ISO 37301:2021

Why does it matter?

The Introduction says organizations that aim to be successful in the long term need to establish and maintain a culture of compliance, considering the needs and expectations of interested parties. ISO 37301 turns that aim into a management system with defined obligations, roles, controls and records that internal and external parties can audit.

Key benefits include:

• Compliance as culture

The governing body and top management establish and uphold a compliance culture and compliance governance (Clauses 5.1.1 to 5.1.3), and personnel and management have defined responsibilities (Clauses 5.3.3 and 5.3.4).

• Obligations and risk in one view

The organization determines its compliance obligations (Clause 4.5) and assesses compliance risk (Clause 4.6), so effort follows the obligations most likely to be breached.

• A route for concerns

Clause 8.3 requires a process for raising concerns and Clause 8.4 requires investigation processes, so suspected noncompliance reaches someone who can act.

• Evidence for regulators and courts

Compliance reporting and record-keeping (Clauses 9.1.4 and 9.1.5) produce the evidence an organization can show when its commitment to compliance is examined.

• Fits other management systems

The Introduction says the standard is suitable to enhance the compliance-related requirements in other management systems, and the shared structure lets it share policies, audits and management reviews with them.

How does it work?

ISO 37301 follows the ten-clause structure used by ISO management system standards. Clause 4 covers the context, interested parties, scope of the CMS (4.3), the CMS itself (4.4), compliance obligations (4.5) and compliance risk assessment (4.6). Clause 5 covers leadership, compliance policy (5.2) and roles, including the compliance function (5.3.2). Clause 6 covers actions to address risks and opportunities, compliance objectives and planning of changes. Clause 7 covers resources, competence, awareness, communication and documented information.

Operation (Clause 8) is specific to compliance: operational planning and control (8.1), establishing controls and procedures (8.2), raising concerns (8.3) and investigation processes (8.4). Performance evaluation (Clause 9) adds sources of feedback on compliance performance (9.1.2), development of indicators (9.1.3), compliance reporting (9.1.4) and record-keeping (9.1.5), followed by internal audit and management review. Clause 10 covers continual improvement and nonconformity and corrective action.

The standard separates a nonconformity from a noncompliance: a nonconformity is not necessarily a noncompliance (Clause 3.16, Note 1). Where an organization has no separate governing body, every requirement that refers to a governing body applies to top management (Clause 1). The standard is voluntary, and an organization that wants an independent certificate asks an accredited certification body to audit its CMS against the requirements.

Key Elements

• Compliance obligations and risk (Clauses 4.5 and 4.6)

The organization identifies its compliance obligations, which the Introduction frames as relevant laws, regulatory requirements, industry codes and organizational standards, as well as standards of good governance, ethics and community expectations, and assesses the compliance risk of failing to meet them.

• Governing body, top management and culture (Clause 5.1)

Commitment from the governing body and top management (5.1.1), a compliance culture (5.1.2) and compliance governance (5.1.3).

• Compliance policy and roles (Clauses 5.2 and 5.3)

A compliance policy, and defined responsibilities for the governing body and top management (5.3.1), the compliance function (5.3.2), management (5.3.3) and personnel (5.3.4).

• Planning (Clause 6)

Actions to address risks and opportunities, compliance objectives and planning to achieve them, and planning of changes (6.1 to 6.3).

• Competence and awareness (Clauses 7.2 and 7.3)

Competence through the employment process (7.2.2) and training (7.2.3), and awareness (7.3).

• Controls, concerns and investigations (Clauses 8.2 to 8.4)

Controls and procedures to manage compliance obligations, a way to raise concerns and investigation processes.

• Evaluation and improvement (Clauses 9 and 10)

Feedback sources, indicators, compliance reporting and record-keeping (9.1.2 to 9.1.5), internal audit program (9.2.2), management review (9.3), continual improvement (10.1) and nonconformity and corrective action (10.2).

What does it cover?

ISO 37301:2021 specifies requirements and provides guidelines for establishing, developing, implementing, evaluating, maintaining and improving an effective compliance management system within an organization. It applies to all types of organizations regardless of the type, size and nature of the activity, and whether the organization is public, private or non-profit (Clause 1). It covers the organization's whole range of compliance obligations, where ISO 37001 addresses anti-bribery management systems specifically. It has no normative references (Clause 2).

What are its objectives?

The Introduction sets out what the standard is meant to achieve. Its objectives are to:

Help the organization develop and spread a positive culture of compliance.

Treat effective management of compliance-related risks as an opportunity.

Demonstrate commitment to comply with laws, regulatory requirements, industry codes, organizational standards, good governance, ethics and community expectations.

Improve the overall management of all the organization's compliance obligations.

Adapt to the size and maturity of the CMS and to the nature and complexity of the organization's activities.

Framework in Context

ISO/TC 309 prepared ISO 37301 as the first edition, canceling and replacing ISO 19600:2014. The Foreword lists two main changes: the document now contains requirements with additional guidance, and it follows ISO's harmonized structure for management system standards. Amendment 1:2024, published February 23, 2024, adds climate change statements to the context clauses. ISO 37302:2025 supports it with guidance on evaluating the effectiveness of a CMS and, per its scope, does not add to or change the requirements of ISO 37301.

Common Framework Mappings

ISO 37301:2021 is commonly mapped to the other ISO management system standards it shares a structure with and to the governance and risk frameworks listed below, so that one set of policies, audits and reviews can serve several programs.

Mapped frameworks include:

ISO 9001:2026

ISO 27001:2022

ISO 22301

ISO 42001

ISO 31000:2018

COSO IC 2013

COSO ERM 2017

SOX

ISO 37001