ISO 37301, a system for staying compliant
Build a compliance programme that tracks obligations, assigns owners and shows evidence.
Official sources
Use these official places to read the text and find the latest version.
What ISO 37301 is
ISO 37301 is the standard for a compliance management system. It helps you identify the laws, contracts and commitments you must follow, assign owners, and show that you keep to them.
It replaced ISO 19600, which was guidance only. ISO 37301 can be certified.
How ISO 37301 got to where it is today
The milestones that changed what organisations have to do.
ISO 19600
Guidelines for compliance management systems.
ISO 37301:2021
Replaces ISO 19600 with a certifiable requirements standard.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You face many laws, contracts or regulators.
Compliance is tracked in scattered spreadsheets.
You need to show a regulator or customer how you comply.
Leadership wants one view of obligations.
What it asks of you
The requirements fall into six areas.
Context and obligations
Identify what you must comply with.
Leadership and culture
Policy, roles and tone from the top.
Compliance risk
Assess where non-compliance could happen.
Operation and controls
Procedures that keep you compliant.
Reporting and concerns
Let people raise issues safely.
Audit and improvement
Check and fix.
The 7 clauses, 26 sub-clauses and 39 requirements
Open any clause to see what the compliance management standard asks of an organisation, in plain English, with practical steps and the records an auditor would expect.
26 sub-clauses · 39 requirements
c4Clause 4 Context of the organisationUnderstand your setting, obligations and compliance risks.6 sub-clauses · 6 requirements
4.1Understanding the organisation and its contextKnow the factors that shape your compliance work.1 requirement
- 4.1
The organisation determines external and internal issues relevant to its purpose and to achieving the intended results of the compliance system, considering its size, structure, nature and complexity.
What you do
- Document sectors, countries, partners and regulators involved
- Review the analysis yearly
Evidence to keep
- Context analysis
- Business model and sector summary
4.2Needs and expectations of interested partiesKnow whose expectations matter.1 requirement
- 4.2
The organisation determines the interested parties relevant to the system and their relevant requirements, and which become compliance obligations.
What you do
- List regulators, customers, staff and partners and flag which expectations the organisation has chosen to adopt
Evidence to keep
- Interested parties register
4.3Scope of the systemSet the boundary.1 requirement
- 4.3
The organisation determines the boundaries and applicability of the compliance system, considering context, obligations and risk assessment, and documents the scope.
What you do
- Cover all business units, countries and third parties acting for you or record the exclusions
Evidence to keep
- Scope statement
4.4The compliance management systemBuild and maintain the system.1 requirement
- 4.4
The organisation establishes, develops, implements, evaluates, maintains and continually improves the system including its processes and interactions.
What you do
- Appoint a system owner and map processes to clauses
Evidence to keep
- System description and process map
4.5Compliance obligationsList what you must and choose to comply with.1 requirement
- 4.5
The organisation systematically identifies its compliance obligations arising from its activities, products and services, assesses their impact, keeps them up to date and maintains documented information.
What you do
- Record each law, licence condition, contract term and voluntary code with an owner
- Subscribe to regulator updates and review at least quarterly
Evidence to keep
- Compliance obligations register
- Update log
4.6Compliance risk assessmentAssess where non-compliance is likely and harmful.1 requirement
- 4.6
The organisation identifies, analyses and evaluates its compliance risks on the basis of its obligations, with reference to causes and consequences of non-compliance, and reviews the assessment on a periodic basis and on change.
What you do
- Rate likelihood and impact per obligation, per process and per third party
- Record how each higher risk is treated
Evidence to keep
- Compliance risk assessment
- Risk register with treatment
c5Clause 5 LeadershipThe governing body and top management set the tone and own compliance.3 sub-clauses · 5 requirements
5.1Leadership and commitmentVisible commitment from the top.3 requirements
- 5.1.1
The governing body and top management demonstrate leadership and commitment, including establishing policy, integrating the system into business processes, allocating resources and supporting the compliance function.
What you do
- Include compliance on board agendas with reports from the compliance function
- 5.1.2
The organisation develops, maintains and promotes a compliance culture at all levels.
What you do
- Run culture surveys and have leaders reinforce expected behaviour
- 5.1.3
The governing body and top management ensure the compliance function has authority, independence and access, and that compliance is not compromised by other objectives.
What you do
- Give the compliance lead a direct line to the board and protect them from retaliation
Evidence to keep
- Board and management minutes
- Statement of compliance culture
5.2Compliance policyState commitments and expectations.1 requirement
- 5.2
Top management establishes a compliance policy that sets commitments, expectations, consequences of non-compliance and the right to raise concerns, and is documented, communicated and available.
What you do
- Publish the policy and require annual acknowledgement
Evidence to keep
- Approved compliance policy
- Communication and acknowledgement records
5.3Roles, responsibilities and authoritiesAssign accountability.1 requirement
- 5.3
Roles, responsibilities and authorities for compliance are assigned and communicated, including a compliance function with the competence, status and resources it needs, and management responsibility for compliance in their areas.
What you do
- Appoint compliance owners in each department
- Define what the compliance function is accountable for
Evidence to keep
- Roles and responsibilities matrix
- Compliance function mandate
c6Clause 6 PlanningPlan actions, objectives and change.3 sub-clauses · 3 requirements
6.1Actions to address risks and opportunitiesPlan how risks are treated.1 requirement
- 6.1
The organisation plans actions to address compliance risks and opportunities and how to integrate and evaluate them.
What you do
- Add treatments such as training, controls or process change to the risk register
Evidence to keep
- Action plans linked to compliance risks
6.2Compliance objectivesSet measurable goals.1 requirement
- 6.2
Compliance objectives are set, consistent with policy, measurable where practicable, monitored and communicated, with plans stating what, who, resources, when and how evaluated.
What you do
- Set targets such as training coverage, overdue obligations and time to close issues
Evidence to keep
- Objectives with measures
- Progress reports
6.3Planning of changesControl changes to the system.1 requirement
- 6.3
When changes to the system are needed, they are made in a planned manner.
What you do
- Review purpose, resources and impact before restructuring or changing scope
Evidence to keep
- Change log for the system
c7Clause 7 SupportResources, skills, awareness, communication and records.5 sub-clauses · 9 requirements
7.1ResourcesFund the system.1 requirement
- 7.1
The organisation determines and provides the resources needed for the system.
What you do
- Budget for tools, advisers and training
Evidence to keep
- Budget and staffing plan
7.2Competence and trainingHire, check and train people.3 requirements
- 7.2.1
The organisation determines the competence needed for people affecting compliance performance and ensures it by education, training or experience.
What you do
- Define competence for compliance roles
- 7.2.2
Employment processes cover recruitment and conditions so people understand their compliance obligations, apply them, and face consequences for failing to comply.
What you do
- Include compliance in screening, contracts, performance reviews and disciplinary rules
- 7.2.3
Training is provided at planned intervals, appropriate to roles and risk, assessed for effectiveness and records retained.
What you do
- Run induction and annual role-based training with tests
Evidence to keep
- Competence records
- Training matrix and completion
- Employment process records
7.3AwarenessPeople know the policy and consequences.1 requirement
- 7.3
Personnel are aware of the policy, their contribution to effectiveness, the implications of non-conformity and how to raise concerns.
What you do
- Use short regular reminders and publicise the speak-up channel
Evidence to keep
- Awareness campaign records
7.4CommunicationPlan internal and external communication.1 requirement
- 7.4
The organisation determines internal and external communications relevant to the system, including what, when, with whom and how.
What you do
- Set who speaks to regulators and how updates reach staff
Evidence to keep
- Communication plan
7.5Documented informationKeep and control records.3 requirements
- 7.5.1
The system includes documented information required by the standard and that the organisation deems necessary.
What you do
- List mandatory documents
- 7.5.2
Documented information is identified, formatted, reviewed and approved when created and updated.
What you do
- Use templates with owner and version
- 7.5.3
Documented information is controlled for availability, protection, distribution, storage, retention and change.
What you do
- Control access and retain records of decisions and investigations
Evidence to keep
- Document register
- Retention schedule
c8Clause 8 OperationEmbed controls, speak-up and investigations in day to day work.4 sub-clauses · 4 requirements
8.1Operational planning and controlRun processes to meet obligations.1 requirement
- 8.1
The organisation plans, implements, controls and reviews the processes needed to meet obligations and address compliance risks, including controlling outsourced processes and third parties.
What you do
- Set criteria for processes, control changes, and apply due diligence and contract terms to third parties
Evidence to keep
- Operational control documents
- Third-party control records
8.2Establishing controls and proceduresPut controls in place.1 requirement
- 8.2
The organisation establishes controls and procedures to achieve compliance with its obligations, and keeps them up to date.
What you do
- Map each obligation to a control and owner
- Test controls and revise after incidents
Evidence to keep
- Control and procedure library
- Control testing records
8.3Raising concernsLet people speak up safely.1 requirement
- 8.3
The organisation establishes, implements and maintains a process to encourage and enable reporting of suspected or actual violations, confidential, accepting anonymous reports, protecting reporters from retaliation, and enabling personnel to receive advice.
What you do
- Provide a hotline or web form run independently
- Report anonymised statistics to management
Evidence to keep
- Speak-up procedure
- Log of concerns raised and outcomes
- Non-retaliation statement
8.4Investigation processesLook into reports fairly.1 requirement
- 8.4
The organisation develops, establishes, implements and maintains processes to assess, evaluate, investigate and close reports of suspected or actual non-compliance, with independent, impartial investigators who have no conflict of interest and with confidentiality.
What you do
- Define triage, investigator roles and timelines
- Record outcomes, discipline and lessons learned
Evidence to keep
- Investigation procedure
- Case files with outcomes
c9Clause 9 Performance evaluationMeasure, audit and review.3 sub-clauses · 10 requirements
9.1Monitoring, measurement, analysis and evaluationKnow how well the system performs.5 requirements
- 9.1.1
The organisation determines what to monitor and measure, how, and when to analyse and evaluate, and evaluates performance and effectiveness.
What you do
- Define a set of indicators and review them regularly
- 9.1.2
The organisation establishes methods to gather feedback on its compliance performance from sources such as complaints, hotline reports, customers, suppliers, regulators and staff.
What you do
- Collect and analyse feedback across channels
- 9.1.3
The organisation develops, implements and reviews indicators to assess compliance performance, trends and the effectiveness of the system.
What you do
- Use leading and lagging indicators such as overdue actions and repeat issues
- 9.1.4
The organisation establishes criteria and processes for reporting on compliance to the governing body, top management and other stakeholders at defined intervals.
What you do
- Produce a periodic compliance report including breaches and trends
- 9.1.5
The organisation maintains accurate and current records of compliance activities to support monitoring and audit.
What you do
- Keep records on training, issues, investigations and corrective actions
Evidence to keep
- Indicator reports
- Compliance reports to the board
- Records of non-compliance and responses
9.2Internal auditIndependent checks.2 requirements
- 9.2.1
The organisation conducts internal audits at planned intervals to check the system conforms to requirements and is effectively implemented.
What you do
- Audit across the cycle covering all clauses and high-risk areas
- 9.2.2
The audit programme defines criteria, scope, frequency and methods, uses objective and impartial auditors, reports results to relevant management and retains evidence.
What you do
- Use competent auditors independent of the area audited
Evidence to keep
- Audit programme
- Audit reports with follow up
9.3Management reviewLeadership reviews the system.3 requirements
- 9.3.1
Top management reviews the system at planned intervals to ensure continuing suitability, adequacy and effectiveness.
What you do
- Hold at least an annual review
- 9.3.2
Review inputs include status of actions, changes in context and obligations, performance information, audits, non-conformities, reports of concerns and results of investigations, communications, opportunities for improvement and adequacy of resources.
What you do
- Use a standard pack with these topics
- 9.3.3
Review outputs record decisions on improvement opportunities, need for system changes and resources, and are documented.
What you do
- Record decisions with owners and dates
Evidence to keep
- Management review minutes
- Decision log
c10Clause 10 ImprovementFix and improve.2 sub-clauses · 2 requirements
10.1Continual improvementImprove suitability, adequacy and effectiveness.1 requirement
- 10.1
The organisation continually improves the suitability, adequacy and effectiveness of the compliance management system.
What you do
- Use audit, review and incident findings to drive improvement projects
Evidence to keep
- Improvement log
10.2Nonconformity and corrective actionReact and correct.1 requirement
- 10.2
When a non-compliance or nonconformity occurs the organisation reacts, controls and corrects it, evaluates need to remove causes, implements action, reviews effectiveness and updates the system, with records kept.
What you do
- Open a corrective action with owner, root cause and due date
- Verify closure and look for similar cases elsewhere
Evidence to keep
- Corrective action register
- Root cause records
Nothing matches. Clear the search or pick another clause.
Outcomes and implementation examples are from ISO 37301:2021 Compliance management systems - Requirements with guidance for use, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
List your obligations
Laws, contracts, standards.
- 2
Assign owners
One owner for each.
- 3
Assess compliance risk
Where could you fall short.
- 4
Run controls and record evidence
Day to day.
- 5
Audit and review
Then certify if you wish.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Context and obligations | Obligations register |
| Leadership and culture | Policy management |
| Compliance risk | Risk register |
| Operation and controls | Controls and evidence |
| Reporting and concerns | Case and incident log |
| Audit and improvement | Audit plans and actions |
Free ISO 37301 readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Obligations register
- Compliance policy (sample)
- Concern reporting procedure
- Audit checklist
Share or cite this page
Writing about ISO 37301? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/iso-37301/">ISO 37301 explained in plain English - Optimus CyberX</a>Common questions
How is it different from ISO 27001?
ISO 27001 covers information security. ISO 37301 covers compliance with any obligation.
Is it mandatory?
No. It is voluntary, although some customers and regulators look favourably on organisations that follow it.
Can we certify?
Yes. An accredited certification body can audit your compliance management system and issue a certificate.
Does it replace ISO 19600?
Yes. ISO 37301:2021 replaced ISO 19600, which was guidance only. Organisations that used ISO 19600 can build on that work.
Related frameworks
See how ready you are for ISO 37301
Answer questions across every area. We email you a report showing where you comply and where you do not.