What is ISO 37301 Compliance Assurance?

What is ISO 37301?

What is ISO 37301 Compliance Assurance? The guidelines on compliance management systems are applicable to all types of organizations. The extent of the application of these guidelines depends on the size, structure, nature and complexity of the organization. ISO 37301:2021 is based on the principles of good governance, proportionality, transparency and sustainability.

ISO 37301 helps establish, develop, evaluate, and maintain a compliance management system. It brings together separate strands of compliance management and risk management, and its processes align very closely with ISO 31000, another risk management standard.

What is meant by Compliance Management?

Simply put, Compliance Management refers to a company obeying applicable laws, relevant industry standards and internal policies (e.g. codes of conduct) it has decided to implement because they impact upon its business, its staff and its treatment of consumers.

Amongst many other things, the new standard “recommends” that organisations: “adopt a risk-based approach to compliance” and “develop a risk appetite for compliance risks”. The standard gives comprehensive guidance with helpful and easy-to-follow examples for users wanting to implement a compliance management system or benchmark their framework against a standard.

What does Compliance Management cover?

All ISO 37301 sets out how a Compliance Management system should function in a logical manner. As such Risk Management forms a central part of this standard. Because risks are identified, analysed and evaluated in order to meet compliance requirements and establish controls, countermeasures that are established to meet these risks and are applied for the highest compliance risks.

The evaluation of the effectiveness of compliance measures as well as ongoing process improvement also plays a role, alongside internal and external communication. Last but not least, the standard focuses on the roles and responsibilities of senior and line managers as well as employees. The independence of the compliance officers is also reviewed in detail.