by the compliance team. Management review needs decisions and actions, not just a presentation. Corrective action must address root cause, not only the visible error.