ISO 37301 LI cheat sheet

ISO 37301 defines a compliance management system (CMS) as the set of interrelated or interacting elements an organization uses to establish compliance policy and objectives and to achieve those objectives.

Compliance is defined as meeting all the organization's compliance obligations; compliance obligations are requirements the organization must comply with plus those it voluntarily chooses to comply with.

ISO 37301 follows the Harmonized Structure (Annex SL): clauses 4-10 are Context, Leadership, Planning, Support, Operation, Performance evaluation, and Improvement.

Core principles of ISO 37301: good governance, proportionality, transparency, sustainability, accountability, and a risk-based approach embedded in culture.

A CMS is not a legal opinion: certification to ISO 37301 attests to the management system, not to the absence of noncompliance or to legal adequacy.

PDCA (Plan-Do-Check-Act) underlies the standard: Plan = clauses 4-6, Do = 7-8, Check = 9, Act = 10.

Compliance culture is an outcome of leadership behavior, tone at the top, incentives, and the perceived consequences of both compliant and noncompliant conduct.

Compliance risk is the effect of uncertainty on compliance objectives; it is assessed by likelihood and consequence and treated via controls, not eliminated.

ISO 37301 is certifiable (requirements only), unlike ISO 19600, which was guidance; ISO 37301 replaced ISO 19600 in 2021.

Initiation begins with top management commitment: a formal decision, sponsor at the highest level, and a mandate that includes authority and resources.

Define the scope of the CMS before designing anything: functions, locations, legal entities, processes, products, and interfaces with third parties.

Perform a preliminary gap analysis against ISO 37301 clauses 4-10 to establish a baseline and prioritize work.

Map the organization's context: external and internal issues, interested parties and their relevant requirements, and the compliance obligations universe.

Appoint a compliance function with defined responsibilities (clause 5.3) and decide the governance model: centralized, decentralized, or hybrid.

Build the implementation plan: phases, milestones, owners, budget, dependencies, and quick wins versus structural changes.

Identify and secure resources: people, budget, technology (registers, GRC tools), and access to legal/external advice.

Establish the project governance: steering committee, reporting cadence, escalation path, and change management approach.

Communicate the intent early to employees, workers' representatives, and key stakeholders to reduce resistance and set expectations.

Clause 6.1 requires planning that addresses risks and opportunities, including determination of the risks and opportunities related to compliance.

Compliance obligations (clause 6.1.3) must be identified, documented, and kept up to date; the register is the central planning artifact.

Compliance objectives (clause 6.2) must be measurable where practicable, monitored, communicated, and supported by plans answering what, who, when, and how.

Risk treatment options: avoid, reduce likelihood, reduce consequence, transfer (e.g., insurance), or accept with authority and rationale.

Planning must address planned changes and unintended changes; changes to the CMS must be carried out in a planned manner (clause 6.3).

Controls are selected based on risk assessment results and then integrated into processes, not bolted on as separate procedures.

Planning outputs include the compliance risk assessment methodology, criteria for risk levels, and the compliance obligations register.

Objectives should be SMART and cascade from the compliance policy; each objective needs an owner, metric, and target date.

Documentation planning must define what information is required, its format, ownership, retention, and access controls.

Clause 5 requires top management to establish a compliance policy, ensure integration into business processes, and demonstrate leadership and commitment.

The compliance policy must be appropriate to purpose, provide a framework for objectives, include commitment to meet obligations, and be communicated and available.

Clause 7 covers support: resources, competence, awareness, communication, and documented information; competence includes training and records of it.

Clause 8 (Operation) requires planning and control of processes, due diligence on third parties, and controls over outsourced processes.

Third-party compliance requires risk-based due diligence, contractual compliance requirements, monitoring, and escalation mechanisms.

Operational controls include procedures, segregation of duties, approval limits, whistleblowing channels, and training tied to role-based risk.

Communication must be planned: what, when, with whom, and how, including internal and external reporting lines and the speak-up channel.

Documented information must be controlled: creation, review, approval, version control, distribution, retention, and disposal (clause 7.5).

The CMS must be integrated with other management systems (quality, environment, anti-bribery) rather than run as a parallel bureaucracy.

Clause 9.1 requires determining what to monitor and measure, the methods, when, who, and when results are analyzed and evaluated.

Monitoring indicators include training completion, speak-up reports, investigation cycle time, third-party due diligence coverage, and control test results.

Internal audit (clause 9.2) must be planned, programmed, and conducted by objective, impartial auditors; auditors cannot audit their own work.

The audit program considers the importance of processes, changes, and results of previous audits; audit criteria and scope must be defined.

Management review (clause 9.3) takes inputs such as audit results, nonconformities, monitoring results, stakeholder feedback, and risks/opportunities.

Management review outputs must include decisions on improvement opportunities and CMS changes, with owners and deadlines.

A nonconformity is a failure to meet a requirement; a finding is an audit observation, which may be a nonconformity, an opportunity, or an observation.

Performance evaluation should include root cause analysis for failures and a review of the effectiveness of corrective actions.

KPIs must be defined with baselines and targets; trending data is more informative than single-point measurements.

Clause 10.1 requires continual improvement of the suitability, adequacy, and effectiveness of the CMS.

Clause 10.2 requires reacting to nonconformities, evaluating the need for action, implementing corrective action, and reviewing its effectiveness.

Corrective action must address root causes; the documented information must include the nature of the nonconformity and the actions taken.

Improvement sources: internal audit findings, management review outputs, monitoring data, incidents, complaints, regulator feedback, and changes in context.

Improvement must be proportionate: prioritize by risk, cost, and impact rather than by ease of implementation.

Lessons learned from incidents and near misses should be fed back into risk assessment, training, and controls.

Changes to the CMS must be planned (clause 6.3) and should not create new risks or break existing controls.

Maturity models can guide improvement sequencing, but certification only requires conformity with clauses 4-10, not a maturity level.

Effectiveness of improvement must be verified and recorded; repeated nonconformities indicate the corrective action failed to address the cause.

Certification follows ISO/IEC 17021-1: a two-stage initial audit (Stage 1 readiness, Stage 2 conformity), then surveillance audits and recertification.

Stage 1 assesses readiness: documentation, scope, context understanding, internal audit and management review completed, and identifies Stage 2 focus areas.

Stage 2 assesses implementation and effectiveness: evidence of operation, not just documented procedures.

Internal audit and management review must be completed before Stage 2; their absence is a common cause of failure.

Select a certification body accredited for ISO 37301 by a recognized accreditation body (e.g., IAF member) and confirm the scope covers the intended activities.

Prepare an evidence pack: compliance obligations register, risk assessment, policy, training records, audit reports, management review minutes, and incident logs.

Nonconformities at Stage 2 are graded major or minor; a major nonconformity generally requires correction and verification before certification is granted.

Certificates are valid for three years, subject to surveillance audits (typically annually) and a recertification audit before expiry.

The audit is a sampling exercise; the organization must demonstrate that the system, not just the audit day, is effective.