Compliance Management System Requirements
Domain 2 tests clause-level knowledge of ISO 37301:2021, Clauses 4–10, and your ability to match an audited situation to the correct requirement. You need to know what is required, not just what is recommended.
Requirement map
- Clause 4 – Context: determine external and internal issues, interested parties and their relevant requirements, the CMS scope, and the processes needed.
- Clause 5 – Leadership: top management commitment, a compliance policy, and assigned roles, responsibilities, and authorities. The policy must commit to satisfying compliance obligations and to continual improvement.
- Clause 6 – Planning: actions to address risks and opportunities, compliance risk assessment, compliance objectives, and planning of changes.
- Clause 7 – Support: resources, competence, awareness, communication, and documented information.
- Clause 8 – Operation: operational planning and control, including controls over outsourced processes.
- Clause 9 – Performance evaluation: monitoring, measurement, analysis, evaluation, internal audit, and management review.
- Clause 10 – Improvement: continual improvement, nonconformity, and corrective action.
Worked example
An auditor reads a compliance policy that says: 'We comply with all applicable laws.' It contains no commitment to continual improvement and there is no evidence that it has been communicated. The auditor maps the first gap to Clause 5.2, which requires both commitments, and the second to Clause 7.4. Because the policy is missing a required commitment, it is a nonconformity, not merely an improvement opportunity. Communication is a separate finding only if the communication requirement itself is unmet.
Traps
Do not cite ISO 19600 as a requirement source. Do not accept a training folder as proof of competence without checking effectiveness. Do not confuse compliance objectives with general business targets. Remember governing-body oversight and management review inputs; both are commonly missed.