PECB ISO 37301 Foundation cheat sheet

ISO 37301 is a Type A management system standard: it states requirements against which conformity can be audited and certified, unlike ISO 19600, which was guidance only.

Compliance is defined as meeting all the organization's compliance obligations; compliance obligations are requirements the organization must comply with plus those it voluntarily chooses to comply with.

A compliance management system (CMS) is the set of interrelated elements an organization uses to direct, operate and control compliance; ISO 37301 structures it on the Plan-Do-Check-Act cycle.

Core principles of ISO 37301: top-management leadership and commitment, a risk-based approach, proportionality to the organization's context, and continual improvement.

Good compliance culture rests on seven elements: governance, proportionality, transparency, sustainability, accountability, responsibility and ethical behaviour.

Three pillars of the compliance function: prevention (policies, training, advice), detection (monitoring, reporting channels, audits) and response (investigation, corrective action, sanction).

The CMS is not a standalone silo: compliance obligations must be integrated into the organization's existing processes and business processes rather than managed in parallel.

Risk-based compliance means effort and controls are allocated according to the likelihood and impact of non-compliance, not applied uniformly to every obligation.

Clause 4 (Context): determine external and internal issues, interested parties and their relevant requirements, and define the CMS scope; the compliance function must be independent and have access to top management.

Clause 5 (Leadership): top management demonstrates leadership, establishes the compliance policy, ensures roles and responsibilities are assigned, and ensures the compliance function has authority and resources.

Clause 5.2 policy content: appropriate to purpose and context, provides a framework for setting compliance objectives, includes a commitment to satisfy compliance obligations, and includes a commitment to continual improvement.

Clause 6 (Planning): identify compliance obligations, assess compliance risk, set measurable compliance objectives, and plan actions to address risks and opportunities; changes must be planned.

Clause 7 (Support): resources, competence, awareness, communication, and documented information - including the compliance obligations register and evidence of competence.

Clause 8 (Operation): controls to meet compliance obligations, including policies, procedures, training, and controls over outsourced or externally provided processes; performance indicators are established.

Clause 9 (Performance evaluation): monitoring, measurement, analysis and evaluation; internal audit of the CMS; management review at planned intervals with defined inputs and outputs.

Clause 10 (Improvement): handle nonconformity and corrective action (react, evaluate the need to eliminate the cause, implement, review effectiveness, update risks), and continually improve the CMS suitability, adequacy and effectiveness.