General
The governing body of the entity performs evaluate, direct, monitor and communicate, and top management is fully involved in the operation of the organization.
What clause 7.3.1 asks
The four processes belong to the entity's governing body. Top management is always involved in running the organization, because that is what the organization is. An entity may hold more than one management system, and it may also govern activities that sit in no management system at all. So the four processes are not a life cycle for one system; they are the board's work across everything it governs. A later clause and an annex show how the processes work when the system covers part of an entity or is shared by several. The processes do not change with the structure. What changes is who holds which seat.
Why it matters
The general clause prevents a common misreading. Teams sometimes treat the four processes as a project sequence that ends when the certificate is issued. The text places them in the governing body and keeps them running. It also allows for governance over activities that no management system covers, which is important in a group where some functions have a formal system and others do not. The practical question for a board is not whether it has a process diagram. It is whether each of the four processes has a recurring slot, an input it can rely on, a decision it is allowed to take and a record that survives the meeting.
What good looks like
Put the four processes on the board calendar with a fixed cadence. For each, name the input, the decision, the record and the person who prepares it. Check that the top management of each management system is in the room for the parts that concern it. Where the entity governs an activity outside any management system, add it to the scope of the cycle rather than leaving it to a function. Review the calendar once a year against the entity structure.
Evidence a board or an auditor asks for
The board calendar with the four processes and their cadence; the input and record for each slot; the attendance list showing top management of each management system; the scope note covering governed activities outside a management system.
- Record The board calendar with the four processes and their cadence
- Record the input and record for each slot
- Record the attendance list showing top management of each management system
- Record the scope note covering governed activities outside a management system
Where it commonly fails
- A process diagram with no meeting behind it
- Governance limited to the certified scope and blind to the rest of the entity
- Top management absent from the cycle that sets its objectives
What to do before publication
Before the edition 3 text is published, put clause 7.3.1 on the entity governance and the objectives agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
← 7.2.6 Objective 6: Ensure the security performance meets current and future requirements of the entity7.3.2 Evaluate →