New Zealand · Certification
ISO 37301 certification in New Zealand
Achieve ISO 37301 certification in New Zealand with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Accredited certification
- Sydney office team
- Effivity software included
- Academy training included
Who asks for ISO 37301 in New Zealand
Clients include
ISO 37301 certification in New Zealand at a glance
One New Zealand instrument bears on ISO 37301. It does not name the standard. So why do buyers in New Zealand keep asking for the certificate?
Compliance in a New Zealand organisation rarely arrives as a single obligation. A business may need a privacy officer and breach notification under the Privacy Act 2020, officer due diligence under the Health and Safety at Work Act 2015, proportionate anti-corruption procedures as the Ministry of Justice recommends, and sector rules on top. None of these names ISO 37301, and certification is voluntary, but the standard offers a single framework of obligations register, risk assessment, controls, reporting and review. Government buyers can ask suppliers for evidence of meeting the Supplier Code of Conduct, which accepts certifications among its examples. A certification body, ideally accredited by JASANZ, audits the system. Sterling's Sydney office helps New Zealand organisations build and maintain it, with Effivity software and Sterling Academy training included with the engagement.
Who needs ISO 37301 in New Zealand, and what happens without it
In New Zealand the question rarely comes from a law. It comes from the buyer, the regulator or the partner that wants proof before it signs. These are the organisations that get asked.
- Businesses with several overlapping legal dutiesA New Zealand business may face the Privacy Act, HSWA, sector rules and anti-bribery law at once, and a compliance management system gives them one managed process.
- Directors and officersHSWA requires officers to exercise due diligence on health and safety responsibilities, one example of personal accountability for compliance.
- Financial market participantsClimate reporting entities report under a regime the FMA monitors and enforces, and compliance obligations multiply.
- Suppliers to government agenciesThe Supplier Code of Conduct sets expectations and agencies may ask for evidence of compliance.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the ISO 37301 readiness checkISO 37301 requirements in New Zealand
Strip away the vocabulary and ISO 37301 requires a company to prove six things about how it meets its legal and other obligations.
In New Zealand these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: ISO 37301 explained →
How to get ISO 37301 certified in New Zealand
One team from the Sydney office carries the work from scoping to certificate. Clients across New Zealand are served from Sterling's Sydney office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against ISO 37301 and the New Zealand requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before the certification body arrives.
- Certification body stage 1 and stage 2, then surveillanceAn accredited body audits and decides. Sterling supports the audits and the three-year cycle.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does ISO 37301 certification take in New Zealand?
There is no standard duration: it depends on your scope and on how much of the system already runs. In New Zealand these are the factors that set the timeline.
- Compliance obligations register to build
- Risk assessment and controls across legal topics
- Complaints, concerns-reporting and investigation processes to formalise
- Certification body scheduling around public holidays
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does ISO 37301 certification cost in New Zealand?
The cost has two parts: the consulting work to build and prove the system, and the certification body’s audit fees, which are quoted separately. In New Zealand these factors move both.
- Number of obligations, entities and sites in scope
- Compliance function resourcing and tooling
- Certification body audit fees quoted separately from consulting
- Integration with ISO 9001 or ISO 37001 work
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
ISO 37301 consultants and certification bodies in New Zealand
Two different organisations are involved. A consultant helps you build the system and prove it works; an accredited certification body then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers ISO 37301 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in New Zealand are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive ISO 37301 in New Zealand (3)
| Instrument | How it treats the standard |
|---|---|
| Privacy Act 2020 and Health and Safety at Work Act 2015 | Does not name the standard Examples of duties that require a privacy officer, serious-harm breach notification, officer due diligence and a primary health and safety duty. |
| Ministry of Justice guide on anti-bribery compliance procedures | Related Procedures should be proportionate to risk; the guide does not name ISO 37301. |
| Supplier Code of Conduct | Does not name the standard Lists certifications and accreditations among the evidence suppliers can offer, and agencies may ask for it. |
Accreditation, audit language and remote audits in New Zealand
Use a certification body accredited for this standard by JASANZ, the joint Australia–New Zealand accreditation body, or by an accreditation body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA); check that the accreditation scope covers the standard and your sector. No body is named here unless its accreditation scope has been verified. Edition and transition details: ISO 37301 hub →
Audit language
English is the usual working language of audits; Māori and New Zealand Sign Language are official languages. Agree the audit language and the language of controlled documents with the certification body at application, and follow any language requirement in a tender or customer contract.
Remote and on-site
Remote audit elements are at the certification body's discretion under its accreditation rules; sites and operations in scope are normally visited on-site.
ISO 37301 in New Zealand: questions clients ask
Does any New Zealand law require ISO 37301?
No law requires it, and none of the Acts or guidance cited here names the standard. The Privacy Act, HSWA and the Ministry of Justice anti-bribery guide each set their own duties and expect compliance to be proportionate to risk. ISO 37301 gives a certifiable framework for managing all of them, but regulators judge compliance with each law.
How does a compliance management system help with privacy and safety duties?
It gives one register of obligations, risk assessment, controls and reporting channel instead of separate efforts. The Privacy Act requires a privacy officer and breach notification, and HSWA asks officers for due diligence on safety. A single system helps evidence both, while each regulator still enforces its own Act.
Is a compliance certificate useful to officers of a New Zealand company?
It can show that duties are managed systematically, which supports the due diligence HSWA expects of officers for health and safety. It cannot replace the duty itself, and a certificate on paper does not protect officers if the system is not used. Take advice on personal exposure.
What do suppliers to government need for compliance evidence?
The Supplier Code of Conduct says suppliers can use policies, practices, certifications and accreditations as evidence, and agencies may ask for it and decide how to enforce. It does not name ISO 37301. Match your evidence to what each tender asks for rather than assuming one certificate will do.
More on ISO 37301 for New Zealand organisations
Other standards New Zealand businesses ask Sterling for
Organisations in New Zealand often combine ISO 37301 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Sydney office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Privacy Act 2020 and Health and Safety at Work Act 2015 — privacy.org.nz; worksafe.govt.nz (accessed 8 Oct 2026)
- Ministry of Justice guide on anti-bribery compliance procedures — justice.govt.nz (accessed 8 Oct 2026)
- Supplier Code of Conduct — procurement.govt.nz (accessed 8 Oct 2026)
- Joint Accreditation System of Australia and New Zealand (JASANZ) — jasanz.org (accessed 8 Oct 2026)
Talk to a consultant
Plan your certification with the Sydney team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
australia@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice