ISO 37301 requirements explained: video brief

Compliance content inside clauses 4 to 10

ISO 37301:2021 uses the harmonised structure shared by the ISO management system standards, clauses 4 to 10, and adds the compliance-specific requirements inside it. This short film walks through where they sit.

Clause 4 covers context, including the compliance obligations the organisation must meet and the compliance risk assessment that identifies, analyses and evaluates the risk of failing to meet them, as well as whether climate change is a relevant issue. Clause 5 covers leadership, with compliance culture, governance and the compliance function; where an organisation has no separate governing body, the requirements addressed to it apply to top management. Clause 6 covers planning, objectives and change.

People, controls, reporting

Clause 7 adds compliance to the employment process and to training, so that people understand the obligations relevant to their roles. Clause 8 covers operation: controls that address compliance risks, procedures for raising concerns, and investigation processes. Clause 9 covers performance evaluation, including feedback, indicators, compliance reporting and record-keeping, alongside internal audit and management review, and clause 10 covers improvement, nonconformity and corrective action.

The standard applies to public, private and not-for-profit organisations of any size, above all regulated businesses, listed companies, group subsidiaries and government suppliers. ISO 37301:2021 with Amendment 1:2024 was confirmed unchanged by ISO in August 2026, so no transition is pending. Certification is assessed and decided by an independent, accredited certification body, under the same rules as other ISO management system standards.

ISO 37301 replaced ISO 19600, a guideline with no requirements, on 13 April 2021, turning compliance management into a requirements standard on the harmonised structure. A certificate attests that the compliance management system conforms to the standard and operates; it is not a legal opinion that every obligation has been met. Top management gives a compliance function responsibility and authority for operating the system, with direct access to the governing body, independence and adequate resources. Clause 8.3 requires a process for raising concerns about attempted, suspected and actual noncompliance, with confidentiality, the option of anonymity and protection from retaliation, and clause 8.4 an investigation process. A small company needs a short but complete obligations register, a clear policy and one person with the authority and time to run the function.