Free PECB Certified ISO 37301 Lead Implementer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified ISO 37301 Lead Implementer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A compliance project has separate legal, operations, and human-resources activities. What makes their arrangement a management system?

   1. A.The activities follow a shared annual calendar
   2. B.The activities are managed as related parts to achieve objectivesCorrect answer: B
   3. C.The activities are assigned to a single external adviser
   4. D.The activities produce an identical set of written records

   Explanation: ISO 37301:2021 Frequently Asked Questions states: "manages the inter-related parts of its business in order to achieve its objectives." A management system connects business activities to objectives; a calendar, outsourcing arrangement, or uniform records alone do not establish that relationship.

   Reference: ISO 37301:2021 Frequently Asked Questions — p. 1, question 2

2. 2Which role holds ultimate responsibility for organizational governance and holds top management accountable?

   1. A.The internal audit team
   2. B.The compliance function
   3. C.The governing bodyCorrect answer: C
   4. D.The project steering secretary

   Explanation: ISO 37301:2021 published preview states: "to which top management (3.3) reports and by which top management is held accountable" The governing body is the ultimate governance authority; the other roles do not inherently hold that authority.

   Reference: ISO 37301:2021 published preview — Clause 3.21

3. 3A CMS planner reviews changes in regulation and the organization's reporting structure. How do these inputs relate to context analysis?

   1. A.Both are external because neither is a compliance objective
   2. B.Both are internal because the organization must respond to them
   3. C.Regulation is an external factor; reporting structure is an internal factorCorrect answer: C
   4. D.Regulation is a risk treatment; reporting structure is a risk consequence

   Explanation: PECB: ISO 31000:2018 Risk Management Guidelines states: "external environment (political, social, etc.) and internal environment (objectives, strategies, structures, ethics, discipline, etc.)." Context analysis considers both environments: regulation arises externally, while the reporting structure is part of the organization's internal arrangements.

   Reference: PECB: ISO 31000:2018 Risk Management Guidelines — III. Implementing the Risk management process — Establishing the context

4. 4An organization outsources a service relevant to its CMS. What remains necessary under PECB's explanation of compliance controls?

   1. A.Treating the supplier's own policies as automatic evidence of conformity
   2. B.Removing the outsourced service from compliance control activities
   3. C.Ensuring the service is controlled to the necessary extent and on timeCorrect answer: C
   4. D.Transferring every applicable obligation to the supplier's certification body

   Explanation: PECB Whitepaper on ISO 37301:2021 states: "ensure that all externally provided products and services relevant to the CMS are controlled to the necessary extent and in a timely manner." Outsourcing does not remove the need for appropriate control over relevant external services.

   Reference: PECB Whitepaper on ISO 37301:2021 — Compliance Controls and Procedures

5. 5A CMS team regularly checks whether required reviews are being completed and whether controls remain operational. Which ISO 37301 concept describes determining this status?

   1. A.Certification
   2. B.Correction
   3. C.MonitoringCorrect answer: C
   4. D.Risk sharing

   Explanation: ISO 37301:2021 published preview states: "determining the status of a system, a process (3.8) or an activity" Monitoring determines status; certification, correction, and risk sharing serve different functions.

   Reference: ISO 37301:2021 published preview — Clause 3.20

6. 6An obsolete CMS instruction is found at a workstation. Replacing it with the current approved instruction addresses the detected problem. How is that immediate response distinguished from action on its cause?

   1. A.It is complete corrective action because a current instruction is now available
   2. B.It is preventive action because other workstations have not reported the problem
   3. C.It is correction rather than necessarily complete corrective actionCorrect answer: C
   4. D.It is cause analysis because replacing the copy establishes why it was obsolete

   Explanation: ISO/IAF APG: Nonconformity—Review and Closing states: "replacing an obsolete procedure with the current issue" Replacing the obsolete instruction corrects the detected nonconformity. It does not, by itself, establish the cause or eliminate it; the absence of reports elsewhere does not turn a response to an existing problem into preventive action.

   Reference: ISO/IAF APG: Nonconformity—Review and Closing — p. 2, Review of actions in response to a nonconformity

7. 7An organization wants independent certification of its CMS to ISO 37301. Which statement correctly distinguishes the roles involved?

   1. A.ISO develops the standard and directly certifies each organization
   2. B.ISO certification is issued by the organization's own governing body
   3. C.An external certification body certifies; ISO develops standardsCorrect answer: C
   4. D.A training attendance certificate is the organization's CMS certification

   Explanation: ISO 37301:2021 Frequently Asked Questions states: "ISO develops international standards, but does not perform certification and does not issue certifications." Certification is performed by bodies external to ISO, not by ISO itself or through an individual's training certificate.

   Reference: ISO 37301:2021 Frequently Asked Questions — p. 2, question 6

8. 8A company voluntarily commits to an industry code alongside its statutory duties. How should it understand compliance in its CMS?

   1. A.It concerns statutory duties while the code remains outside compliance
   2. B.It concerns the code while statutory duties remain outside compliance
   3. C.It includes both statutory duties and the commitments it has adoptedCorrect answer: C
   4. D.It includes the code only when a regulator formally enacts it

   Explanation: PECB Whitepaper on ISO 37301:2021 states: "include organizational requirements, voluntary commitments, codes of practice, industry standards, and so on." Compliance extends beyond legislation, so an adopted code belongs within the organization's compliance considerations.

   Reference: PECB Whitepaper on ISO 37301:2021 — Introduction

9. 9A CMS covers one subsidiary of a larger group. Who is top management for that defined system?

   1. A.Those who direct and control the covered subsidiaryCorrect answer: A
   2. B.Only the parent group's shareholders in general meeting
   3. C.Every employee who supervises work at the subsidiary
   4. D.Only the external consultant directing implementation

   Explanation: ISO 37301:2021 published preview states: "top management refers to those who direct and control that part of the organization." Top management is assessed against the system's organizational scope, rather than automatically being every group-level or supervisory role.

   Reference: ISO 37301:2021 published preview — Clause 3.3, note 2

10. 10A local community believes a proposed organizational activity will affect it, even though it has no contract with the organization. What CMS planning concept includes it?

    1. A.An interested partyCorrect answer: A
    2. B.An internal process owner
    3. C.A certification decision maker
    4. D.A delegated governing body

    Explanation: ISO 37301:2021 published preview states: "can affect, be affected by, or perceive itself to be affected by a decision or activity" Interested-party status is not limited to contractual counterparties; perceived effects can establish the relationship described by the definition.

    Reference: ISO 37301:2021 published preview — Clause 3.2