I85PREP
⌘ K
PECB ISO 37301 Lead Auditor study materials
PECB ISO 37301 Lead Auditor study resources

PECB ISO 37301 Lead Auditor practice questions

One question at a time. Build your PECB ISO 37301 Lead Auditor understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of a compliance management system

In ISO 37301, what is the primary purpose of a compliance management system (CMS)?

  1. To guarantee that no regulatory breach can ever occur in the organization
  2. To document the personal ethics of senior management for public disclosure
  3. To replace the legal department with an outsourced external counsel arrangement
  4. To embed compliance obligations into the organization's culture and operations so that noncompliance is prevented and detected Correct answer.

Explanation

A CMS is the set of interrelated elements an organization uses to govern compliance obligations, integrating them into decision-making, culture and daily operations. ISO 37301 frames the CMS as a preventive and detective mechanism supporting continual improvement, not a guarantee of zero breaches.

Question 2Fundamental concepts and principles of a compliance management system

Which concept does ISO 37301 define as the organization's obligation to meet requirements imposed by law, regulators, its own commitments, and stakeholder expectations?

  1. Compliance culture
  2. Compliance function
  3. Compliance risk appetite
  4. Compliance obligation Correct answer.

Explanation

A compliance obligation is any requirement the organization must meet, whether legally mandated, contractually assumed, or self-imposed through policy and voluntary commitments. Identifying these obligations is the foundation for building the compliance obligations register.

Question 3Fundamental concepts and principles of a compliance management system

According to ISO 37301, who is ultimately accountable for the effectiveness of the compliance management system?

  1. The line managers of operational units
  2. The organization's governing body Correct answer.
  3. The external auditor engaged to certify the CMS
  4. The compliance officer alone

Explanation

ISO 37301 requires top management and the governing body to demonstrate leadership and commitment, and the governing body retains ultimate accountability for CMS effectiveness. Operational roles such as the compliance officer support and coordinate, but accountability stays with governance.

Question 4Fundamental concepts and principles of a compliance management system

Which statement best describes the relationship between ISO 37301 and ISO 37001?

  1. ISO 37301 addresses anti-bribery only, whereas ISO 37001 addresses all compliance obligations
  2. ISO 37001 replaces ISO 37301 for organizations operating in high-risk sectors
  3. ISO 37001 is a specific anti-bribery management system standard that can be integrated into the broader CMS described by ISO 37301 Correct answer.
  4. The two standards are unrelated and cannot be used together

Explanation

ISO 37301 provides generic requirements for managing compliance obligations across all types of risk, while ISO 37001 focuses specifically on anti-bribery management. Because both follow the harmonized management system structure, an anti-bribery system can be nested within a broader CMS.

Question 5Fundamental concepts and principles of a compliance management system

What does the principle of proportionality require when an organization designs its compliance management system?

  1. That every obligation receive an identical control regardless of the risk it presents
  2. That the compliance budget be fixed as a percentage of revenue set by the regulator
  3. That only obligations with criminal penalties be included in the CMS scope
  4. That controls and resources be commensurate with the nature, scale and complexity of the compliance risks faced Correct answer.

Explanation

Proportionality means the CMS is calibrated to the organization's size, sector, context and risk profile, so effort is concentrated where exposure is greatest. A small low-risk entity and a multinational are therefore not expected to apply identical controls.

Question 6Fundamental concepts and principles of a compliance management system

Which term describes an organization's shared values, beliefs and behaviours that determine whether compliance obligations are respected in practice?

  1. Compliance performance indicator
  2. Compliance risk treatment plan
  3. Compliance culture Correct answer.
  4. Compliance obligations register

Explanation

Compliance culture refers to the attitudes and behaviours of people within the organization, shaped by leadership example, incentives and tone at the top. ISO 37301 treats culture as an outcome to be encouraged and monitored, not merely documented.

Question 7Fundamental concepts and principles of a compliance management system

Why does ISO 37301 require the compliance function to have direct access to the governing body?

  1. To permit the compliance function to override operational managers without justification
  2. To allow the compliance function to issue binding legal rulings on behalf of regulators
  3. To ensure compliance matters and risks are escalated and considered at the highest decision-making level Correct answer.
  4. To reduce the number of staff needed in the internal audit team

Explanation

Direct reporting lines to the governing body protect the independence and authority of the compliance function and ensure significant issues reach those with ultimate accountability. This escalation path is a core governance safeguard in the standard.

Question 8Fundamental concepts and principles of a compliance management system

Which of the following is an example of a voluntary compliance obligation?

  1. A tax rate imposed by national legislation
  2. A court injunction ordering the organization to cease a practice
  3. A statutory reporting deadline set by a financial regulator
  4. A commitment the organization makes by signing an industry code of conduct Correct answer.

Explanation

Voluntary commitments, such as adopting an industry code of conduct or a self-imposed policy, become compliance obligations once the organization commits to them. Legal, regulatory and judicial requirements are mandatory external obligations rather than voluntary ones.

Question 9Fundamental concepts and principles of a compliance management system

A compliance officer is mapping the organization's obligations and finds a new data protection regulation that takes effect in eight months. What is the most appropriate action under the ISO 37301 framework?

  1. Register the obligation only after the first inspection by the data protection authority
  2. Record the obligation, assess its impact, and plan the necessary changes before the effective date Correct answer.
  3. Delegate the matter to the IT department and exclude it from the compliance register
  4. Wait until the regulation enters into force before adding it to the obligations register

Explanation

ISO 37301 requires the organization to identify and have access to up-to-date compliance obligations and to plan changes to the CMS when requirements change. Anticipating an upcoming regulation and preparing in advance is consistent with the preventive intent of the standard.

Question 10Fundamental concepts and principles of a compliance management system

How does ISO 37301 treat the relationship between compliance risk and the organization's objectives?

  1. Compliance risk is assessed in isolation and is never linked to strategic objectives
  2. Compliance risk is identified and assessed in relation to the organization's context and objectives, and informs decisions about the CMS Correct answer.
  3. Compliance risk is considered only when a breach has already occurred
  4. Compliance risk is managed only by the internal audit function

Explanation

The standard requires compliance risk to be assessed against the organization's context, obligations and objectives, so that the CMS addresses the risks that matter to the business. This links compliance management to strategic planning rather than treating it as a separate administrative activity.

Question 11Fundamental concepts and principles of a compliance management system

An organization's compliance policy states that employees may accept gifts of any value from suppliers. Which principle of an effective CMS does this most directly undermine?

  1. The principle that compliance responsibilities belong exclusively to the governing body
  2. The principle that the compliance function should be outsourced
  3. The principle that the CMS should be reviewed only after a breach
  4. The principle that compliance obligations and controls should be consistently embedded in policies and procedures Correct answer.

Explanation

A policy that permits conduct conflicting with applicable anti-bribery or conflict-of-interest obligations shows inconsistent embedding of compliance requirements. ISO 37301 expects policies and procedures to be consistent with the organization's compliance obligations.

Question 12Fundamental concepts and principles of a compliance management system

What distinguishes a compliance management system from a standalone code of conduct?

  1. A CMS is a systemic framework of interrelated processes, roles and controls, whereas a code of conduct is one document within that framework Correct answer.
  2. A CMS applies only to regulated financial institutions
  3. A code of conduct is legally binding while a CMS is optional
  4. A code of conduct replaces the need for risk assessment

Explanation

A code of conduct is a single element expressing expected behaviour, while a CMS is the broader system of governance, risk assessment, controls, monitoring and improvement. ISO 37301 addresses the whole system, of which the code is one component.

Question 13Fundamental concepts and principles of a compliance management system

Which statement correctly describes the 'Plan-Do-Check-Act' logic as applied within ISO 37301?

  1. It applies only to the internal audit programme
  2. It requires that corrective actions be avoided to preserve stability
  3. It is a one-time certification process that ends once a certificate is issued
  4. It is a cyclical improvement model in which planning, implementation, monitoring and corrective action feed continual improvement of the CMS Correct answer.

Explanation

ISO 37301 uses the Plan-Do-Check-Act cycle to structure the CMS and drive continual improvement. Planning establishes objectives and processes, implementation executes them, checking monitors performance, and acting addresses gaps.

Question 14Fundamental concepts and principles of a compliance management system

What is the role of a compliance obligations register in the CMS?

  1. It lists the financial penalties the organization has already paid
  2. It records employee grievances and disciplinary outcomes
  3. It is a structured record of the requirements applicable to the organization and how each is addressed Correct answer.
  4. It documents only those obligations that the organization has chosen to adopt voluntarily

Explanation

The obligations register consolidates the legal, regulatory, contractual and voluntary requirements applicable to the organization and links them to the controls and owners responsible. It supports traceability and helps ensure obligations are not overlooked.

Question 15Fundamental concepts and principles of a compliance management system

A manager argues that because the organization has a compliance policy, employees will automatically comply. Which ISO 37301 principle best explains why this reasoning is incomplete?

  1. Compliance requires the policy to be supported by leadership example, training, controls and monitoring that embed it in practice Correct answer.
  2. Compliance is achieved once the policy is signed by the governing body
  3. Compliance is the responsibility of external auditors
  4. Compliance depends solely on the severity of penalties in the policy

Explanation

A policy is only one element of the CMS; ISO 37301 requires supporting awareness, competence, operational controls, monitoring and leadership commitment to translate intent into behaviour. Culture and enforcement mechanisms are what make the policy effective.

Question 16Fundamental concepts and principles of a compliance management system

Which of the following best reflects the principle of 'tone at the top' in a compliance management system?

  1. The compliance officer personally reviews every transaction in the organization
  2. The governing body and top management visibly demonstrate commitment to compliance through their decisions and behaviour Correct answer.
  3. The organization publishes its compliance policy only on an internal website
  4. Senior managers delegate all compliance decisions to junior staff

Explanation

Tone at the top means leaders model compliant behaviour, set expectations and are seen to prioritize compliance over short-term results. ISO 37301 treats leadership commitment as a precondition for an effective CMS.

Question 17Fundamental concepts and principles of a compliance management system

What does ISO 37301 mean by 'compliance risk'?

  1. The probability that a competitor will report the organization to a regulator
  2. The financial return generated by compliance investments
  3. The likelihood that the organization will fail to meet a compliance obligation and the consequences of that failure Correct answer.
  4. The cost of the compliance department's annual budget

Explanation

Compliance risk combines the likelihood of noncompliance with the impact of that noncompliance on the organization. It is assessed so that proportionate controls can be designed and prioritized.

Question 18Fundamental concepts and principles of a compliance management system

An organization operates in several countries and faces conflicting local requirements. Under ISO 37301, which approach is most consistent with the standard?

  1. Identify all applicable obligations per jurisdiction and determine how to manage conflicts transparently and proportionately Correct answer.
  2. Apply the least stringent local requirement everywhere to minimize cost
  3. Suspend operations in every jurisdiction until the requirements are harmonized
  4. Ignore local requirements and apply only the headquarters' national law

Explanation

ISO 37301 requires the organization to identify its compliance obligations across its context, including multiple jurisdictions, and to manage them proportionately. Where requirements conflict, the organization must determine a defensible approach and document it.

Question 19Fundamental concepts and principles of a compliance management system

Which element most directly supports the 'independence' of the compliance function?

  1. Outsourcing all compliance decisions to external lawyers
  2. Reporting to the sales director to align compliance with revenue targets
  3. Being free from undue influence and having appropriate authority and access to the governing body Correct answer.
  4. Rotating compliance staff through operational roles every month

Explanation

Independence means the compliance function can act objectively, free from undue commercial or managerial pressure, with sufficient authority and escalation access. This protects the integrity of compliance advice and reporting.

Question 20Fundamental concepts and principles of a compliance management system

What is the significance of the term 'continual improvement' in ISO 37301?

  1. It requires the CMS to be replaced entirely every year
  2. It means the organization must achieve zero nonconformities before certification
  3. It applies only to the compliance training programme
  4. It refers to the recurring process of enhancing CMS performance through monitoring, review and corrective action Correct answer.

Explanation

Continual improvement is the ongoing effort to enhance CMS performance, driven by monitoring, management review, nonconformity handling and corrective action. It recognizes that compliance management must adapt to changing obligations and risks.

Question 21Fundamental concepts and principles of a compliance management system

An auditor observes that the organization's compliance objectives are vague and not measurable. Which ISO 37301 principle is most directly affected?

  1. The requirement that compliance objectives be consistent with the compliance policy and be measurable and monitored Correct answer.
  2. The requirement that all employees hold a law degree
  3. The requirement that the compliance function be outsourced
  4. The requirement that the CMS be certified before any objective is set

Explanation

ISO 37301 requires compliance objectives to be established at relevant functions and levels, to be consistent with the compliance policy, and to be measurable and monitored. Vague objectives cannot be tracked or used to drive improvement.

Question 22Fundamental concepts and principles of a compliance management system

Which situation best illustrates a failure of the principle that compliance responsibilities should be integrated into operational roles?

  1. The compliance officer provides guidance to operational teams
  2. Internal audit tests compliance controls independently
  3. The governing body reviews compliance performance annually
  4. Operational managers treat compliance as the sole responsibility of the compliance officer and ignore obligations in their own processes Correct answer.

Explanation

ISO 37301 distributes compliance responsibilities across the organization, with operational managers accountable for compliance within their areas. Treating compliance as exclusively the compliance officer's job fragments accountability and weakens the CMS.

Question 23Fundamental concepts and principles of a compliance management system

Two departments interpret the same regulatory obligation differently, and both interpretations are documented in their local procedures. What does ISO 37301 imply about this situation?

  1. It is acceptable because each department is autonomous
  2. It is irrelevant because procedures are not part of the CMS
  3. It indicates a need for a consistent approach to interpreting obligations and aligning procedures with the CMS Correct answer.
  4. It is acceptable provided the interpretations are not shared with regulators

Explanation

Consistency in how compliance obligations are interpreted and applied is essential to an effective CMS. Conflicting interpretations signal a need to clarify the obligation centrally and align procedures accordingly.

Question 24Fundamental concepts and principles of a compliance management system

Which statement best captures the relationship between a compliance management system and organizational culture?

  1. A CMS is designed only to satisfy external auditors, not to influence culture
  2. Culture can substitute entirely for a CMS
  3. Culture and formal controls reinforce each other; the CMS should actively shape and monitor culture Correct answer.
  4. Culture is irrelevant once formal controls are in place

Explanation

ISO 37301 recognizes that formal controls alone are insufficient; a healthy compliance culture makes controls effective, and the CMS should promote, measure and reinforce that culture. The two are complementary rather than substitutes.

Question 25Fundamental concepts and principles of a compliance management system

An organization discovers that a new subsidiary has no documented compliance obligations and no assigned compliance responsibilities. Which principle of ISO 37301 is most clearly breached?

  1. The principle that the CMS should cover the entire organization and all its activities within scope, with defined responsibilities Correct answer.
  2. The principle that subsidiaries may set their own compliance standards without oversight
  3. The principle that compliance obligations apply only to the parent company
  4. The principle that compliance responsibilities can be left undefined until a breach occurs

Explanation

ISO 37301 requires the CMS to apply across the organization's scope, with defined roles, responsibilities and obligations at all levels, including new subsidiaries. Gaps in coverage and undefined responsibilities undermine the system's effectiveness.

Question 26Fundamental concepts and principles of a compliance management system

Under ISO 37301, what does the term 'compliance' primarily refer to?

  1. Complying with the internal rules set by the compliance function alone
  2. Meeting the requirements of the organization's own voluntary commitments only
  3. Satisfying the expectations of external auditors during a certification audit
  4. Fulfilling all applicable compliance obligations, including legal and other requirements the organization must or chooses to meet Correct answer.

Explanation

ISO 37301 defines compliance as the outcome of meeting all applicable compliance obligations, which include mandatory legal requirements plus other requirements the organization voluntarily adopts (such as standards, codes, and contractual terms). It is not limited to auditor expectations or internal rules, and it explicitly covers voluntary commitments alongside legal ones.

Question 27Fundamental concepts and principles of a compliance management system

An organization wants its compliance management system to be grounded in the ISO 37301 principle of 'risk-based' compliance. Which action best reflects this principle?

  1. Prioritizing controls and resources according to the likelihood and consequences of non-compliance Correct answer.
  2. Delegating all compliance decisions to external legal counsel
  3. Documenting every possible regulation worldwide before assessing any risk
  4. Applying identical controls to every obligation regardless of its impact

Explanation

A risk-based approach means the organization identifies its compliance risks and allocates controls and resources in proportion to the likelihood and severity of potential non-compliance. Uniform controls or exhaustive documentation ignore proportionality and do not reflect risk-based thinking.

Question 28Fundamental concepts and principles of a compliance management system

In ISO 37301, which statement best describes the relationship between the governing body and the compliance management system?

  1. The governing body delegates all compliance authority and retains no oversight responsibility
  2. The governing body limits its role to approving the annual compliance budget
  3. The governing body assigns accountability to the compliance function so it bears sole responsibility
  4. The governing body ensures the CMS is integrated into the organization's processes and holds ultimate accountability for its effectiveness Correct answer.

Explanation

ISO 37301 places ultimate accountability for the compliance management system with the governing body, which must ensure the CMS is integrated into the organization's business processes and provide oversight. While the compliance function supports and operates the system, accountability cannot be fully delegated away from the top.

Question 29Fundamental concepts and principles of a compliance management system

An auditor finds that the organization treats its compliance management system as a one-time project completed last year, with no subsequent review of obligations or objectives. Which ISO 37301 principle is most directly compromised?

  1. Documented information control
  2. Competence of compliance personnel
  3. Continual improvement of the compliance management system Correct answer.
  4. Impartiality of the compliance function

Explanation

ISO 37301 is built on continual improvement, so the CMS must be regularly reviewed, evaluated and improved rather than treated as a finished project. Failing to revisit obligations and objectives undermines that ongoing cycle, even if documents, staff competence and impartiality are otherwise adequate.

Question 30Compliance management system requirements

Under ISO 37301, which obligation applies to the governing body of an organization establishing a compliance management system?

  1. Delegating all compliance decisions to an external legal counsel
  2. Approving every individual compliance risk assessment performed by operational staff
  3. Outsourcing compliance monitoring to the internal audit function without oversight
  4. Ensuring that the compliance management system is integrated into the organization's business processes Correct answer.

Explanation

ISO 37301 places leadership responsibility at the top of the organization, requiring the governing body to ensure the CMS is integrated into business processes rather than treated as a standalone add-on. This reflects the principle that compliance must be embedded in how the organization actually operates.

Question 31Compliance management system requirements

Which statement best describes the role of a compliance policy within the ISO 37301 framework?

  1. It establishes the organization's commitment to compliance and provides a framework for setting compliance objectives Correct answer.
  2. It documents the results of the most recent internal audit for external stakeholders
  3. It replaces the need for documented procedures across all operational areas
  4. It lists the disciplinary measures applied to employees who breach the code of conduct

Explanation

The compliance policy is a top-level document that communicates commitment to compliance and provides the framework for setting and reviewing compliance objectives. It is not an audit record, a disciplinary catalogue, or a substitute for operational procedures.

Question 32Compliance management system requirements

In ISO 37301, what is the primary purpose of the compliance function within an organization?

  1. To independently audit the organization's financial statements
  2. To replace line management's responsibility for compliance in operational units
  3. To guarantee that no compliance breaches will ever occur in the organization
  4. To provide specialist advice, support, and oversight for the compliance management system Correct answer.

Explanation

The compliance function provides specialist expertise, support, and oversight, helping the organization operate its CMS effectively. It cannot guarantee the absence of breaches and does not replace line management accountability.

Question 33Compliance management system requirements

Which element is essential when establishing the scope of a compliance management system under ISO 37301?

  1. The list of competitors operating in the same market sector
  2. The compliance obligations and the organizational boundaries to which the CMS applies Correct answer.
  3. The personal preferences of the chief executive officer regarding compliance priorities
  4. Only the legal requirements applicable in the organization's headquarters country

Explanation

Scope definition requires identifying the compliance obligations the organization must address and the organizational boundaries, activities, and interfaces to which the CMS applies. This ensures the CMS is appropriately tailored and complete.

Question 34Compliance management system requirements

Which of the following best describes a compliance obligation under ISO 37301?

  1. A requirement that the organization must comply with, including legal requirements and voluntary commitments Correct answer.
  2. An internal audit finding that has not yet been closed
  3. A financial target set by the board of directors for the compliance department
  4. A recommendation from an external consultant that the organization may adopt at its discretion

Explanation

Compliance obligations encompass mandatory legal and regulatory requirements as well as voluntary commitments such as contractual obligations, industry standards, and codes of conduct that the organization has chosen to adopt. They are not discretionary recommendations, financial targets, or audit findings.

Question 35Compliance management system requirements

What is the primary objective of a compliance risk assessment under ISO 37301?

  1. To satisfy external auditors without influencing decisions
  2. To assign blame to departments that have already caused breaches
  3. To identify and evaluate compliance risks so that appropriate controls can be determined Correct answer.
  4. To calculate the exact financial cost of every possible regulatory penalty

Explanation

A compliance risk assessment identifies and evaluates risks associated with compliance obligations, providing the basis for selecting and prioritizing controls. It is a forward-looking decision-making tool, not a cost calculator, blame exercise, or box-ticking activity.

Question 36Compliance management system requirements

Which type of evidence is most appropriate for demonstrating that compliance training has been effective in an ISO 37301 CMS?

  1. An email announcing that training will take place next quarter
  2. A list of employees who registered for the training sessions
  3. Records of assessment results and observed changes in workplace behaviour Correct answer.
  4. A copy of the training provider's marketing brochure

Explanation

Effectiveness evidence goes beyond attendance and shows that competence and behaviour have changed, such as assessment outcomes and observed performance. Registration lists and announcements demonstrate activity, not effectiveness.

Question 37Compliance management system requirements

Which statement correctly reflects the relationship between ISO 37301 and ISO 19011?

  1. ISO 37301 and ISO 19011 are identical documents with different titles
  2. ISO 19011 specifies compliance obligations that must be incorporated into a CMS
  3. ISO 37301 specifies the compliance management system requirements, while ISO 19011 provides guidance on auditing management systems Correct answer.
  4. ISO 37301 replaces ISO 19011 for all internal audits

Explanation

ISO 37301 sets the requirements for a compliance management system, whereas ISO 19011 provides guidance on principles and approaches for auditing management systems. Auditors apply ISO 19011 guidance when auditing against ISO 37301 requirements.

Question 38Compliance management system requirements

An organization has identified a new regulatory requirement affecting one of its product lines. According to ISO 37301, what should the organization do as part of its compliance obligations management process?

  1. Delegate the matter entirely to the external legal advisor without internal action
  2. Record the requirement in the risk register without further evaluation
  3. Update its identification of compliance obligations and assess the associated risks and controls Correct answer.
  4. Wait until the next scheduled management review to consider the new requirement

Explanation

ISO 37301 requires the organization to maintain a current understanding of its compliance obligations and to respond to changes by reassessing risks and controls. Passive waiting or mere recording without evaluation does not satisfy this requirement.

Question 39Compliance management system requirements

A compliance manager wants to determine whether a newly implemented control is operating as intended. Which action best aligns with ISO 37301 monitoring requirements?

  1. Defining monitoring indicators and periodically measuring control performance Correct answer.
  2. Waiting for an external audit to detect control failures
  3. Relying on employee self-declarations of compliance without verification
  4. Reviewing the control design document once at the time of implementation

Explanation

Monitoring under ISO 37301 involves defining what to monitor, methods, timing, and indicators, then measuring performance over time. A one-time design review, unverified self-declarations, and reliance on external audits do not provide ongoing assurance that controls operate effectively.

Question 40Compliance management system requirements

During a compliance audit, an auditor finds that a documented procedure exists but staff are unfamiliar with it. How should the auditor interpret this finding under ISO 37301?

  1. The finding should be ignored because documentation is the only requirement
  2. The finding should be recorded as an observation only, with no further action
  3. There is potential nonconformity because the procedure is not effectively communicated and implemented Correct answer.
  4. The CMS is fully conformant because documentation exists

Explanation

ISO 37301 requires documented information to be communicated and available where needed, and controls must be implemented, not merely documented. A procedure unknown to staff indicates a possible nonconformity in communication and implementation.

Question 41Compliance management system requirements

Which approach best demonstrates top management's commitment to the compliance management system during an audit interview?

  1. Stating that compliance is handled entirely by the legal department
  2. Explaining how compliance objectives are integrated into business planning and performance reviews Correct answer.
  3. Confirming that compliance meetings are held only after incidents occur
  4. Describing compliance as a cost centre with no strategic relevance

Explanation

ISO 37301 expects top management to demonstrate leadership by integrating compliance into business strategy, objectives, and performance management. Delegating everything to legal, reactive-only meetings, or dismissing compliance strategically contradicts this expectation.

Question 42Compliance management system requirements

An organization identifies a compliance risk with high likelihood and severe consequences. According to ISO 37301, what is the most appropriate next step?

  1. Accept the risk without further action because it is too difficult to control
  2. Remove the risk from the register to avoid reporting obligations
  3. Determine and implement controls proportionate to the risk and monitor their effectiveness Correct answer.
  4. Transfer the entire responsibility to a third party and take no further action

Explanation

ISO 37301 requires the organization to take action to address compliance risks and to evaluate the effectiveness of that action. Controls should be proportionate to the risk, and monitoring ensures they remain effective.

Question 43Compliance management system requirements

Which of the following is the best example of a compliance objective that satisfies ISO 37301 requirements?

  1. Purchase a new compliance software platform
  2. Reduce the number of late regulatory filings by 50 percent within the next 12 months Correct answer.
  3. Improve compliance culture generally as soon as possible
  4. Ensure that everyone always complies with everything

Explanation

Compliance objectives should be measurable, relevant to compliance obligations, monitored, and set within a defined timeframe. A specific, quantified target such as reducing late filings by 50 percent in 12 months meets these criteria, whereas vague aspirations or a procurement action do not.

Question 44Compliance management system requirements

An auditor is reviewing how an organization handles a compliance breach. Which sequence best reflects the corrective action process under ISO 37301?

  1. Close the breach record immediately to keep the register clean
  2. Ignore the breach if it was reported by a customer rather than an employee
  3. React to the breach, evaluate the need to eliminate the cause, implement action, and review its effectiveness Correct answer.
  4. Apply disciplinary action first and investigate the cause only if time permits

Explanation

Corrective action requires reacting to the nonconformity, evaluating the need to eliminate root causes, implementing action, and reviewing effectiveness. Skipping cause analysis or closing records prematurely does not address the underlying issue.

Question 45Compliance management system requirements

What is the primary reason ISO 37301 requires the organization to maintain documented information as evidence of compliance?

  1. To increase the volume of paperwork available to regulators
  2. To satisfy marketing claims about regulatory excellence
  3. To shift responsibility for compliance onto the documentation itself
  4. To provide evidence that processes are being carried out as planned and that the CMS is effective Correct answer.

Explanation

Documented information serves as evidence that the CMS processes are performed as planned and supports demonstration of conformity. It is a means of assurance, not paperwork for its own sake or a substitute for actual compliance.

Question 46Compliance management system requirements

An organization's compliance function reports directly to the chief executive officer and has a dotted-line reporting relationship to the audit committee. How does this arrangement support ISO 37301 requirements?

  1. It eliminates the need for a compliance policy
  2. It transfers compliance responsibility from line management to the compliance function
  3. It ensures the compliance function has appropriate authority, independence, and access to top management Correct answer.
  4. It removes the requirement for internal audits of compliance processes

Explanation

ISO 37301 expects the compliance function to have the authority, independence, and access to top management necessary to perform its role effectively. Reporting lines that provide both executive access and governance oversight support this.

Question 47Compliance management system requirements

When planning a compliance audit, which factor should most influence the audit programme's sampling and frequency?

  1. The personal seniority of the auditor assigned to the audit
  2. The preference of the auditee for a shorter audit
  3. The number of pages in the compliance manual
  4. The risk level and compliance performance of the processes being audited Correct answer.

Explanation

Audit programmes should be risk-based, with frequency and depth reflecting the compliance risk and performance of the processes concerned. Auditor seniority, document length, and auditee convenience are not valid determinants of audit sampling.

Question 48Compliance management system requirements

Which statement best explains the difference between a compliance obligation and a compliance risk under ISO 37301?

  1. An obligation is a requirement the organization must meet; a risk is the effect of uncertainty on meeting that obligation Correct answer.
  2. An obligation is always financial; a risk is always reputational
  3. An obligation applies only to executives; a risk applies only to operational staff
  4. An obligation is optional; a risk is mandatory

Explanation

Compliance obligations are the requirements the organization must satisfy, while compliance risk relates to the effect of uncertainty on the organization's ability to meet those obligations. The two concepts are related but distinct.

Question 49Compliance management system requirements

An organization discovers that a supplier processing personal data on its behalf is not meeting contractual compliance requirements. Under ISO 37301, what should the organization consider first?

  1. Evaluating the compliance risk and determining appropriate action, including supplier controls and contractual remedies Correct answer.
  2. Terminating all business with the supplier immediately without further analysis
  3. Reporting the supplier to the regulator before assessing the facts
  4. Taking no action because the supplier is a separate legal entity

Explanation

ISO 37301 requires the organization to manage compliance risks arising from external providers through appropriate controls and contractual arrangements. The organization should evaluate the risk and determine proportionate action rather than acting reflexively or ignoring its responsibility.

Question 50Compliance management system requirements

An auditor identifies that the organization's compliance risk assessment has not been updated despite significant changes to its operating markets. Which conclusion is most defensible?

  1. The risk assessment process may not be effective because it does not respond to changing circumstances Correct answer.
  2. The CMS is conformant because a risk assessment was performed at some point
  3. The finding is irrelevant because risk assessments are one-time activities
  4. The organization should remove the risk assessment from its CMS scope

Explanation

ISO 37301 requires risk assessment to be an ongoing process that reflects changes in the organization's context and obligations. A static assessment that ignores significant market changes indicates a potential failure of the process's effectiveness.