PECB ISO 37301 Foundation study plan

Define compliance, compliance culture, and the difference between compliance obligations and voluntary commitments in your own words, with one workplace example each.

Map the Plan-Do-Check-Act cycle onto a compliance management system (CMS) and explain what each phase produces.

Distinguish ISO 37301 from ISO 19600 by listing what changed from guidance to certifiable requirements.

Identify the seven principles of compliance set out in ISO 37301 (such as leadership, risk-based approach, and continual improvement) and state one observable indicator for each in a real organization.

Explain the benefits and limitations of third-party certification of a CMS.

Describe the roles of governing body, top management, compliance function, and internal audit in a CMS, and separate assurance from management responsibility.

Outline how compliance risk is identified, assessed, and treated within a risk-based CMS, using a simple likelihood-impact scale.

Relate compliance obligations to interested parties and explain how stakeholder expectations become obligations.

List the core elements of a CMS (governance, obligations, risk, controls, monitoring, improvement) and explain how they interlock.

Explain the concept of compliance culture and how tone at the top, incentives, and speaking-up mechanisms influence it.

Distinguish compliance assurance activities from operational controls and give two examples of each.

Describe how noncompliance is detected, escalated, and remediated in a mature CMS.

Read Clause 4 and explain how to determine the organization's context, scope, and CMS boundaries.

Identify internal and external issues relevant to compliance and describe how they feed into the CMS.

Summarize the compliance obligations determination process and the need to keep it current.

Explain how interested parties are identified and their relevant requirements captured.

Explain the leadership and commitment requirements of Clause 5, including the compliance policy.

Describe how the compliance policy is communicated, maintained, and aligned with the organization's strategy.

Outline the responsibilities and authorities that top management must assign, including the compliance function's mandate.

Explain how governance bodies demonstrate oversight of the CMS.

Explain how compliance risks and opportunities are addressed in planning, including actions to integrate into processes.

Describe the compliance objectives requirement and how to make objectives measurable.

Outline the planning of changes to the CMS and the considerations involved.

Explain the resources, competence, awareness, communication, and documented information requirements of Clause 7.

Describe the operational planning and control requirements and how they apply to outsourced processes.

Explain the monitoring, measurement, analysis, and evaluation requirements, including what to monitor and how to evaluate results.

Outline the internal audit program requirements and management review inputs and outputs.

Describe the nonconformity and corrective action process and the continual improvement requirement.

Integrate clauses 4 to 10 into a single end-to-end CMS storyline from context to improvement.

Answer practice questions on fundamental concepts and clause requirements, and review every wrong answer against the standard text.

Explain how clauses 4 to 10 connect to the principles studied in weeks 1 to 3.

Identify remaining knowledge gaps and build a one-page revision sheet of weak areas.