Implementation walkthrough
How to implement ISO 37301: video walkthrough
A walkthrough of building an ISO 37301 compliance management system, from mapping obligations to the controls, culture and reporting that prove they are met.
Key takeaways
- ISO 37301 covers mandatory obligations and voluntary commitments.
- An obligations register maps each obligation to the parts of the organisation it affects.
- A compliance risk assessment shows where failure would hurt most.
- The compliance function needs authority and independence.
- People must be able to raise concerns, and investigations handled properly.
One system for obligations and commitments
ISO 37301 is the international standard for compliance management systems. It sets requirements, with guidance, for a system through which an organisation meets its compliance obligations: the laws, regulations, permits, licences, regulatory orders and contract terms it must comply with, and the codes, policies and commitments it has chosen to adopt. In the standard's words, compliance is an ongoing process and the outcome of an organisation meeting its obligations.
A board should ask three direct questions: do we know every obligation that applies to us, which of them could hurt us if we got them wrong, and can we show that we meet them? This short film walks through how the system that answers those questions is built.
From obligations to certification
Define the scope: the entities, activities and locations covered and the regulators, contracts and commitments that matter. A gap analysis then compares the current compliance programme with the standard and agrees actions with owners and dates.
The core of the build is an obligations register, mapping each law, regulation, permit, contract term and voluntary commitment to the parts of the organisation it affects, followed by a compliance risk assessment that identifies which obligations carry the most risk. Controls are designed and put into operation, the governing body and top management lead a compliance culture, and a compliance function is given the authority and independence it needs. Training is built into the employment process, people are able to raise concerns, investigations are handled properly, and compliance performance is monitored and reported. Internal audit and management review follow before an independent, accredited certification body audits the system and decides.
Sterling's expert and experienced consultants carry the obligations mapping, risk assessment and implementation with your team under Sterling OS™, with the register held in Effivity. ISO 37301:2021 with Amendment 1:2024 is current and was confirmed unchanged by ISO in August 2026.
ISO 37301 at a glance
- Purpose
- Compliance management: one system for the obligations you must meet and the commitments you choose to make, with the culture, controls and reporting to prove it
- Relevant to
- Public, private and not-for-profit organisations of any size; above all regulated businesses, listed companies, group subsidiaries and government suppliers
- Edition
- ISO 37301:2021 with Amendment 1:2024; confirmed unchanged by ISO in August 2026, so no transition is pending
- Certification
- Assessed and decided by an independent, accredited certification body
- Sterling's role
- Register, risk assessment and implementation with your team, Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO 37301 CMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months
ISO 37301: questions people ask
Can a small organisation implement ISO 37301?
Yes. The standard expects a system proportionate to the organisation's obligations, risks, size and complexity. A small company usually needs a short but complete obligations register, a clear policy, one person with the authority and time to act as the compliance function, a few controls where the risk is real and a way for staff to raise a concern.
What is the difference between ISO 37301 and ISO 19600?
ISO 19600:2014 was a guideline with no requirements, so nobody could be certified against it. ISO 37301:2021 replaced it on 13 April 2021 as a requirements standard with guidance for use, on the harmonised structure, and an accredited certification body can now certify against it.
Is ISO 37301 certification mandatory?
No law requires it in general. Regulators, licensing authorities, listing rules, lenders and customers expect an effective compliance programme, but the certificate itself is a choice, made because it gives the programme a recognised structure and an independent check that outsiders can rely on.
Does ISO 37301 certification mean we comply with the law?
No. The certificate attests that your compliance management system conforms to ISO 37301 and is operating; it is not a legal opinion that every obligation has been met. What the system gives you is a systematic way of knowing your obligations, managing the risks and evidencing what you did, which is what regulators and courts weigh when something goes wrong.
Does Sterling issue the ISO 37301 certificate?
No. Sterling consults; an independent, accredited certification body conducts the audit and takes the decision. A provider offering to do both is offering paper.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO 37301
Start with the ISO 37301 page, or go straight to the guide you need.
On the ISO 37301 page
More videos: Governance, risk and resilience
- How to implement ISO 22301Implementation walkthrough · 3 min 24 s
- ISO 22301 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 37001Implementation walkthrough · 3 min 14 s
- ISO 37001 requirements explainedTwo-minute brief · 2 min
- ISO 37500 guidance explainedTwo-minute brief · 2 min
- How to implement ISO 31000Implementation walkthrough · 3 min 15 s
- ISO 31000 guidelines explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO 37301 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice