ISO 37301:2021

Overview

ISO 37301:2021 - Compliance management systems - Requirements with guidance for use specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving an effective compliance management system (CMS). Applicable to all types and sizes of organizations (public, private or non‑profit), the standard sets out leadership, planning, operational controls and evaluation processes needed to meet legal, regulatory, industry and internal compliance obligations. ISO 37301:2021 replaces ISO 19600:2014 and follows ISO’s harmonized structure for management system standards.

Key topics and technical requirements

ISO 37301 defines a comprehensive CMS framework organized in management‑system clauses. Key topics include:

• Context of the organization: determining internal/external factors, interested parties and the scope of the CMS.
• Compliance obligations & risk assessment: identifying obligations and assessing compliance risks to prioritize controls.
• Leadership and governance: requirements for governing bodies/top management, compliance culture, policy, roles, responsibilities and authorities.
• Planning: actions to address risks and opportunities, setting compliance objectives and managing change.
• Support: resources, competence, awareness, communication and documented information management.
• Operation: operational planning, controls, procedures, raising concerns and investigation processes.
• Performance evaluation: monitoring, indicators, reporting, record‑keeping, internal audit and management review.
• Improvement: continual improvement, nonconformity handling and corrective actions.
• Guidance: informative Annex A provides practical guidance for implementation and adaptation to organizational size/maturity.

Practical applications and who uses it

ISO 37301 is used to:

• Build or formalize an organization‑wide compliance program that demonstrates commitment to laws, regulations, ethics and industry codes.
• Integrate compliance into existing management systems (e.g., quality, risk, governance).
• Provide evidence of due diligence to regulators, customers, investors and courts (jurisdictions may consider a CMS when assessing penalties). Primary users include:
• Top management and governing bodies (accountability for compliance governance)
• Compliance officers and legal teams (design and oversight of controls)
• Internal auditors and risk managers (monitoring, auditing and reporting)
• Regulators, boards and third‑party assessors (benchmarking and assurance)

Related standards

• ISO 19600:2014 - replaced by ISO 37301:2021 (technical revision)
• Aligns with ISO’s common management system structure to facilitate integration with other ISO standards.

Keywords: ISO 37301, compliance management system, compliance risk, compliance policy, ISO standard, governance, compliance program, ISO 37301:2021.