One view of obligations
A maintained register of what you must comply with, and who owns it.
Certification support
ISO 37301 Compliance Management
Current edition: ISO 37301:2021
The certifiable standard for compliance management systems. It helps organisations identify their compliance obligations, manage compliance risk and build a culture where obligations are met, across every area of law, regulation and commitment.
What the standard covers
Requirements, clause by clause
ISO 37301 applies to all of your compliance obligations: laws, regulations, licences, contracts, codes and voluntary commitments.
4
Context
Compliance obligations, interested parties, scope, compliance risk assessment.
5
Leadership
Governing body and top management, compliance culture, policy, compliance function.
6
Planning
Actions to address compliance risks, objectives, planning of changes.
7
Support
Resources, competence, training, awareness, communication, documented information.
8
Operation
Controls and procedures, raising concerns, investigation processes.
9
Performance evaluation
Monitoring, compliance reporting, internal audit, management review.
10
Improvement
Nonconformity, noncompliance, corrective action and continual improvement.
Clauses 4 to 10 follow the harmonized structure shared with ISO 9001 and ISO/IEC 27001, so the systems integrate cleanly.
Why organisations implement it
What a working compliance system delivers
Prioritised risk
Compliance resources focused on the obligations that carry most risk.
Board assurance
Regular, evidence-based compliance reporting to the governing body.
Credible culture
Leadership commitment and behaviour that regulators and partners can see.
Faster response
Concerns raised, investigated and resolved through a defined process.
Integrated topics
Anti-bribery, data protection and sector rules managed in one system.
How we work
Path to certification
One AEC methodology from first assessment to certificate, delivered by registered lead auditors.
- AssessGap assessment against ISO 37301, scope and roadmap
- DesignProcesses, risk register, policy and documented information
- ImplementProcesses embedded with coaching for process owners
- TrainAwareness for all staff and internal auditor development
- VerifyInternal audit, management review and mock certification audit
- Certify & sustainStage 1 and Stage 2 support, then surveillance readiness
Full implementation
No existing system. We design and implement from the ground up.
Typically 6 to 9 monthsGap remediation
Some documentation in place. We close the gaps and prove effectiveness.
Typically 4 to 6 monthsUpgrade & integration
We formalise an existing compliance programme or integrate it with ISO 37001.
Typically 3 to 5 months
Who certifies
Independent certification, chosen to fit your market
Your ISO 37301 certificate is issued by an independent certification body accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares you for that audit; the certification decision is theirs.
CB-neutral
We are not tied to one certification body and help you select one to suit your stakeholders and markets.
Audit-ready
Mock certification audit and closed corrective actions before Stage 1 and Stage 2.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO 37301 by industry
Finance · regulated financial services
Healthcare · life sciences and healthcare providers
Power & utilities · licensed operators
Government · public bodies and state enterprises
Manufacturing · export control and product regulation
Related standards
Training Academy
View ISO 37301 Implementer course
ISO 37301 training
Delivered by practising, registered lead auditors. In-house, public, virtual or hybrid.
- Awareness (half day) for staff, managers and board members
- Implementer (2 to 3 days) for compliance and system owners
- Internal Auditor (2 to 3 days) in line with ISO 19011
Questions
ISO 37301 FAQ
Does AEC issue the ISO 37301 certificate?
No. Certificates are issued by independent certification bodies accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares your organisation for that audit.
What counts as a compliance obligation?
Mandatory requirements such as laws, regulations, permits and licences, and requirements you choose to adopt, such as contracts, codes of conduct and voluntary commitments.
Does ISO 37301 replace legal advice?
No. It provides the management system for meeting obligations. Interpretation of specific laws remains with your legal advisers; the system ensures obligations are identified, owned and met.
Can ISO 37301 include anti-bribery?
Yes. Many organisations combine ISO 37301 with ISO 37001, using one compliance function, one risk assessment and one audit programme.
Start your ISO 37301 programme
Tell us your sector, regulators and current compliance programme. We reply with a proposal covering implementation, training and certification support.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.