PECB ISO 37301 Lead Auditor flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Compliance

The state of meeting an organization's mandatory and voluntary obligations; it is an outcome produced by the compliance management system, not a document or a single department.

Compliance management system

A set of interrelated policies, processes, roles and controls that an organization uses to identify obligations, manage compliance risk and achieve compliance outcomes.

Compliance obligation

A requirement that the organization must meet, arising from laws, regulations, permits, contracts, voluntary codes or internal policies, and recorded in the obligation register.

Compliance culture

The shared values, attitudes and behaviours that determine how people actually comply; evidenced by leadership behaviour, incentives, speak-up rates and training effectiveness rather than by policy statements.

Compliance risk

The effect of uncertainty on compliance objectives, assessed by combining the likelihood of non-compliance with the severity of its legal, financial and reputational consequences.

Harmonized Structure

The common clause framework (clauses 4 to 10) used by ISO management system standards, which allows an ISO 37301 compliance management system to be integrated with quality or information security systems.

Scope of the CMS

The documented boundaries and applicability of the compliance management system, including the functions, locations and obligations it covers; it must be available as documented information.

Compliance policy

Top management's documented statement of commitment to compliance, providing the framework for setting compliance objectives and a reference point for the whole compliance management system.

Compliance objectives

Measurable targets set for relevant functions and levels, consistent with the compliance policy, monitored and communicated, and supported by plans describing how they will be achieved.

Due diligence on third parties

The process of assessing and monitoring the compliance risk of suppliers, agents and partners before and during the relationship, as required by the operational control clause.

Speak-up process

A confidential channel through which workers and third parties can raise compliance concerns without fear of retaliation, supported by investigation and escalation procedures.

Management review

A planned top-management evaluation of the compliance management system's suitability, adequacy and effectiveness, using defined inputs and producing decisions on improvement and resources.

Audit

A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the degree of conformity.

Audit criteria

The set of requirements used as a reference against which audit evidence is compared, such as ISO 37301 clauses, applicable laws and the organization's own policies.

Audit evidence

Records, statements of fact or other verifiable information relevant to the audit criteria; evidence must be traceable and triangulated from interviews, observation and documents.

Nonconformity

A failure to meet an audit criterion; it is stated by citing the requirement, the objective evidence of the gap and the effect, without prescribing the corrective action.

Audit principles

The seven principles of ISO 19011: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.

Audit programme

The set of one or more audits planned for a specific time frame and purpose, managed by a programme manager who allocates resources and monitors performance.

Audit plan

The documented arrangement for a single audit, covering objectives, scope, criteria, dates, locations, team roles and allocation of time and resources.

Initiating the audit

The preparatory step that defines audit objectives, scope and criteria, confirms feasibility, selects the audit team and establishes initial contact with the auditee.

Document review

The pre-audit examination of compliance policies, obligation registers, risk assessments, prior reports and nonconformity logs to focus sampling and interview questions.

Audit sampling plan

The documented approach to selecting which processes, records and locations to examine, based on criticality, volume, complexity, prior findings and monitoring results.

Opening meeting

The first formal meeting of the audit, confirming scope, criteria, schedule, communication channels, confidentiality and escalation, with attendance recorded.

Audit trail

The documented link from audit criterion to objective evidence to conclusion, which allows a finding to be verified and defended by another auditor.

Interview technique

The use of open questions, probing for concrete examples and verification against records, while avoiding leading questions and recording who said what and when.

Closing meeting

The final formal meeting where findings, nonconformities and conclusions are presented, and the auditee is given the opportunity to clarify or dispute them.

Audit report

The documented output of the audit, containing objectives, scope, criteria, dates, team, summary of the process, findings, conclusions and any limitations or deviations.

Corrective action

Action taken to eliminate the root cause of a nonconformity so that it does not recur; the auditor verifies evidence of implementation and effectiveness, not stated intentions.

Follow-up audit

A verification activity, by desk review or on-site visit, confirming that corrective actions for reported nonconformities have been implemented and are effective.

Programme monitoring

The use of indicators such as audit completion rate, finding closure rate, repeat findings and coverage of high-risk obligations to judge whether the audit programme is achieving its objectives.

Auditor competence

The combination of knowledge of the standard and applicable law, audit techniques and personal behaviours such as ethical conduct and open-mindedness required to perform audits.

Conflict of interest

A situation in which an auditor's objectivity could be compromised, for example by auditing their own work or a process they manage; it is avoided through independence and rotation.