ISO 37301 · Compliance management systems
ISO 37301 certification consulting for compliance you can evidence, not just assert.
Get ISO 37301 certified by an independent, accredited body, first time, on your timeline. Sterling's expert and experienced consultants map your obligations, assess the compliance risks with your leadership, build the controls and reporting lines the standard expects, prepare the evidence and stay with you through the certification audit and after it, in 60+ countries. We ensure successful certification for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced compliance management consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
8,100+ client engagements in 60+ countries.
ISO 37301 client experience
What it is
What is ISO 37301 and what is it used for?
ISO 37301 is the international standard for compliance management systems. It sets out requirements, with guidance, for establishing, implementing, evaluating, maintaining and improving a system through which an organisation meets its compliance obligations: the laws, regulations, permits, licences, regulatory orders and contract terms it has to comply with, and the codes, policies and commitments it has chosen to adopt. In the standard's own words, compliance is an ongoing process and the outcome of an organisation meeting its obligations. It applies to any organisation, whatever its sector or size.
A board should ask three direct questions: do we know every obligation that applies to us, which of them could hurt us if we got them wrong, and could we show a regulator, a customer or a court what we did about it? ISO 37301 turns those three questions into a working system: an obligations register, a compliance risk assessment, a policy the governing body owns, a compliance function with the standing and access to do its job, controls where obligations bite, a speak-up channel, an investigation process, and reporting that tells leadership whether the system works. The standard says that embedding compliance in behaviour depends above all on leadership at every level and clear values; the certificate shows that leadership has been organised and independently checked.
Current edition. ISO 37301:2021, the first edition, was published on 13 April 2021 and replaced ISO 19600:2014, a guideline that could not be certified. Amendment 1:2024 (February 2024) adds the climate-change text all ISO management system standards received that year: clause 4.1 requires the organisation to determine whether climate change is a relevant issue, and clause 4.2 notes that interested parties can have climate-related requirements. No transition programme was needed; certification bodies audit the addition as part of your context. After its systematic review, ISO confirmed the 2021 edition on 3 August 2026, so no revision is in progress and there is nothing to transition to.
Who it is for
Who needs ISO 37301 certification?
ISO 37301 is deliberately generic: a listed group and a family-owned distributor can both conform, because the requirements scale with the obligations and risks each carries. The certificate's scope should name the entities, locations and activities covered. Organisations come to Sterling for ISO 37301 from four starting points:
- A regulator, a licence condition or a listing rule expects a demonstrable compliance programme. Financial services, telecoms, energy, healthcare, gaming, pharmaceuticals and government contracting all ask, in their own vocabulary, for an organised way of meeting obligations. ISO 37301 gives that programme a recognised shape and an independent check a regulator can read.
- A customer, a bank or a parent company wants evidence, not a policy. Due diligence questionnaires, lender covenants and group charters ask how obligations are identified, who owns them and how breaches are reported and investigated. A certificate with the right scope answers all three.
- Compliance sits in one person's head, or in several people's spreadsheets. Obligations are tracked by whoever last read the circular, training is ad hoc and nobody can say what changed in the law last quarter. The standard's register, risk assessment and reporting turn that exposure into a managed system.
- You already hold ISO 37001, ISO/IEC 27001 or ISO 9001 and want compliance managed the same way. The governing body wants one view of legal, regulatory, anti-bribery, privacy and contractual obligations rather than a regime for each, and the harmonised structure makes that a straightforward extension.
Business benefits
How ISO 37301 protects the licence to operate
A compliance management system earns its keep when an obligation and a commercial pressure pull in opposite directions: a launch waiting on a permit, a contract clause nobody read, a regulatory change that reached the inbox but not the process. We start with the obligations whose breach would cost the most.
- Every obligation known and ownedA register that relates each law, licence, code and commitment to the activities it affects, with an owner, a review date and a route for changes, so nothing applies to you that nobody watches.
- Effort where the risk isA risk assessment that ranks obligations by the likelihood and consequence of getting them wrong, so training, controls and monitoring are concentrated rather than spread thin.
- A compliance function that can actDefined authority, adequate resources, independence and direct access to the governing body: what gets advice heard before a decision rather than after a breach.
- Problems raised inside firstA confidential channel people trust, protection from retaliation and investigations that reach a documented conclusion, so issues surface internally, not through a regulator or the press.
- Reports a board can act onIndicators, feedback sources and periodic compliance reports that tell the governing body what was breached, what changed and what was fixed, not a reassurance that all is well.
- Credible answers to customers and regulatorsA certificate whose scope covers the entities and activities being examined, backed by evidence that the system runs, which shortens due diligence and supports proportionate treatment.
Pick a few measures that reflect these priorities, such as overdue obligation reviews, concerns raised and time to close them, or training completion in higher-risk roles, and judge the system by whether they move. A thicker policy library is not a compliance outcome.
Requirements
What are the main ISO 37301 requirements?
ISO 37301:2021 uses the harmonised structure shared by the ISO management system standards, clauses 4 to 10, and adds the compliance-specific requirements inside it: obligations and the risk assessment in clause 4; culture, governance and the compliance function in clause 5; the employment process and training in clause 7; controls, raising concerns and investigations in clause 8; feedback, indicators, compliance reporting and record-keeping in clause 9. Where an organisation has no separate governing body, the requirements addressed to it apply to top management. The table is a plain-language map, not the standard's text; your implementation is checked clause by clause during the programme.
| Clause | What it requires of you | What it looks like in practice |
|---|---|---|
| 4 Context of the organisation, with 4.5 compliance obligations and 4.6 compliance risk assessment | Understand the issues that shape your exposure, including whether climate change is relevant, the interested parties and the scope; identify your compliance obligations systematically and keep them current; identify, analyse and evaluate the resulting compliance risks, and reassess when activities, obligations or the organisation change | A scope statement naming entities, sites and activities; an obligations register linked to processes and owners; a documented risk assessment with likelihood, consequence and existing controls, reviewed on a schedule and after material change |
| 5 Leadership, with 5.1.2 compliance culture, 5.1.3 compliance governance and 5.3.2 the compliance function | The governing body and top management lead visibly, develop and promote a compliance culture at every level, and see that the compliance function has direct access to them, independence, authority and adequate resources; a compliance policy; responsibilities assigned to the compliance function, to management and to all personnel | Board and management minutes that show compliance decisions, a policy people have read, a compliance function with a documented remit and reporting line, responsibilities written into role descriptions |
| 6 Planning | Act on the risks and opportunities the assessment reveals, set measurable compliance objectives and plan changes to the system deliberately | Objectives with owners, measures and dates; a record of how new products, markets, structures or laws were assessed before the change went live |
| 7 Support, with 7.2.2 the employment process and 7.2.3 training | Competent people; an employment process in which conditions of employment require compliance, higher-risk roles are checked in proportion to the risk, and incentives do not reward noncompliance; role-based training and awareness; communication; controlled documented information | Screening proportionate to the role, compliance clauses in contracts and job descriptions, a training plan by role with records, an incentive review on file, and documents with versions and owners |
| 8.1 to 8.2 Operational planning and control; establishing controls and procedures | Plan and control the processes that carry compliance obligations, including outsourced ones; establish and maintain the controls and procedures that manage each obligation and risk, and review them so they stay effective | A control for every higher-risk obligation, traceable in the register with its owner, procedure and monitoring, and a periodic review that retires stale controls and adds missing ones |
| 8.3 Raising concerns | A process that enables and encourages personnel to report attempted, suspected and actual noncompliance, protects confidentiality, allows anonymous reporting, shields reporters from retaliation and is known to the people expected to use it | A speak-up channel with more than one route, a published non-retaliation commitment, awareness evidence, and a log showing every concern was acknowledged and handled |
| 8.4 Investigation processes | A process to evaluate, investigate and conclude reported and detected noncompliance, carried out by people with the competence and independence the case requires, with the outcome recorded and acted on | Case files with the allegation, the investigator, the evidence, the conclusion, the corrective action and the lessons fed back into the risk assessment and controls |
| 9 Performance evaluation, with 9.1.2 to 9.1.5 sources of feedback, indicators, compliance reporting and record-keeping | Monitor and measure the system through defined feedback sources and indicators; report on compliance performance to the governing body, top management and, where required, regulators; keep records; audit internally; review at management level | A compliance dashboard, a periodic compliance report covering breaches, changed obligations and corrective actions, an internal audit programme weighted to risk, and a management review that records its decisions |
| 10 Improvement | Improve the system continually and act on nonconformities, including breaches that surface through concerns, investigations and audits, with corrective action that removes the cause | Corrective actions closed with evidence, repeat breaches analysed for a common cause, and the register, controls and training updated as a result |
What does useful ISO 37301 evidence look like?
An obligations register that names real laws, licences, codes and contracts and the processes they touch; a risk assessment with its criteria and dates; the policy with its acknowledgements; the compliance function's remit and its reports to the governing body; training records by role; controls mapped to obligations; the concerns log and case files; internal audit and management review records. We help identify the records your obligations require, without documents that only fill folders, and they live in Effivity from the first workshop so the auditor sees a system that runs.
ISO 37301 requirements explained, clause by clauseCertification process
How do you get ISO 37301 certified?
Build a working system first; then an independent certification body audits it. ISO 37301 is certified under the same rules as other ISO management system standards, ISO/IEC 17021-1, by auditors who meet the competence requirements of ISO/IEC TS 17021-13, and it sits within the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA, so an accredited certificate is recognised across borders. Sterling supports you through the obligations mapping, the risk assessment, preparation and implementation; the decision belongs to the certification body, and that separation is what makes a compliance certificate credible to a regulator.
- 01Settle what the certificate has to cover.Confirm the entities, jurisdictions, activities and obligation families in scope, who the governing body is, and what the regulator, customer or parent expects.
- 02Gap analysis: measure what exists against the standard.The gap analysis tests the existing register, policies, controls and reporting against the standard, keeps what works and agrees actions, owners, dates and resources.
- 03Map the obligations, assess the risks and build the controls.The register and the risk assessment drive the rest: the policy, the compliance function's remit, training, controls for higher-risk obligations, the speak-up channel, investigations and indicators.
- 04Operate, report, audit and address the findings.The system runs long enough to produce compliance reports, training records, handled concerns and monitoring results; internal audit and management review test it; findings are raised by us first and closed with evidence.
- 05Undergo the independent assessment.The certification body's Stage 1 readiness review, then the Stage 2 audit; findings answered, then its decision.
- 06Keep the system running once certified.Obligation updates, training, monitoring, reporting, internal audits and reviews continue, alongside the body's surveillance audits and three-yearly recertification.
Test the credibility of the route, not only the price. Ask for the certification body's identity, whether its accreditation covers compliance management systems, the proposed scope and the audit arrangements, and verify them directly. Be cautious of "no implementation, no audit" offers: a certificate a regulator cannot rely on leaves the obligations unmanaged. How to choose a credible ISO 37301 provider · The certification buyer's checklist
Cost
How much does ISO 37301 certification cost?
There is no useful universal price for ISO 37301 implementation. A single-jurisdiction service company needs a different programme from a group answering to several regulators in several countries; jurisdictions and regulated activities move the effort more than headcount does. What we can promise is a proposal in which every component is visible and nothing is added later.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Maturity of the existing programme, entities, jurisdictions and regulated activities in scope, the size of the register, the deliverables and how much of the work your team takes on (Design™ or Drive™) |
| Independent certification | The certification body's audit days, locations, travel and the annual surveillance arrangements |
| Internal resources | Time of the compliance function, legal and process owners, obligation research, training, corrective work and operational changes |
| Software and learning | Included in a Sterling engagement: Effivity for the system and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, obligation and risk reviews, upkeep, refresher learning and future revisions under Sustain™ |
What moves the price
- Jurisdictions, regulators and licences in scope, and how often they change
- Entities, sites and the processes that carry higher-risk obligations
- Whether an obligations register exists today, and how much of it is evidenced
- The deadline, and how much of the work your team can carry
- Languages, group reporting lines and customer or lender requirements
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Certification-body fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does ISO 37301 certification take?
The realistic timeline depends on your starting point, how many jurisdictions and regulators are in scope, how quickly the governing body can decide, and the certification body's schedule. It is counted in months, not days, typically four to eight: the obligations have to be identified and assessed, controls and training put in place, a compliance report produced, and an internal audit and a management review held before an auditor can see a system that operates. The plan is built around that evidence, with milestones tracked in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to the governing body, management, legal, the existing compliance function and current registers, policies and records |
| Obligations mapping, risk assessment and build | Jurisdictions, licences and business lines to map, decisions on the compliance function's remit and reporting line, and approval times |
| Operation and evidence | Training delivered in higher-risk roles, controls in use, concerns handled, a compliance report issued, then internal audit and management review |
| Certification assessment | The certification body's availability, Stage 1 and Stage 2 scheduling, and the time needed to address any findings |
If a regulator's deadline or a customer's due diligence date is driving the programme, share it at the start and we will say what is achievable. A certificate date promised before anyone has looked at your obligations is not a project plan; it is a sales tactic.
Challenges
Common ISO 37301 implementation challenges
Most ISO 37301 programmes stall for the same five reasons. Each has a practical answer.
Nobody can produce the list of obligations.
Start with the activities, not the statute books: for each business line and location, list the regulators, licences, contracts and codes that touch it, then research the obligations behind each. The register is built once in Effivity, with owners and review dates, and updated through a defined change process.
The compliance function has responsibility without authority.
Agree its remit, its resources and its direct line to the governing body and top management before the build starts. Design™ gives that person or team the structure and coaching to run the system; Drive™ has Sterling carry the agreed consulting and documentation work.
Compliance is treated as the legal department's problem.
The standard assigns responsibilities to management in every area and to all personnel. We write them into role descriptions, build controls into the procedures people already follow and train by role, so compliance becomes part of running the business.
The hotline exists but nobody uses it.
Usually because people doubt the confidentiality or fear the consequences. We design the channel with more than one route, a published non-retaliation commitment and an investigation process with timelines, and we measure whether concerns are raised.
Reporting tells the board that everything is fine.
Reports without breaches, near-misses or overdue obligations are a warning sign, not a comfort. We agree indicators that can move both ways, feedback sources beyond the compliance team, and a report that shows what changed, what was found and what was done.
Your engagement
What your ISO 37301 engagement includes
Your agreed scope brings together everything a working compliance management system and a prepared organisation need: the whole journey, from one team, under one all-inclusive proposal.
Scope, gap analysis, obligations mapping, risk assessment and implementation plan
With responsibilities, dates and decision owners, agreed with the governing body and top management before work starts.
Policies, procedures and controls
Compliance policy, the compliance function's charter, the obligations register, controls, raising concerns, investigations and compliance reporting, on Sterling's own template sets, built with your process owners.
Effivity ISO & GRC software
Your CMS runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit, compliance reporting and management review
Conducted or facilitated as agreed, with findings closed with evidence before the certification body arrives.
Certification readiness and support
Preparation for Stage 1 and Stage 2, and support through to the certification decision.
Certification decisions remain with the independent certification body.
How we deliver
How Sterling supports your ISO 37301 implementation
Every ISO 37301 engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. Choose the level of support your capacity allows; the method, the software and the accountability do not change.
- 01Design™Guided implementation: your compliance function and process owners implement with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants take on the agreed consulting and documentation work with your compliance function and process owners.
- 03Sustain™Post-certification operation: obligation updates, surveillance readiness, internal audits, refreshers and new-hire training, year after year.
- 04Automate™The CMS running in Effivity: register, risk assessment, controls, concerns, investigations, indicators, audits and management review in one workspace.
- 05Revise™Future editions and amendments of ISO 37301, and changes in entities, markets, licences or regulation.
At the start we agree the engagement team, the weekly working session, the deliverables and the decision owners; progress is reviewed against them so gaps are visible early, not at Stage 1.
How Sterling OS™ worksOften combined with
Standards organisations pair with ISO 37301
- ISO 37001ISO 37001 certification consulting: proportionate anti-bribery controls to prevent, detect and respond, built with your teams and ready for an accredited audit.
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
- COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
- FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
Effivity · ISO 37301 CMS software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO 37301:2021.
Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries, is part of every Sterling ISO 37301 engagement. Your consultant configures the CMS workspace within the agreed scope, so the obligations register, the risk assessment, controls, training records, concerns and case files, compliance reports, audits and management review live in one place and the certification auditor reviews a live system rather than a binder. Sterling consulting clients have the Effivity subscription included with the engagement, at no additional cost.
Obligations register and compliance risk assessment
Every obligation linked to the processes and owners it affects, with its source, review date and change log; the risk assessment scores likelihood and consequence against existing controls and flags what to reassess when the business or the law changes.
Policy, compliance governance and the compliance function
The compliance policy with its distribution and acknowledgements, the compliance function's remit and reporting line, and the reports it sends to top management and the governing body, dated and on file.
Objectives, actions and planned changes
Compliance objectives with measures, owners and dates; actions from the risk assessment tracked to closure; new products, markets, structures or regulations assessed and recorded before they take effect.
Competence, employment process and documented information
Role-based training plans and records linked to Sterling Academy, screening and incentive reviews for higher-risk roles, and documents with versions, approvals and distribution, so the current version is the only one in use.
Controls and procedures mapped to obligations
Each higher-risk obligation carries its control, procedure, owner and monitoring record, so a change in the law or a failed check is visible against the obligation it affects, not buried in a shared drive.
Raising concerns and investigations
Concerns logged with confidentiality controls and anonymous intake, case files with the investigator, the evidence, the conclusion and the actions taken, reported to the compliance function and management from the system.
Indicators, compliance reporting, internal audit and management review
Feedback sources and indicators on live dashboards, compliance reports generated from the system, risk-weighted audit programmes with findings and follow-up, and a management review that records its inputs, decisions and actions.
Nonconformity and corrective action
Breaches, audit findings and investigation outcomes raised, analysed for root cause and closed with the evidence that the action worked; repeat issues visible to management before they become a finding.
What this means at the audit
The certification auditor asks for the obligations register, the risk assessment, the compliance function's last report to the governing body, training records for higher-risk roles, the concerns log, the internal audit programme and the last management review. In Effivity every one of them is a screen carrying dates, owners and evidence, not a folder put together the week before Stage 1. Once certified, Sustain™ runs in the same workspace, and every surveillance audit meets a system that never paused.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your registers, policies and case records migrated, not retyped
- Admin and user training for your team
- Modules for anti-bribery, information security, quality and more when you integrate other standards
ISO 37301 client experience
Client letters on file, available on request.
Signed client letters for ISO 37301 are available on request. The client feedback wall lists every letter by standard.
Where ISO 37301 usually sits
How a combined compliance programme is run.
- 01How integrated programmes run
Compliance, anti-bribery and information security as one programme
ISO 37301 is commonly implemented together with ISO 37001 and ISO/IEC 27001, usually on top of an ISO 9001 system. In such a programme one register holds legal, anti-bribery, privacy and contractual obligations side by side, one risk method scores them, one speak-up channel and one investigation process serve every standard, and one compliance report, internal audit programme and management review support every certificate.
Sterling Academy · ISO 37301 e-learning
Train every employee on ISO 37301, not just the compliance function.
Sterling Academy trains the whole workforce and the people who run the system online: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion per learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- ISO 37301 awareness for every employee, with the awareness evidence the standard requires
- Practitioner courses for the compliance function, managers who own obligations and those who handle concerns
- Internal auditor training for the people who will audit the system, as applicable to your standard, as part of the engagement
- Learner progress by department and a training status report for the certification auditor
- New hires trained as they arrive and higher-risk roles refreshed on a schedule, so evidence stays current
- A Sterling consultant reachable when a learner needs one
Sterling Academy courses for an ISO 37301 programme
The courses your people take, and who takes them.
ISO 37301 Awareness
What a compliance obligation is, what the policy asks of each person, why the culture depends on everyday decisions, and how and where to raise a concern. Awareness evidence for every employee.
Coming soon: view the courseDocumented Information Management
Creating, controlling and retaining the register, policies, procedures, case records and compliance reports the system depends on, so evidence stays usable and audit-ready.
View the courseNonconformity Management
Recording, investigating and closing noncompliances, whether they arrive through a concern, an audit or a regulator, root cause and corrective action, and the evidence that a fix worked.
View the courseRisk Management
Identifying, analysing and evaluating compliance risks by relating obligations to activities, products and services, with the documented assessment, ownership and reassessment clauses 4.6 and 6.1 expect.
View the courseInternal auditor training
Delivered by your Sterling consultant for the people who will audit the compliance management system, with practical exercises on your own register, controls and case files, and a Certificate of Competence.
Integrating other standards?
Awareness courses for ISO 37001, ISO 9001, ISO/IEC 27001, ISO 14001, ISO 45001, ISO 22000 and more, so one workforce is trained on one platform for an integrated system.
See all coursesAccess is arranged through your Sterling consultant. Academy certificates evidence training; certification of your management system stays with the independent certification body.
Where we work
Where Sterling delivers ISO 37301
- ISO 37301 in Australia
- ISO 37301 in Austria
- ISO 37301 in Bahrain
- ISO 37301 in Bangladesh
- ISO 37301 in Belgium
- ISO 37301 in Brazil
- ISO 37301 in Canada
- ISO 37301 in China
- ISO 37301 in Czechia
- ISO 37301 in Denmark
- ISO 37301 in Egypt
- ISO 37301 in France
- ISO 37301 in Germany
- ISO 37301 in Ghana
- ISO 37301 in Hong Kong
- ISO 37301 in India
- ISO 37301 in Indonesia
- ISO 37301 in Ireland
- ISO 37301 in Italy
- ISO 37301 in Japan
- ISO 37301 in Jordan
- ISO 37301 in Kenya
- ISO 37301 in Kuwait
- ISO 37301 in Malaysia
- ISO 37301 in Maldives
- ISO 37301 in Mauritius
- ISO 37301 in Mexico
- ISO 37301 in Nepal
- ISO 37301 in the Netherlands
- ISO 37301 in New Zealand
- ISO 37301 in Nigeria
- ISO 37301 in Norway
- ISO 37301 in Oman
- ISO 37301 in Pakistan
- ISO 37301 in the Philippines
- ISO 37301 in Poland
- ISO 37301 in Portugal
- ISO 37301 in Qatar
- ISO 37301 in Saudi Arabia
- ISO 37301 in Singapore
- ISO 37301 in South Africa
- ISO 37301 in South Korea
- ISO 37301 in Spain
- ISO 37301 in Sri Lanka
- ISO 37301 in Sweden
- ISO 37301 in Switzerland
- ISO 37301 in Taiwan
- ISO 37301 in Tanzania
- ISO 37301 in Thailand
- ISO 37301 in Türkiye
- ISO 37301 in Uganda
- ISO 37301 in the United Arab Emirates
- ISO 37301 in the United Kingdom
- ISO 37301 in the United States
- ISO 37301 in Vietnam
Keep exploring
Explore more about ISO 37301
Watch a video on how to implement ISO 37301 here.
Watch a video on ISO 37301 requirements here.
Why Sterling
Want successful ISO 37301 certification? Come to Sterling.
Whether you answer to one regulator or to a dozen across countries with different laws and enforcement styles, Sterling helps you build one compliance management system with clear local ownership, so obligations are managed where they arise and reported where decisions are made.
Management systems in 60+ countries since 2003
Governance, risk and compliance systems implemented for financial services, BPO, energy, healthcare, logistics, technology and government suppliers, with one engagement team accountable wherever you operate.
All-inclusive proposal
Consulting, Effivity, training and Academy access priced in one proposal, the certification body's fees itemised on their own. No surprises, ever.
A system your people can use
Controls placed where obligations bite, a register people can search, and paperwork limited to what a regulator, an auditor or a court would ask for, so the system is used rather than tolerated.
Expert and experienced consultants
Consultants who have advised on management systems across sectors and countries since 2003 and build your CMS properly the first time, so the certification audit confirms what already works.
The Sterling Promise
What our ISO 37301 certification success guarantee means
We stay with you until your agreed ISO 37301 certification outcome is achieved, supporting the mapping, the risk assessment, implementation, preparation and the resolution of assessment findings. Clear explanations, practical delivery, included software and employee learning turn the investment into a compliance capability, not a certificate on a wall.
The engagement names the standard, the scope, the outcome and the responsibilities. Your organisation provides accurate information, takes the decisions reserved for its governing body and top management, and puts the agreed controls into use. The independent certification body assesses conformity; the decision is its alone. Our commitment covers the agreed certification support; it is not legal advice on any obligation, nor a warranty that a breach can never occur.
After certification
What happens after ISO 37301 certification?
Your CMS should keep working as laws, licences, contracts, products and people change: obligations updated, risks reassessed, concerns handled, compliance reports reaching the governing body and training keeping pace with turnover. The certification body returns for surveillance, normally every year, and for recertification at the end of the three-year cycle.
Under Sterling OS™ Sustain™ we review the obligations register, the risk assessment and the indicator trends with you alongside the planned internal audits, management reviews and surveillance preparation, so the system stays alive between audits.
FAQs
Frequently asked questions about ISO 37301
Can a small organisation implement ISO 37301?
Yes. The standard expects a system proportionate to the organisation's obligations, risks, size and complexity. A small company usually needs a short but complete obligations register, a clear policy, one person with the authority and time to act as the compliance function, a few controls where the risk is real and a way for staff to raise a concern.
What is the difference between ISO 37301 and ISO 19600?
ISO 19600:2014 was a guideline with no requirements, so nobody could be certified against it. ISO 37301:2021 replaced it on 13 April 2021 as a requirements standard with guidance for use, on the harmonised structure, and an accredited certification body can now certify against it.
Is ISO 37301 certification mandatory?
No law requires it in general. Regulators, licensing authorities, listing rules, lenders and customers expect an effective compliance programme, but the certificate itself is a choice, made because it gives the programme a recognised structure and an independent check that outsiders can rely on.
Does ISO 37301 certification mean we comply with the law?
No. The certificate attests that your compliance management system conforms to ISO 37301 and is operating; it is not a legal opinion that every obligation has been met. What the system gives you is a systematic way of knowing your obligations, managing the risks and evidencing what you did, which is what regulators and courts weigh when something goes wrong.
Does Sterling issue the ISO 37301 certificate?
No. Sterling consults; an independent, accredited certification body conducts the audit and takes the decision. A provider offering to do both is offering paper.
ISO 37301 or ISO 37001: which one, or both?
ISO 37301 covers all of an organisation's compliance obligations; ISO 37001 goes deeper on bribery alone: due diligence, gifts and hospitality, financial and non-financial controls. If bribery is your dominant risk, start with ISO 37001; if a regulator or a board wants the whole compliance agenda managed, ISO 37301 is the frame and ISO 37001 can sit inside it. Both are certifiable on the harmonised structure, so a body accredited for both can audit them in one visit.
Who should be our compliance function?
The standard requires top management to give a compliance function responsibility and authority for operating the system, and asks the governing body and top management to ensure it has direct access to them, independence, authority and adequate resources. It can be a compliance officer, a team, a committee or, in a small organisation, a senior manager with defined authority; what matters is the reporting line, freedom from conflicting duties and time.
Does ISO 37301 cover whistleblowing?
Clause 8.3 requires a process for raising concerns about attempted, suspected and actual noncompliance, with confidentiality, the option of anonymity and protection from retaliation, and clause 8.4 requires an investigation process. ISO 37002:2021 gives guidelines, not certifiable requirements, for a whistleblowing management system and is the natural design reference for that channel.
What do you need to prepare an ISO 37301 proposal?
The entities, countries and activities to be covered, approximate headcount, the regulators and licences you answer to, whether an obligations register, a compliance function or a certificate exists today, any regulator, customer or parent-company requirement, and your deadline. That is enough for a scoped, all-inclusive proposal; there is no need to prepare the register first.
Before the first call
Prepare a useful ISO 37301 readiness brief
You do not need a register or a policy before the first discussion. Bring a short account of what the organisation does, who regulates it and where the certificate should help. Seven questions are enough:
- Who is asking: a regulator, a licence condition, a customer, a lender or a parent company, and which entities and countries must the certificate cover? Or, if nobody has asked, what does the governing body want to show?
- Which regulators, licences, permits, codes and major contracts govern your activities, and who follows changes to them today?
- Where have breaches, regulator findings, penalties, complaints or near-misses occurred in recent years, and what did they reveal?
- Who currently acts as the compliance function, to whom do they report, and how much of their time is available?
- Which existing policies, registers, training, controls and reporting channels already work, including under other ISO certificates you hold?
- Who can make decisions and contribute time: the governing body, top management, legal, HR, finance and the managers who own regulated processes?
- Is there an existing certificate, an inspection date or a due diligence deadline to plan around?
These answers let us scope the work and prepare a realistic proposal; they are not a scored assessment or a certification decision.
Don’t be fooled by certification scams
If it takes ten days, it is not ISO 37301 certification.
A compliance certificate is useful when its scope covers the entities under examination and the system behind it stands up to review. The market is full of paper: certificates from bodies nobody accredits, a policy template renamed "compliance management system", and audits that never open the obligations register or the concerns log. They cost less, until a regulator, a lender or a court checks; a hollow compliance certificate is worse than none.
How to choose a credible ISO 37301 provider
- Ask who will issue the certificate and how you can check its status and scope on the certification body's public register.
- Confirm the accreditation covers compliance management systems, under a body recognised through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA, and check it with the accreditation body itself, not a logo in a quotation.
- Ask how the programme will examine your real obligations, licences, contracts and concerns. Documents should reflect your regulators and risks, not a template with another company's name still in it.
- Identify who carries each task, especially the obligations research, which assessment costs are separate, and what support exists when findings need correcting.
- Ask what your people will learn and where the system will be kept. With no training and no software, nothing survives the consultant's departure.
- Decline "certified in 7 to 10 days", "leave it all to us" and one invoice covering consulting and certificate. A compliance management system has to run against real obligations before it can be audited.
Keep exploring
More on ISO 37301 and related standards
Every ISO 37301 guide
More in Governance, risk & resilience
Talk to a consultant
Plan your ISO 37301 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice