ISO 37301:2021 コンプライアンス管理システム—使用に関するガイダンス付きの要件 | ページ 6

3.1

organization

person or group of people that has its own functions with responsibilities, authorities and relationships to achieve its objectives (3.6)

Note 1 to entry: The concept of organization includes, but is not limited to, sole-trader, company, corporation, firm, enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated or not, public or private.

Note 2 to entry: If the organization is part of a larger entity, the term “organization” refers only to the part of the larger entity that is within the scope of the compliance management system.

3.2

interested party (preferred term)

stakeholder (admitted term)

person or organization (3.1) that can affect, be affected by, or perceive itself to be affected by a decision or activity

3.3

top management

person or group of people who directs and controls an organization (3.1) at the highest level

Note 1 to entry: Top management has the power to delegate authority and provide resources within the organization.

Note 2 to entry: If the scope of the management system (3.4) covers only part of an organization, then top management refers to those who direct and control that part of the organization.

Note 3 to entry: For the purposes of this document, the term “top management” refers to the highest level of executive management.

3.4

management system

set of interrelated or interacting elements of an organization (3.1) to establish policies (3.5) and objectives (3.6) as well as processes (3.8) to achieve those objectives

Note 1 to entry: A management system can address a single discipline or several disciplines.

Note 2 to entry: The management system elements include the organization’s structure, roles and responsibilities, planning and operation.

3.5

policy

intentions and direction of an organization (3.1) , as formally expressed by its top management (3.3)

Note 1 to entry: A policy can also be formally expressed by an organization’s governing body (3.21) .

3.6

objective

result to be achieved

Note 1 to entry: An objective can be strategic, tactical, or operational.

Note 2 to entry: Objectives can relate to different disciplines (such as finance, health and safety, and environment). They can be, for example, organization-wide, or specific to a project, product, service or process (3.8) ).

Note 3 to entry: An objective can be expressed in other ways, e.g. as an intended result, a purpose, an operational criterion, as a compliance (3.26) objective, or by the use of other words with similar meaning (e.g. aim, goal, or target).

Note 4 to entry: In the context of compliance management systems (3.4) , compliance objectives are set by the organization (3.1) , consistent with the compliance policy (3.5) , to achieve specific results.

3.7

risk

effect of uncertainty on objectives (3.6)

Note 1 to entry: An effect is a deviation from the expected – positive or negative.

Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of, an event, its consequence, or likelihood.

Note 3 to entry: Risk is often characterized by reference to potential “events” (as defined in ISO Guide 73) and “consequences” (as defined in ISO Guide 73), or a combination of these.

Note 4 to entry: Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated “likelihood” (as defined in ISO Guide 73) of occurrence.

3.8

process

set of interrelated or interacting activities that uses or transforms inputs to deliver a result

Note 1 to entry: Whether the result of a process is called output, product or service depends on the context of the reference.

3.9

competence

ability to apply knowledge and skills to achieve intended results

3.10

documented information

information required to be controlled and maintained by an organization (3.1) and the medium on which it is contained

Note 1 to entry: Documented information can be in any format and media, and from any source.

3.11

performance

measurable result

Note 1 to entry: Performance can relate either to quantitative or qualitative findings.

Note 2 to entry: Performance can relate to managing activities, processes (3.8) , products, services, systems or organizations (3.1) .

3.12

continual improvement

recurring activity to enhance performance (3.11)

3.13

effectiveness

extent to which planned activities are realized and planned results are achieved

3.14

requirement

need or expectation that is stated, generally implied or obligatory

Note 1 to entry: “Generally implied” means that it is custom or common practice for the organization (3.1) and interested parties (3.2) that the need or expectation under consideration is implied.

Note 2 to entry: A specified requirement is one that is stated, e.g. in documented information (3.10) .

3.15

conformity

fulfilment of a requirement (3.14)

3.16

nonconformity

non-fulfilment of a requirement (3.14)

Note 1 to entry: A nonconformity is not necessarily a noncompliance (3.27) .

3.17

corrective action

action to eliminate the cause(s) of a nonconformity (3.16) and to prevent recurrence

3.18

audit

systematic and independent process (3.8) for obtaining evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled

Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party (3.30) ), and it can be a combined audit (combining two or more disciplines).

Note 2 to entry: An internal audit is conducted by the organization (3.1) itself, or by an external party on its behalf.

Note 3 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011.

Note 4 to entry: Independence can be demonstrated by the freedom from responsibility for the activity being audited or freedom from bias and conflict of interest.

3.19

measurement

process (3.8) to determine a value

3.20

monitoring

determining the status of a system, a process (3.8) or an activity

Note 1 to entry: To determine the status, there can be a need to check, supervise or critically observe.

3.21

governing body

person or group of persons that has the ultimate responsibility and authority for an organization’s (3.1) activities, governance and policies (3.5) and to which top management (3.3) reports and by which top management is held accountable

Note 1 to entry: Not all organizations, particularly small organizations, will have a governing body separate from top management.

Note 2 to entry: A governing body can include, but is not limited to, a board of directors, committees of the board, a supervisory board or trustees.

3.22

personnel

individuals in a relationship recognized as a work relationship in national law or practice, or in any contractual relationship that depends on its activity from the organization (3.1)

3.23

compliance function

person or group of persons with responsibility and authority for the operation of the compliance (3.26) management system (3.4)

Note 1 to entry: Preferably one individual will be assigned to the oversight of the compliance management system.

3.24

compliance risk

likelihood of occurrence and the consequences of noncompliance (3.27) with the organization’s (3.1) compliance obligations (3.25)

3.25

compliance obligations

requirements (3.14) that an organization (3.1) mandatorily has to comply with as well as those that an organization voluntarily chooses to comply with

3.26

compliance

meeting all the organization’s (3.1) compliance obligations (3.25)

3.27

noncompliance

non-fulfilment of compliance obligations (3.25)

3.28

compliance culture

values, ethics, beliefs and conduct (3.29) that exist throughout an organization (3.1) and interact with the organization’s structures and control systems to produce behavioural norms that are conducive to compliance (3.26)

3.29

conduct

behaviours and practices that impact outcomes for customers, employees, suppliers, markets and communities

3.30

third party

person or body that is independent of the organization (3.1)

Note 1 to entry: All business associates are third parties, but not all third parties are business associates.

3.31

procedure

specified way to carry out an activity or a process (3.8)

[SOURCE: ISO 9000:2015, 3.4.5]