PECB ISO 37301 Lead Auditor cheat sheet

Compliance is the outcome of meeting an organization's obligations; a compliance management system (CMS) is the set of interrelated policies, processes, roles and controls that produce that outcome.

ISO 37301:2021 follows the Harmonized Structure (Annex SL): clauses 4-10 (context, leadership, planning, support, operation, performance evaluation, improvement), enabling integration with ISO 9001 and ISO 27001.

Seven compliance principles underpin the standard: good governance, proportionality, transparency, sustainability, accountability, integrity and stakeholder engagement.

The compliance function is independent and has direct access to the governing body; independence of the compliance function is a recurring audit focus.

Compliance culture is measured through observable behaviour (tone at the top, incentives, speak-up rates, training effectiveness), not merely through documents.

Obligations have three sources: mandatory requirements (laws, regulations, permits), voluntary commitments (contracts, codes, standards) and internal requirements (policies).

The Plan-Do-Check-Act cycle maps to clause 6 (planning), clause 8 (operation), clause 9 (performance evaluation) and clause 10 (improvement).

Risk-based approach: compliance risk is the effect of uncertainty on compliance objectives; obligation registers are prioritized by likelihood and consequence.

Clause 4 requires determining external and internal issues, interested parties and their relevant requirements, and the scope of the CMS; scope must be documented and available.

Clause 5 requires top management to demonstrate leadership, establish a compliance policy, and assign roles, responsibilities and authorities; a compliance committee may be established.

Clause 6 requires compliance risk assessment, identification of compliance obligations, and documented compliance objectives that are measurable, monitored and communicated.

Clause 7 covers resources, competence, awareness, communication and documented information; competence records are required evidence.

Clause 8 covers operational planning and control, due diligence on third parties, training, raising concerns (speak-up), and investigation processes.

Clause 9 requires monitoring, measurement, analysis and evaluation, internal audit, and management review with defined inputs and outputs.

Clause 10 requires handling nonconformity and corrective action, and continual improvement of the CMS suitability, adequacy and effectiveness.

Documented information must be controlled for availability, protection, distribution, access, retrieval and retention; obsolete documents must be prevented from unintended use.

Audit: systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the degree of conformity.

Seven audit principles per ISO 19011: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.

Audit types: first-party (internal), second-party (supplier/customer), third-party (certification, accreditation, regulatory); combined audits cover two or more management systems together.

Audit criteria are the set of requirements used as a reference (ISO 37301, legal obligations, internal policies); audit evidence comprises records, statements of fact or other verifiable information.

Audit findings are classified as conformities or nonconformities; nonconformities may be graded major (systemic/absent control) or minor (isolated lapse).

Sampling risk and evidence reliability: evidence from direct observation and records is stronger than interview statements alone; triangulation reduces audit risk.

Auditor competence includes knowledge of the standard, legal/regulatory awareness, audit techniques, and personal behaviours such as ethical conduct and open-mindedness.

Audit programme vs audit plan: the programme is the set of audits planned over a period; the plan is the documented arrangement for a single audit (objectives, criteria, scope, dates, team).

Initiating the audit includes defining objectives, scope and criteria, determining feasibility, selecting the team and establishing initial contact with the auditee.

Document review before the audit covers the compliance policy, obligation register, risk assessment, prior audit reports, management review minutes and nonconformity logs.

Audit plan content: audit objectives, scope, criteria, locations, dates, expected time and duration, roles, and allocation of resources; plan is communicated to auditee.

Checklists should be derived from clause requirements and process risks, not copied from the standard; they guide but do not limit the audit.

Audit sampling plan should consider process criticality, volume, complexity, prior findings and results of monitoring.

Work documents include the audit plan, checklists, forms for recording evidence and findings, and sampling plans; they are retained as evidence of the audit process.

Opening meeting confirms scope, criteria, schedule, communication channels, confidentiality and escalation; attendance is recorded.

Evidence collection uses interviews, observation of activities, and review of documents and records; evidence must be verifiable and traceable to criteria.

Interview technique: ask open questions, probe for examples, verify with records, avoid leading questions, and record who said what and when.

Audit trail: every finding must link criterion (clause/law) -> evidence (record/observation) -> conclusion (conformity/nonconformity).

Nonconformity statement structure: requirement, evidence of the gap, and the effect; avoid prescribing the corrective action.

Observation of the compliance function's independence, access to the governing body, and escalation of concerns is central to a 37301 audit.

Daily team meetings consolidate findings, check coverage against the plan, and adjust sampling; findings are reviewed before the closing meeting.

Closing meeting presents findings, nonconformities and conclusions; the auditee should be given the opportunity to clarify and dispute findings.

Audit report content: objectives, scope, criteria, dates, team, summary of the audit process, findings, conclusions, and any limitations or deviations from the plan.

Findings are graded; major nonconformities typically block certification until corrective action is verified; minor nonconformities may be closed by documented evidence.

Corrective action process: root cause analysis, correction, corrective action, verification of effectiveness; the auditor verifies evidence, not the auditee's intention.

Follow-up may be a desk review or an on-site visit depending on the severity of the finding and the certification body's procedures.

The audit is closed when the report is issued, findings are communicated, and the follow-up arrangements are agreed; records are retained.

Confidentiality and data protection apply to all audit records; distribution of the report is controlled by the audit programme owner.

Conclusions must be based only on the evidence collected within the audit scope; the report should not include recommendations unless the audit objectives allow it.

Audit programme: set of one or more audits planned for a specific time frame, directed at a specific purpose; managed by a programme manager.

Programme design considers the organization's context, compliance risk, legal obligations, size and complexity, and the results of previous audits.

Programme elements: objectives, risks and opportunities, scope, schedule, resources, competence of auditors, and monitoring of programme performance.

Auditor selection considers competence, independence, and the avoidance of conflicts of interest; auditors should not audit their own work.

Programme monitoring uses indicators such as audit completion rate, finding closure rate, repeat findings, and coverage of high-risk obligations.

Programme records include audit plans, reports, nonconformity logs, corrective action evidence, and auditor competence records.

Programme review at planned intervals ensures continual improvement; changes in legal obligations or organizational structure trigger a programme review.