PECB ISO 37301 Lead Auditor key terms

A structured set of interrelated policies, processes, roles and controls an organization uses to direct, monitor and improve its adherence to compliance obligations and to create a compliance culture.

A requirement that an organization must or chooses to comply with, arising from law, regulation, contract, industry standard, voluntary commitment or its own internal rules and policies.

The likelihood and consequence of failing to meet a compliance obligation, expressed as the possibility of legal, financial, operational or reputational harm to the organization.

The shared values, attitudes, behaviours and norms within an organization that determine whether compliance is genuinely prioritized, openly discussed and supported by leadership and by every worker.

The highest-level person or group with authority and accountability for the organization's strategic direction, oversight of the compliance management system and approval of its compliance policy.

The person or group directing and controlling the organization at the highest level, responsible for integrating compliance into business processes and providing resources, leadership and direction.

A documented statement of the organization's overall compliance intentions and direction, established by top management and providing a framework for setting compliance objectives.

A measurable result to be achieved in relation to compliance, set consistently with the compliance policy, monitored, communicated and updated as needed.

The internal and external issues, interested parties and their relevant requirements that influence the organization's ability to achieve the intended outcomes of its compliance management system.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision, activity or compliance failure of the organization, including regulators, customers and workers.

The documented boundaries and applicability of the compliance management system, identifying the organizational units, processes, locations and obligations it covers.

Demonstrated and visible support by top management for the compliance management system, shown through resource provision, accountability assignment and personal participation in compliance activities.

The role or organizational unit responsible for operating, facilitating and advising on the compliance management system, including monitoring obligations and supporting other functions.

The individual assigned authority and responsibility for overseeing the compliance management system, advising the organization and reporting on compliance performance to top management and the governing body.

A systematic process of investigating and evaluating the compliance-related risks and track record of parties such as business partners, suppliers or acquisition targets before and during a relationship.

A confidential channel and process enabling workers and other parties to report suspected or actual compliance concerns without fear of retaliation, with reports received and handled appropriately.

The principle and practice that no person who raises a compliance concern in good faith may suffer adverse treatment or disadvantage as a result of doing so.

A person who reports wrongdoing, misconduct or a suspected breach of compliance obligations within or about an organization, often protected by law and by internal policy.

A governance structure distinguishing operational management owning risks, a compliance and risk oversight function providing advice and challenge, and internal audit providing independent assurance.

The recurring activity of enhancing compliance performance by identifying opportunities, correcting weaknesses and raising the maturity of the management system over time.

A failure to meet a requirement of the standard, of the organization's own compliance management system, or of a compliance obligation that the system is intended to manage.

Action taken to eliminate the cause of a detected nonconformity so that it does not recur, including analysis of root cause and verification of effectiveness.

A periodic, structured evaluation by top management of the compliance management system's suitability, adequacy and effectiveness, with decisions on improvement and resource needs.

The process of monitoring, measuring, analysing and evaluating compliance performance against objectives and obligations, providing the evidence base for improvement decisions.

A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the extent of conformity.

The set of requirements, policies, standards, obligations or other references against which audit evidence is compared to determine conformity or nonconformity.

Records, statements of fact or other information relevant to the audit criteria that is verifiable and used by auditors to reach audit findings.

The result of evaluating collected audit evidence against audit criteria, which may indicate conformity or nonconformity and is reported to the auditee.

The auditor's professional judgement of the audit results after considering all findings and their significance against the audit objectives and criteria.

The extent and boundaries of an audit, describing the organizational units, functions, processes, locations and time period to be examined.

A description of the activities, resources, timing and arrangements for conducting an audit, including allocation of responsibilities and sampling approach.

A set of one or more audits planned for a specific timeframe and purpose, directed at efficiency and effectiveness and managed as a portfolio of audits.

The person responsible for establishing, implementing, monitoring and improving the audit programme, including resourcing, scheduling and reporting to top management.

The demonstrated ability of an auditor to apply knowledge, skills and behaviour, including compliance knowledge, audit techniques and personal attributes, to achieve intended audit results.

Freedom from bias and from conditions that threaten the auditor's ability to make impartial, objective judgements, including freedom from auditing one's own work.

The state of mind and conduct that allows an auditor to reach conclusions based only on evidence and criteria, without favour, prejudice or undue influence.

A situation in which an auditor's personal, financial or organizational interests could improperly influence audit judgements, requiring disclosure and appropriate mitigation or reassignment.

Selecting a subset of items from a population to obtain and evaluate evidence about some characteristic of that population, supporting conclusions about the whole.

A formal meeting at the start of an audit to confirm the audit plan, scope and criteria, explain methods and communication channels, and confirm availability of resources and personnel.

A formal meeting at the end of an audit to present findings, conclusions and recommendations, agree follow-up actions and clarify any points of disagreement with the auditee.

A documented record of the audit that presents the scope, criteria, findings, conclusions and any agreed follow-up actions in a clear and complete manner.

An approach that prioritizes audit effort and resources toward areas of higher compliance risk, so that assurance focuses where failure would matter most.