Fundamental Concepts and Principles of a Compliance Management System
This domain tests whether you can explain what 'compliance' means under ISO 37301:2021 and why a compliance management system (CMS) is more than a policy set. Questions often probe principles, the PDCA cycle, and the difference between a guidance standard and a certifiable requirements standard.
Core concepts
- Compliance is meeting all compliance obligations: legal, regulatory, contractual, and voluntary commitments such as standards and codes.
- A CMS is a set of interrelated elements used to direct and control an organization with respect to compliance. ISO 37301:2021 is a requirements standard; ISO 19600:2014 was guidance only.
- The principles include good governance, proportionality, transparency, accountability, and sustainability. They shape how controls are designed, not whether requirements apply.
- Top management and the governing body provide direction and oversight; the compliance function should have authority, resources, and access to the governing body.
- The CMS follows Plan–Do–Check–Act: context and risk assessment, operation and support, monitoring and audit, then improvement.
Worked example
A logistics firm publishes a 40-page code of conduct and declares its CMS complete. An auditor reasons: a policy is only one element. There is no context analysis, no register of compliance obligations, no compliance risk assessment, and no monitoring. The policy also lacks a commitment to continual improvement. The correct conclusion is that the organization has not implemented a functioning CMS, even though it has a documented policy.
Traps
Do not equate compliance with legal compliance only; contractual and voluntary obligations count. Do not treat ISO 19600 guidance as auditable requirements. Certification does not guarantee zero noncompliance. Proportionality allows scaled controls, but it does not remove requirements.