ISO 37301: ISO 37301 – Tutorial (about 60 minutes)

ISO 37301 is the international standard that sets out requirements, with guidance for use, for a compliance management system (CMS): the policies, roles, processes and controls an organisation uses to know which obligations apply to it, to meet them day after day, and to detect, investigate and correct failures. Companies of every size, public bodies and non-profit organisations use it to design or benchmark their compliance programmes, and many seek an independent certificate against it. After this tutorial you will be able to explain how the standard is built, identify compliance obligations and assess compliance risk, set up the roles and controls it expects, run a speak-up and investigation process, and understand what an auditor looks for.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is ISO 37301:2021, Compliance management systems — Requirements with guidance for use, published in April 2021 by ISO technical committee ISO/TC 309 (Governance of organizations). It is the first edition under the number 37301 and it replaced ISO 19600:2014, which gave guidelines only and has been withdrawn. In February 2024 ISO published Amendment 1 (ISO 37301:2021/Amd 1:2024, "Climate action changes"), the same short amendment added to many management system standards at that time; it asks the organisation to consider whether climate change is a relevant issue for its context and notes that interested parties may have climate-related requirements. ISO completed a systematic review of the standard in 2026 and confirmed the 2021 edition on 2026-08-03, so no new edition is in preparation at the time of writing. This tutorial teaches ISO 37301:2021 with its 2024 amendment, which is the version used for certification audits. Verified 2026-10-29 on the ISO catalogue entries for ISO 37301:2021 and its Amendment 1 and on national standards-body listings (SIS, DIN).

Who this is for: compliance officers and those about to become one, lawyers and in-house counsel, risk managers, internal auditors, quality, security, environmental and health-and-safety managers who run other management systems, finance and procurement leads, HR professionals, and engineers or product owners in regulated industries who keep hearing "is this compliant?" and want to understand the system behind the question. It is also useful for board members and executives who must oversee a compliance programme.

Prerequisites: none. A general idea of how an organisation is run (governance, departments, suppliers) helps. If you have met another ISO management system standard such as ISO 9001 or ISO/IEC 27001 you will recognise the clause structure, but this is not required.

Learning objectives. After this tutorial you will be able to:

Explain what a compliance management system is, why ISO 37301 exists and how it differs from its predecessor ISO 19600.
Use the core vocabulary correctly, in particular compliance obligation, compliance risk, compliance culture, compliance function, noncompliance and nonconformity.
Describe the clause 4 to 10 structure of the standard and the topics that make it specific to compliance.
Plan the practical steps of building a CMS: an obligations register, a compliance risk assessment, controls, training, speak-up channels, investigations, monitoring and reporting.
Explain how conformity is assessed, what certification does and does not prove, and how regulators judge whether a programme is effective.
Apply the standard to a realistic organisation and relate it to ISO 37001, ISO 37002, ISO 37000, ISO 31000 and other frameworks.

Lesson 1 – Origins, purpose and scope

Why compliance needs a system

Every organisation lives under rules it did not write: laws on bribery, competition, sanctions and export controls, data protection, tax, employment, product safety, the environment and financial reporting, plus licences, permits and the conditions regulators attach to them. On top of those, most organisations choose to commit to more: a code of conduct, customer contract clauses, industry codes, sustainability pledges. Breaking any of these can lead to fines, criminal charges against the company and its managers, exclusion from public tenders, lost licences, damaged trust and, in the worst cases, harm to people.

When serious compliance failures are investigated, the root cause is rarely that nobody knew the law existed. More often nobody owned the obligation, the rule changed and no one noticed, sales bonuses rewarded the behaviour that caused the breach, a third party acting on the company's behalf was never checked, employees saw problems but had no safe way to say so, or warnings reached management and were ignored. These are failures of a system, not of a single person. ISO 37301 exists to help organisations build that system deliberately, rather than relying on a handful of policies and the goodwill of individuals.

From ISO 19600 to ISO 37301

ISO first published guidance on compliance management in 2014 as ISO 19600. It was a guidance document: it used "should" throughout, so an organisation could follow it but nobody could be certified against it. Over the following years many organisations, regulators and business partners asked for something stronger, a document that would say what a CMS must contain so that conformity could be checked independently. ISO/TC 309, the committee responsible for governance of organisations, reworked ISO 19600 into a requirements standard, and ISO 37301 was published in April 2021, replacing ISO 19600.

The change from guidance to requirements is the most important fact to remember. In ISO language ISO 37301 is a "type A" management system standard: its clauses contain "shall" statements that an organisation must meet if it claims conformity, and it can be used for third-party certification. Each requirement is supported by explanatory guidance in Annex A, which is informative (it helps you interpret the requirements but adds no new ones). That is what "requirements with guidance for use" in the title means.

Scope: who can use it

The standard is deliberately generic. It applies to any organisation regardless of type, size, sector or nature of activity, and whether it is in the public, private or not-for-profit sector. A multinational bank, a 60-person engineering firm, a municipality and a charity can all use it, but each will implement it very differently. The text recognises one structural difference explicitly: where it gives tasks to the governing body (for example a board of directors), and an organisation has no separate governing body, those tasks fall on top management.

Equally important is what the standard does not do. It does not tell you which laws apply to you, does not contain legal advice, and does not list controls for any specific topic such as anti-money-laundering or privacy. It is a framework for managing whatever obligations apply to the organisation. It also does not replace topic-specific standards: an organisation fighting bribery would usually look at ISO 37001 as well, and one handling personal data would look at privacy laws and related standards. ISO 37301 provides the umbrella that keeps all these topics managed in one consistent way.

Why organisations adopt it

To build or benchmark a programme. It gives a recognised checklist of what a mature compliance programme contains, which is useful for a new compliance officer or for a gap analysis.
To demonstrate good faith. Regulators, prosecutors and courts in several jurisdictions take into account whether an organisation had an effective compliance programme when something went wrong. A programme built on an international standard is easier to explain and evidence, although it is never an automatic defence.
To satisfy business partners. Customers, investors and lenders increasingly ask suppliers to show how they manage compliance, and a certificate or a documented CMS answers those questions efficiently.
To integrate. Because it uses the same high-level clause structure as ISO 9001, ISO 14001, ISO/IEC 27001 and ISO 37001, it can be combined with existing management systems instead of creating a parallel bureaucracy.

Lesson 2 – Key concepts and vocabulary

Clause 3 of ISO 37301 defines its terms, many shared with every ISO management system standard and some specific to compliance. The explanations below are paraphrased; the precise definitions are in the standard itself.

Compliance management system (CMS) – the set of interrelated elements (policy, objectives, roles, processes, controls, records) an organisation uses to manage compliance. It is a way of working, not a document or a software tool.
Compliance obligation – anything the organisation has to comply with, either because it is required to or because it has chosen to. The standard groups obligations into two families: mandatory requirements and voluntary commitments.
Mandatory requirement – an obligation imposed on the organisation from outside, such as laws and regulations, permits and licences, regulator orders and guidance, court and tribunal decisions, and treaties.
Voluntary commitment – an obligation the organisation takes on by its own choice, for example adopting an industry code of practice, signing up to a sustainability initiative, or publishing its own code of conduct. Once adopted, it is managed with the same seriousness as a law.
Compliance – meeting all of the organisation's compliance obligations. Noncompliance is failing to meet one of them.
Nonconformity – failing to fulfil a requirement of the management system itself (for example, the internal audit programme was not carried out). Learners often confuse this with noncompliance: missing an internal audit is a nonconformity; paying a bribe or missing a regulatory filing deadline is a noncompliance. One can exist without the other, and both must be corrected.
Compliance risk – the combination of how likely a noncompliance is and how severe its consequences would be. It is a specific kind of risk that is always tied back to one or more compliance obligations.
Compliance culture – the shared values, ethics, beliefs and behaviour throughout the organisation that, together with its structures and controls, make compliant conduct the normal way of working. It is the "soft" side of the system and arguably the most important.
Compliance function – the person or people given responsibility and authority for operating the CMS. It may be a single compliance officer, a department, or a role shared with other duties in a small organisation, and it can be partly outsourced.
Governing body – the group or person with ultimate responsibility and authority for the organisation's activities, governance and policies, to whom top management reports, such as a board of directors or supervisory board.
Top management – the person or group who direct and control the organisation at the highest level, typically the chief executive and executive team.
Personnel – the people who work for the organisation, including employees and others under its direction such as temporary workers. Third party – a person or body independent of the organisation, such as an agent, distributor, supplier or joint-venture partner, whose actions can still create compliance risk for it.
Interested party – a person or organisation that can affect, be affected by, or perceive itself to be affected by a decision or activity: regulators, customers, investors, employees, communities.
Documented information – information the organisation must control and keep, together with the medium it is held on: policies, procedures, registers, training records, investigation files, reports.

How the core ideas connect

The logic of the whole standard can be read in one chain. The organisation first works out its context and the expectations of interested parties. From that it identifies its compliance obligations, both mandatory and voluntary. For each obligation it asks how compliance could fail and how bad that would be: that is its compliance risk. It then designs proportionate controls and procedures to reduce the risks it judges unacceptable, and it monitors whether those controls work. When noncompliance happens anyway, it is detected, investigated and corrected, and the lessons flow back into the risk assessment.

Figure 1 – The core chain of ISO 37301: context leads to obligations, obligations lead to compliance risks, risks drive controls, and monitoring and correction feed back into the risk assessment.

A useful idea running through the standard is proportionality. The introduction links effective compliance to principles such as good governance, proportionality, transparency and sustainability. Proportionality means that the effort and controls should match the size of the risk and the nature of the organisation. A small domestic firm does not need the compliance machinery of a global bank, but it must still know its obligations and manage the real risks it has.

Lesson 3 – Structure of the standard

ISO 37301 follows the Harmonized Structure (HS, earlier called the High Level Structure or HLS), the common skeleton that ISO uses for all management system standards and that is published in Annex SL of the ISO/IEC Directives. Every HS standard has the same ten top-level clauses with the same titles and much of the same core text. Discipline-specific content is added inside that skeleton. This is why an organisation can run one integrated management system for quality, environment, information security and compliance.

The clauses at a glance

Introduction and clauses 1 to 3 – the purpose of the document, its scope, normative references (there are none) and terms and definitions. They contain no auditable requirements.
Clause 4 – Context of the organization. Understanding internal and external issues (including, since the 2024 amendment, whether climate change is relevant), the needs and expectations of interested parties, the scope of the CMS and the CMS itself. Two sub-clauses are specific to compliance and are the foundation of everything else: 4.5 Compliance obligations (identify them, assess their impact on operations, keep them up to date) and 4.6 Compliance risk assessment (identify, analyse and evaluate compliance risks, and reassess them periodically and when things change).
Clause 5 – Leadership. Commitment from the governing body and top management, promoting a compliance culture, compliance governance arrangements such as the compliance function's direct access to the governing body and its independence, the compliance policy, and roles, responsibilities and authorities for the governing body, top management, the compliance function, managers and personnel.
Clause 6 – Planning. Actions to address risks and opportunities for the CMS, measurable compliance objectives with plans to achieve them, and planning of changes to the CMS in a controlled way.
Clause 7 – Support. Resources; competence, including a sub-clause on the employment process (compliance in terms of employment, due diligence before appointing people to high-risk roles, disciplinary consequences, and checking that performance targets and bonuses do not reward noncompliance) and on training; awareness; communication; and documented information.
Clause 8 – Operation. Operational planning and control, including control of outsourced processes; establishing controls and procedures to manage compliance risks; raising concerns (a way for people to report suspected or actual violations, with confidentiality and protection from retaliation); and investigation processes to assess, investigate and close reports properly.
Clause 9 – Performance evaluation. Monitoring, measurement, analysis and evaluation, with compliance-specific topics: sources of feedback on compliance performance, development of indicators, compliance reporting and record-keeping; then internal audit and management review.
Clause 10 – Improvement. Continual improvement of the CMS, and handling of nonconformity and noncompliance with corrective action that removes causes, not just symptoms.
Annex A – informative guidance for clauses 4 to 10, with examples (for instance of typical mandatory requirements and voluntary commitments, of controls and of indicators). Read it alongside each clause; it is where most of the practical advice lives.

Plan-Do-Check-Act

Like other HS standards, ISO 37301 maps naturally onto the Plan-Do-Check-Act (PDCA) improvement cycle. Context and leadership set the direction; planning is "Plan"; support and operation are "Do" (resources, competence and communication make the operational controls possible); performance evaluation is "Check"; improvement is "Act". The cycle then repeats, with each round of monitoring and review making the system a little better.

What makes ISO 37301 different from the generic skeleton

If you already know ISO 9001 or ISO/IEC 27001, focus your reading on the compliance-specific additions, because these are where auditors spend most time:

the obligations inventory and compliance risk assessment in clause 4;
culture, governance and the independence and authority of the compliance function in clause 5;
the employment process and incentive checks in clause 7;
raising concerns and investigations in clause 8, which most other HS standards do not have in this form;
indicators, feedback sources and compliance reporting to the governing body in clause 9;
handling noncompliance (breaches of obligations) as well as nonconformity (failures of the system) in clause 10.

Lesson 4 – How it works in practice

The standard says what a CMS must achieve, not in what order to build it. In practice most organisations follow a sequence like the one below. Small organisations can complete it in a few months with modest documentation; large ones take a year or more and run it as a programme.

Step 1 – Secure the mandate

Compliance without visible support from the top fails quickly. The governing body and top management should approve the decision to build the CMS, appoint or confirm the compliance function, give it resources and access, and say publicly that compliance is not negotiable, including when it costs business. This is not a ceremonial step: auditors will look for evidence that leaders actually discuss compliance reports and act on them.

Step 2 – Understand context and define the scope

Map where the organisation operates, what it sells, who its customers, regulators and partners are, and which issues (growth into new countries, acquisitions, new technology, past incidents, climate-related regulation) affect compliance. Then define the scope of the CMS: which legal entities, locations, activities and obligation topics it covers. A scope that leaves out a high-risk subsidiary or the sales function is a red flag.

Step 3 – Build the obligations register

For each area of activity, identify the obligations that apply, link them to the processes and roles they affect, and give each an owner. A typical register lists the obligation, its source, the business processes affected, the owner, the controls, and the date it was last reviewed. Sources include legal counsel, regulator websites, industry associations, contracts and the organisation's own codes. Because laws change, the register needs a horizon-scanning process: someone must watch for new and changed obligations and assess their impact before they take effect.

Step 4 – Assess compliance risk

For each obligation or group of obligations, ask how noncompliance could happen (which activities, people, third parties and situations create exposure), how likely it is and what the consequences could be. Many organisations rate risk before controls (inherent) and after controls (residual), then compare the residual rating with their risk criteria to decide where more treatment is needed. The method can follow ISO 31000, the general risk-management guideline. The assessment must be repeated at planned intervals and whenever something material changes, such as entering a new market or a change in the law.

Step 5 – Set policy, objectives and roles

The compliance policy states the organisation's commitment, gives a framework for objectives, explains the consequences of not complying, encourages people to raise concerns and promises protection against retaliation. Objectives make the policy measurable, for example "all agents in high-risk countries re-screened within 12 months" or "speak-up awareness above 85 % in the annual survey". Roles must then be made concrete.

Figure 3 – Roles in a CMS: the line of management carries compliance into daily work, while the compliance function supports it and reports directly to the governing body.

The pattern in Figure 3 matters. Compliance is the responsibility of every manager for their own area; the compliance function does not "do compliance" for them. Its job is to design and run the system, advise, monitor, report and challenge. To be able to challenge, it needs authority, competence, enough independence that it is not overruled by the very managers it monitors, and a direct line to the governing body that does not depend on the chief executive's permission.

Step 6 – Design controls and procedures

Controls are what turn intentions into behaviour. Good programmes combine:

Preventive controls – approvals and segregation of duties for payments, gift and hospitality limits, sanctions screening of customers, mandatory legal review of new products, access restrictions.
Detective controls – transaction monitoring, data analytics on expenses, reconciliations, periodic certifications by managers, mystery shopping, audits.
Corrective controls – escalation rules, incident response, remediation and disciplinary procedures.
Third-party controls – due diligence proportionate to risk before engaging agents or distributors, contract clauses, training and periodic review.

The most effective controls are built into normal business processes and tools (the purchasing system, the customer onboarding workflow) instead of sitting in a separate compliance manual. Each control should be traceable to the risks it treats, so that when a risk changes you know which controls to revisit.

Step 7 – People: competence, training, awareness and incentives

Determine the competence each role needs, train people in proportion to their risk exposure (a short general module for all staff, deeper scenario-based training for procurement, sales or trading teams), and keep records. Awareness goes beyond training: people should know the policy, how their own work affects compliance, what happens if they do not comply, and how to raise a concern. The employment process links all this to HR: compliance commitments in contracts, background checks before appointing people to high-risk positions, disciplinary consequences applied consistently, and a review of targets and bonuses so they do not reward cutting corners.

Step 8 – Raising concerns and investigations

Many compliance failures are first noticed by employees, suppliers or customers. The standard therefore requires a process that encourages and enables people to report attempted, suspected or actual violations, in good faith, with confidentiality (and anonymity where the organisation allows it) and protection against retaliation. Reports must then be assessed and, where warranted, investigated by competent people without a conflict of interest, and the outcome documented, acted on and reported. Guidance on building such a process in depth is in ISO 37002 (whistleblowing) and on investigations in ISO 37008.

Figure 4 – The life of a reported concern: receipt, triage, independent investigation, decision and action, closure with protection of the reporter, and feedback into the system.

Step 9 – Monitor, measure and report

The organisation must decide what to monitor, how and when, and use several sources of feedback: control testing, speak-up reports, audits, regulator contact, complaints, employee surveys. Indicators should include leading measures that show whether the system is working (training completed, due diligence on time, controls tested) and lagging measures that show outcomes (substantiated breaches, regulator findings, fines). A low number of speak-up reports is not automatically good news; it may mean people do not trust the channel. Regular compliance reports go to top management and the governing body, and records are kept to prove what was done.

Step 10 – Audit, review and improve

Internal audits check at planned intervals whether the CMS meets the organisation's own requirements and the standard, and whether it is effectively implemented. Management review looks at results, changes in obligations and risks, adequacy of resources and opportunities to improve, and its decisions are recorded. When a nonconformity or noncompliance is found, the organisation reacts (contains it and deals with the consequences), analyses the root cause, takes corrective action to prevent recurrence, and checks that the action worked.

Typical artefacts

A working CMS usually has: a scope statement; a compliance policy and code of conduct; an obligations register; a compliance risk assessment; a controls inventory mapped to risks; role descriptions and a charter for the compliance function; a training plan and records; a speak-up procedure and case log; an investigation procedure; an indicator set and periodic compliance reports; an internal audit programme and reports; management review minutes; and a corrective action log. None of these needs to be long. What matters is that each is used.

Lesson 5 – Assessment, certification and compliance

Ways to show conformity

Because ISO 37301 contains requirements, an organisation can show conformity in several ways:

Self-assessment and self-declaration – the organisation evaluates itself, often with internal audit, and states that it conforms. Cheap, but credibility depends on the organisation's reputation.
Second-party assessment – a customer, investor or parent company audits the organisation against the standard, for example as part of supplier onboarding.
Third-party certification – an independent certification body audits the CMS and, if it conforms, issues a certificate. For the certificate to carry weight, the certification body should be accredited for ISO 37301 by a national accreditation body, which assesses it against ISO/IEC 17021-1, the general requirements for bodies that certify management systems.

The certification cycle

Accredited management-system certification follows a common pattern. An initial audit in two stages checks first the design and readiness of the system (documentation, scope, risk assessment, whether internal audit and management review have run) and then its implementation and effectiveness in practice, through interviews, observation and samples of records. Nonconformities are graded: a major one (a requirement not addressed at all, or a failure that throws doubt on the system's ability to achieve its outcomes) must be corrected before certification; minor ones need an accepted correction plan. The certificate is normally valid for three years, with surveillance audits in between and a recertification audit before expiry.

Figure 5 – The accredited certification cycle for ISO 37301: a two-stage initial audit, correction of major findings, a three-year certificate with surveillance, then recertification.

What auditors look for

Experienced auditors test the system end to end. They pick an obligation from the register and follow it: who owns it, how its risk was assessed, which controls treat it, whether those controls run as described, how they are monitored and what was reported. They interview staff far from head office to see whether they know the speak-up channel. They sample closed investigations to check independence, timeliness and protection of reporters. They read governing-body minutes to see whether compliance reports are discussed. They check that bonuses for high-risk roles consider compliance. Documents that exist but are not used are a common source of findings.

What certification proves, and what it does not

A certificate tells you that, at the time of the audits, an independent body found a CMS that met the standard's requirements within the stated scope. It does not guarantee that no breach will ever happen, does not confirm that every law in every country is being met, and does not give legal immunity. When checking someone else's certificate, read the scope (which entities and activities), the certification body and its accreditation, and the validity dates.

Regulators and prosecutors usually ask a deeper question: did the programme work? A widely cited example is the United States Department of Justice guidance Evaluation of Corporate Compliance Programs (the version at the link below was updated in September 2024), which frames the evaluation around three fundamental questions: whether the programme is well designed, whether it is adequately resourced and empowered to function, and whether it works in practice. ISO 37301 maps well onto those questions, but the evidence regulators want is behavioural: real investigations, real discipline, real changes after incidents. In other jurisdictions, laws on corporate criminal liability or regulatory sanctions take compliance programmes into account in their own ways, so legal advice for each jurisdiction remains necessary.

Measuring maturity

The standard has no maturity levels and no scoring scheme. Organisations that want a sense of progress often add their own maturity scale (for example from "ad hoc" through "defined" and "embedded" to "optimised") or use indicators from culture surveys and control testing. These are internal tools; they are not part of ISO 37301 and should not be presented as if they were.

Lesson 6 – Worked example: Kestrel Freight Group

Kestrel Freight Group is a fictional freight forwarding and customs brokerage company with about 1,400 staff in nine countries, using local agents in several more. It moves goods for manufacturers and retailers, clears them through customs and handles some dangerous goods. Last year a customer's audit found that Kestrel had no organised way to track sanctions rules, and a local manager was dismissed after paying an official to speed up a clearance. The board decides to build a CMS based on ISO 37301 and to seek certification within 18 months.

Mandate and scope

The board approves a compliance charter. The new Head of Compliance reports administratively to the chief executive but has a direct line to the board's audit and risk committee, meets it without management present twice a year, and cannot be dismissed without the committee's agreement. The scope covers all nine operating subsidiaries, the agent network and the obligation areas customs, sanctions and export controls, anti-bribery, competition law, data protection, dangerous goods, and health and safety in warehouses. Tax and financial reporting stay with the finance function's existing control framework but are linked to the CMS for reporting.

Obligations and risk

Workshops with local legal advisers and operations managers produce an obligations register of around 220 entries, each linked to a process (booking, screening, customs declaration, payment to agents, warehousing) and an owner. Voluntary commitments are included: Kestrel's code of conduct, a customer supplier code it has signed, and an industry security programme it belongs to. A horizon-scanning task is given to the legal team, who brief compliance monthly on sanctions list and customs changes.

The compliance risk assessment shows three highest residual risks: sanctions breaches through screening gaps on new customers in two countries, facilitation payments at border crossings by agents, and incorrect dangerous goods declarations by under-trained staff. Competition law risk is rated moderate, mostly from informal contacts with competitors at industry events.

Controls and people

Sanctions: automated screening of every new customer and consignee in the booking system, with a hard stop until compliance clears any match; re-screening when lists change.
Bribery at borders: a clear ban on facilitation payments, a duress exception (staff may pay if their safety is threatened, and must report it immediately), risk-based due diligence and anti-bribery clauses for all agents, and analytics flagging unusual "expediting fees".
Dangerous goods: certified training for every declarant, four-eyes review of declarations, and a quarterly sample check.
Competition: guidance and a short training for anyone attending industry associations, with a rule that meeting agendas are reviewed in advance.
HR: the bonus scheme for station managers is changed so that clearance speed is no longer the only measure, and compliance audit results now count. Managers in high-risk roles pass a background check before promotion.

Speak-up and investigations

Kestrel launches a multilingual hotline run by an external provider, accepting anonymous reports, and trains managers to pass on concerns they receive in person. A small investigation panel (compliance, legal, HR, with internal audit for financial matters) triages cases; anyone connected to a case steps aside. In the first year 41 reports arrive: 19 are HR grievances referred to HR, 14 are investigated as compliance matters and 6 are substantiated, leading to two dismissals, one agent contract ended and three control changes. Reporters are told when their case is closed, and HR checks for any retaliation over the following months.

Monitoring, audit and review

The quarterly compliance report to the board shows leading indicators (training completion, agent due diligence on time, screening matches cleared within target) and lagging ones (substantiated breaches, regulator findings, customs penalties). Internal audit covers each subsidiary over two years, starting with the highest-risk stations. The first management review finds that due diligence on agents in one country is six months late; it allocates an extra analyst and records the decision. An internal audit finds that the dangerous goods quarterly check was skipped at two warehouses: a nonconformity, corrected by assigning it to the regional quality lead and adding it to the compliance calendar.

Certification

At stage 1 the auditor notes that the scope statement does not mention the agent network clearly; Kestrel fixes it before stage 2. At stage 2 the auditor follows several obligations through the system, interviews warehouse staff about the hotline and samples investigation files. One minor nonconformity is raised (two closed cases lack a record of feedback to the reporter) and Kestrel is certified. More important than the certificate, the board can now explain to customers and regulators how it knows what its obligations are and how it would detect a breach.

Lesson 7 – Relationship to other standards and frameworks

ISO 37301 sits in a family of governance standards developed by ISO/TC 309, and it is often used alongside risk-management and topic-specific standards. The table summarises the most important relationships.

Standard or framework	What it covers	Relationship to ISO 37301
ISO 19600:2014 (withdrawn)	Guidelines for compliance management systems	The predecessor. ISO 37301 kept its ideas but turned them into certifiable requirements and replaced it in 2021.
ISO 37000	Guidance on the governance of organisations	Explains how governing bodies should oversee the organisation; ISO 37301 provides the management system through which compliance oversight is exercised.
ISO 37001	Requirements for anti-bribery management systems	A topic-specific sibling with the same structure. Bribery is one compliance risk; many organisations integrate both systems and certify to both.
ISO 37002	Guidelines for whistleblowing management systems	Gives detailed guidance for the raising-concerns process that ISO 37301 requires in clause 8.
ISO 37008	Guidance on internal investigations of organisations	Helps design the investigation process that follows a report or detected breach.
ISO 31000	Guidelines for risk management	Provides a general method for identifying, analysing, evaluating and treating risk, which can be used for compliance risk assessment.
ISO 9001, ISO 14001, ISO/IEC 27001, ISO 45001	Quality, environmental, information security and occupational health and safety management systems	Share the Harmonized Structure, so their policies, audits, reviews and corrective action can be combined with the CMS in one integrated system.
US DOJ Evaluation of Corporate Compliance Programs	How US prosecutors assess compliance programmes	Not a standard, but a widely used benchmark of effectiveness; an ISO 37301 CMS can supply much of the evidence it asks about.

Two points help avoid confusion. First, ISO 37301 is the umbrella: it manages all obligations in one system, while ISO 37001 and similar standards go deep on one topic. An organisation can use ISO 37301 alone, a topic standard alone, or both. Second, the compliance function is not the same as internal audit or risk management. In the common "three lines" view of governance, management owns the risks, the compliance and risk functions support and challenge, and internal audit gives independent assurance on all of it, including on the CMS.

Common pitfalls and best practices

Common pitfalls

Paper programme. Policies and procedures are written to pass an audit but nobody follows them, and the first real incident reveals the gap.
Compliance as the compliance department's job. Line managers assume the compliance team owns all obligations, so nobody in the business takes responsibility for controls.
A stale obligations register. The register is built once and never updated, so new sanctions, privacy or product rules are missed.
Generic risk assessment. Risks are copied from a template instead of being derived from the organisation's own activities, locations and third parties.
Incentives that fight the policy. Bonuses reward volume or speed only, quietly encouraging people to cut corners.
A speak-up channel nobody trusts. Reporters are identified, cases are never closed, or retaliation goes unpunished, so reports dry up.
A compliance function without access or teeth. It reports only through a business manager, lacks resources, or is overruled whenever revenue is at stake.

Best practices

Start from obligations and risks. Let the register and risk assessment decide where to spend effort, and document why some areas get lighter controls.
Embed controls in daily tools. Put screening, approvals and checks inside the systems people already use, so compliance is the easy path.
Make leadership visible. Have leaders talk about compliance, discuss reports at board level, and act on findings, including when it is costly.
Protect and close the loop for reporters. Offer several channels, keep identities confidential, give feedback when cases close, and monitor for retaliation.
Measure both leading and lagging indicators. Track whether the system is operating, not only how many breaches occurred.
Integrate with other management systems. Share audits, reviews and corrective action with quality, security or anti-bribery systems to reduce duplication.
Learn from every case. Feed investigation results, audit findings and near misses back into the risk assessment and training.

Summary and key takeaways

ISO 37301:2021 specifies requirements, with guidance in Annex A, for a compliance management system; it replaced the guidance-only ISO 19600 and can be used for certification. The 2024 amendment added climate considerations, and ISO confirmed the edition in 2026.
Compliance obligations include both mandatory requirements and voluntary commitments, and compliance risk is always tied to those obligations.
The standard follows the Harmonized Structure (clauses 4 to 10), so it integrates with ISO 9001, ISO/IEC 27001, ISO 37001 and other management systems.
Its distinctive content is the obligations inventory, compliance risk assessment, compliance culture and governance, the independence of the compliance function, the employment process, raising concerns and investigations, and compliance reporting.
Line management owns compliance in daily work; the compliance function designs, runs, monitors and reports on the system, with direct access to the governing body.
Controls should be proportionate to risk, embedded in business processes and traceable to the risks they treat.
Certification shows that a CMS met the requirements within a scope at a point in time; it is not a guarantee or legal immunity, and regulators look for evidence that the programme works.
Nonconformity is a failure of the management system; noncompliance is a failure to meet an obligation. Both need root-cause analysis and corrective action.

Reflection questions

List five compliance obligations that apply to your own organisation or team, and decide for each whether it is a mandatory requirement or a voluntary commitment. Who owns each one today?
Pick one of those obligations and describe how noncompliance could realistically happen. Which preventive and detective controls exist, and which are missing?
If an employee in a remote office suspected a breach tomorrow, what exactly would they do, and what would stop them from speaking up?
Look at how people in a high-risk role in your organisation are rewarded. Could the incentives encourage noncompliance, and how would you change them?
Which three indicators would you put in a quarterly compliance report to a board, and what would each tell the board that a count of breaches would not?