ISO 37301: Compliance Management System
ISO 37301 specifies requirements and guidance for establishing, evaluating and improving a compliance management system suited to organizational obligations and risks.
Key Takeaways
- ✓Identify applicable obligations and assign owners to keep them current.
- ✓Assess non-compliance risks based on real context and processes.
- ✓Integrate controls, training, communication and reporting channels.
- ✓Monitor performance and respond to findings with corrective action.
- ✓Do not claim a system equals total legal compliance.
Purpose
ISO 37301 guides the establishment and improvement of a compliance management system. Work starts with organizational context and applicable obligations, defines leadership and accountability, assesses non-compliance risk, embeds controls in processes and monitors effectiveness.
GRC use
Leadership should support a culture of integrity and provide appropriate resources and authority. Communication channels, training, concern handling, monitoring and corrective action help the system respond to changes and findings.
Boundaries
Having a system does not by itself demonstrate compliance with every obligation. Applicability, the scope of any certification and legal claims require specialist review.
Operation and oversight
Establish a process to identify changes in obligations and assess their effects on products, processes, third parties and locations. Assign owners, controls and advice or reporting channels; protect confidentiality as appropriate and define how concerns are investigated. Review indicators alongside incidents, audits and contextual change; measures should show performance and trends, not merely count training sessions or policies.
Illustrative example
When entering a new jurisdiction, an organization can identify relevant obligations, analyze exposed processes, assign owners and check that controls and training reach affected teams. Legal interpretation should be validated by competent counsel.
Integrating obligations and operations
Maintain a process to detect changes in laws, voluntary commitments and other applicable requirements, assigning competent personnel to interpret and validate legal obligations. Translate prioritized obligations into risks, controls, owners and evidence in the processes where work happens. Ensure relevant third parties understand expectations and that accessible advice and reporting channels exist, with confidentiality and non-retaliation rules appropriate to context.
Frequently asked questions
Does ISO 37301 automatically cover every applicable law?
No. The organization must identify its obligations, jurisdictions and applicability.
Does the standard certify an individual?
The standard concerns an organizational management system; it is not a personal certification.
Is a written program enough to demonstrate effectiveness?
No. Evidence of implementation, monitoring, evaluation and improvement within scope is needed.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.
Related Content
ISO 31000 Framework: Enterprise Risk Management Framework
The ISO 31000 framework provides a comprehensive structure to design, implement, maintain and improve organizational risk management capabilities.
COSO ERM: Risk, Strategy and Performance
COSO ERM connects risk management with strategy and performance, helping leaders discuss objectives, uncertainty, appetite and response in an integrated way.