Obligations-based approach
Identify and meet obligations
"ISO 37301 focuses on identifying the obligations that affect the organization and assessing the risk of non-compliance, beyond a purely criminal-law approach."
ISO 37301 Compliance Management System Certification
Comprehensive legal advice to obtain and maintain ISO 37301:2021 certification: compliance gap assessment, design of the compliance management system (CMS), preparation for the certification body audit and integration with UNE 19601, ISO 37001 and UNE 19602.
Free ISO 37301 consultation
We reply within 24 h
- Certifiable compliance standard
- ISO 37301:2021
- Publication of the standard
- April 2021
- High-level structure (HLS)
- 10 clauses
- Standard it replaces
- ISO 19600:2014
Services
Service catalog for ISO 37301 certification
Six areas of legal and technical work to design, implement and certify a Compliance Management System aligned with ISO 37301:2021.
Diagnostic
ISO 37301 gap analysis
Gap analysis between the organization's current state and the 10 clauses of the standard: context, leadership, planning, support, operation, performance evaluation and improvement.
Learn more →
DiagnosticGapsDue diligenceRisk-based
Implementation
CMS design and implementation
Documentation and rollout of the Compliance Management System: policy, procedures, obligations and risk matrix, controls, training and whistleblowing channel.
Learn more →
PoliciesProceduresMatrixControls
Audit
Internal CMS audit
Internal audit program and execution with objectivity, recording of findings, corrective actions and preparation of the file for the certification body.
Learn more →
InternalFindings
Certification
Support during the external audit
Preparation and support during the certification audit (stage 1 documentation review + stage 2 on site) by AENOR, Bureau Veritas or another accredited body.
Learn more →
AENORBureau Veritas
Integration
Integration with other standards
Alignment of ISO 37301 with UNE 19601 (criminal compliance), ISO 37001 (anti-bribery), UNE 19602 (tax) and ISO 27001 in a single integrated framework.
Learn more →
UNE 19601ISO 37001
Maintenance
Maintenance and continuous improvement
CMS PDCA cycle: management review, KPI monitoring, updating of the obligations map and management of regulatory changes.
Learn more →
KPIsReview
Approach
Why ISO 37301 certification delivers strategic value
ISO 37301 is the only international certifiable standard for compliance management systems. It replaces the former ISO 19600 (which could not be certified) and allows the governing body to show, through an independent third party, that the compliance program works.
Certifiable
Validation by an independent third party
"The certification audit by AENOR, Bureau Veritas or another accredited body provides public, transparent and credible evidence of the commitment to compliance."
HLS structure
Integration with ISO 9001, 27001, 37001
"It shares the high-level structure (HLS) of management system standards, which makes it easier to integrate with quality, information security or anti-bribery."
Governance
Commitment of the governing body
"It strengthens the compliance function and gives top leaders adequate control mechanisms, aligned with international good-governance standards."
Why it matters
Why certify to ISO 37301?
It is not just a badge on your website. Certifying the CMS reduces risk, protects directors, improves your reputation with clients, regulators and investors, and makes it easier to win contracts with large corporate clients and public authorities that require compliance standards.
A comprehensive view of compliance: it is not limited to criminal law. It covers the legal, contractual and voluntary obligations the organization has assumed.
Compliance culture: it promotes staff training and awareness, strengthening the compliance function as a key element of sustainability.
Evidence for regulators: in supervised sectors (CNMV, Bank of Spain, SEPBLAC), a certified CMS is a tangible sign of maturity.
UNE-ISO 37301:202110 clauses
International certifiable standard, published in April 2021, that replaced ISO 19600:2014 (guidance only).
Commercial advantageTenders
A growing number of public tenders and corporate procurement processes value or require accredited compliance certifications.
ImportantNo criminal exemption
ISO 37301 does not replace UNE 19601 for the purposes of Art. 31 bis of the Criminal Code: a complete model is required to claim a mitigating circumstance or exemption from criminal liability.
Want to get certified to ISO 37301?
We help you build a robust, realistic and auditable CMS, ready to pass stage 1 and stage 2 of the certification and, above all, useful for the day-to-day management of your organization.
Frequently asked questions
ISO 37301: common questions
What is ISO 37301:2021?
ISO 37301:2021 is the international standard that specifies the requirements for a Compliance Management System (CMS). It was published by the International Organization for Standardization (ISO) in April 2021 and adopted in Spain as UNE-ISO 37301:2021.
It replaces the earlier ISO 19600:2014, which was only a non-certifiable guideline. ISO 37301 can be certified and adopts the high-level structure (HLS) common to ISO 9001, ISO 27001 and ISO 37001.
What is the difference between ISO 37301 and UNE 19601?
UNE 19601 is the Spanish standard for criminal compliance management systems, aligned with Art. 31 bis of the Criminal Code to build a mitigating circumstance or exemption from the criminal liability of a legal entity.
ISO 37301 has a much broader scope (legal, contractual and voluntary obligations) but is not enough on its own to meet all the requirements of Art. 31 bis of the Criminal Code. The two standards complement each other and can be integrated.
What are the 10 clauses of ISO 37301?
The standard follows the ISO HLS structure: 1. Scope, 2. Normative references, 3. Terms and definitions, 4. Context of the organization, 5. Leadership, 6. Planning, 7. Support, 8. Operation, 9. Performance evaluation and 10. Improvement.
Clauses 4 to 10 contain the auditable requirements.
Which organizations can be certified?
Any organization: private, public, governmental or non-profit, regardless of size, sector or activity. The standard is especially useful for:
- Financial institutions and fintechs subject to heavy regulation.
- Companies that take part in public tenders.
- Groups operating in several jurisdictions with heterogeneous obligations.
- Organizations with high reputational exposure.
What steps do you need to follow to get certified?
In broad terms: gap analysis, CMS design, implementation and training, internal audit, selection of an accredited certification body (AENOR, Bureau Veritas, BSI, TÜV...) and an external certification audit in two stages (documentation review + on site).
If you pass without major nonconformities, the certification body issues the certificate, typically valid for three years with annual surveillance audits.
How much does ISO 37301 certification cost and how long does it take?
The cost depends on the size and complexity of the organization and should be broken down into: implementation consulting fees, internal team hours and the certification body's fees.
The usual timeline is 6 to 12 months from the start of the project to the issue of the certificate, although it can be shorter in organizations that already have established management systems.
What benefits does certification bring?
Main documented benefits: a preventive approach to compliance, mitigation of legal, reputational and penalty risks, an improved corporate image with clients, regulators and investors, and operational optimization through clear processes and controls.
On top of that comes the competitive advantage in tenders and corporate procurement processes that require accredited certifications.
Does it integrate well with other ISO standards?
Yes. Thanks to the high-level structure, ISO 37301 integrates naturally with ISO 9001 (quality), ISO 14001 (environment), ISO 27001 (information security), ISO 37001 (anti-bribery) and UNE 19601 (criminal compliance).
In practice, it is common to design an integrated management system that allows joint audits and saves on documentation.
Practical guide
Practical guide to ISO 37301 certification
Getting certified to ISO 37301 is not “buying a badge”: it means building a real management system, consistent with what the organization does, led from the top and sustained over time. This guide summarizes how to approach it without wasting time or budget.
Key standards and legislation
UNE-ISO 37301:2021 (requirements), UNE 19601 (criminal compliance), ISO 37001 (anti-bribery), UNE 19602 (tax), ISO 27001 (security), ISO 31000 (risk management) and Art. 31 bis of the Criminal Code.
Obligations + risks
The standard revolves around two axes: identifying the obligations that affect the organization and assessing non-compliance risks, designing proportionate controls.
A useful audit, not a cosmetic one
A certifiable CMS that only chases the badge tends to be fragile. The real value lies in the system measuring, correcting and improving the organization's actual behavior.
10-step checklist to obtain ISO 37301 certification
- Visible commitment from the governing body and top management, with a formal decision to certify to ISO 37301.
- Gap analysis of the current state against the 10 clauses of the standard, and an action plan.
- Definition of the CMS scope: activities, subsidiaries, jurisdictions and obligations covered.
- Obligations map and non-compliance risk matrix with consistent assessment criteria.
- Compliance policy, procedures, whistleblowing channel and roles (compliance committee, OCC, etc.).
- Training and awareness program for the governing body, top management and employees.
- Implementation of proportionate controls, indicators (KPIs) and monitoring mechanisms.
- Internal audit, analysis of findings and corrective actions to close nonconformities.
- Management review of CMS performance before the external audit.
- External certification audit (stage 1 + stage 2) by an accredited body and issue of the certificate.
ISO 37301 works very well as an umbrella for other sector-specific obligations: for example, compliance with the FATF list in AML entities, the requirements for SGIIC, the role of the independent director in investment firms (ESI), testing in the financial sandbox or the regime for issuers of MiCA EMTs. For additional validation, it can be complemented with an external expert report.
ISO 37301 in practice
Anatomy of a certifiable CMS
A Compliance Management System certifiable under ISO 37301 rests on four levers: leadership, risks and obligations, controls and culture and continuous evaluation. Each one must be documented and demonstrated with evidence.
1) LeadershipGoverning body and top management
Approved compliance policy, allocation of resources, appointment of the compliance function and periodic oversight of CMS performance.
- Written policy
- Compliance committee
- Tone from the top
2) RisksObligations and risks
Inventory of the obligations that apply to the organization, assessment of non-compliance risk and prioritization of controls using objective criteria.
- Regulatory inventory
- Risk matrix
- Prioritization
3) ControlsControls + culture
Procedures, operational controls, training, whistleblowing channel, conflict-of-interest management and internal communication to build a real culture.
- Procedures
- Whistleblowing channel
- Training
4) EvaluationContinuous evaluation and improvement
KPIs, internal audits, management review, corrective actions and continuous improvement: it is the PDCA cycle that sustains a CMS that is auditable and defensible before any supervisor.
Tip: a well-planned internal audit dramatically reduces nonconformities in the external audit.
IntegrationIntegration with other standards
Criminal compliance
UNE 19601: coverage of Art. 31 bis of the Criminal Code as a mitigating circumstance or exemption.
Anti-bribery
ISO 37001: prevention and detection of bribery and corruption.
Others
UNE 19602 (tax), ISO 27001 (information), ISO 9001 (quality).
ISO 37301 playbook
How each clause works in practice
4. Context
Understand internal and external factors and interested parties, and determine the scope of the CMS.
SWOT analysis, stakeholder map, CMS scope document.
5. Leadership
Governing body commitment, policy, compliance roles and responsibilities.
Approval minutes, signed policy, organization chart, mandate of the OCC/committee.
6. Planning
Address CMS risks and opportunities, set objectives and planned actions.
Risk matrix, annual plan, measurable objectives and associated KPIs.
7. Support
Resources, competence, awareness, communication and documented information.
Training plan, competence matrices, controlled document system.
8. Operation
Operational controls, supplier management, whistleblowing channel and response to non-compliance.
Procedures, due diligence records, operational channel, response plan.
9. Evaluation
Monitoring, measurement, internal audits and management review of the CMS.
KPI reports, internal audit program and minutes, management review minutes.
10. Improvement
Nonconformities, corrective actions and continuous improvement of the system.
Incident log, root cause analysis, improvement plan and follow-up.
Typical warning signs before the audit
Indicators that tend to lead to nonconformities during the certification audit.
- A generic compliance policy that is unsigned or out of date with the organization's real context.
- An obligations map that is incomplete or not updated when the applicable regulations change.
- A risk matrix without objective assessment criteria or without a link to the controls.
- A whistleblowing channel that formally exists but has no real handling procedure or log.
- An internal audit carried out by the person who later implements the corrective actions (lack of independence).
Working glossary
Key concepts for working with ISO 37301
If you are going to pursue ISO 37301 certification, these terms appear in the standard, in audit reports and in contracts with certification bodies.
CMSSystem
Compliance Management System
A set of interrelated elements (policy, processes, resources) to establish and achieve compliance objectives.
Central subject of ISO 37301.
HLSStructure
High Level Structure
Common structure of ISO management system standards. Makes integration with ISO 9001, 14001, 27001 and 37001 easier.
10 common clauses.
ComplianceConcept
Regulatory compliance
An organization's fulfillment of all the legal, regulatory, contractual and voluntary obligations it has assumed.
ISO 37301 definition.
ObligationCore
Compliance obligation
A requirement the organization must meet, whether mandatory or voluntarily assumed; the basis of the ISO 37301 approach.
Legal or contractual origin.
FunctionRole
Compliance function
The person or unit responsible for overseeing the CMS, with adequate competence, authority and independence.
May be an OCC or a committee.
UNE 19601Criminal
Criminal compliance
Spanish standard for criminal compliance management systems, aligned with Art. 31 bis of the Criminal Code.
Complementary to ISO 37301.
ISO 37001Anti-bribery
Anti-bribery systems
International standard specific to the prevention, detection and handling of bribery.
Can be integrated with ISO 37301.
PDCACycle
Plan-Do-Check-Act
The continuous improvement cycle on which ISO management systems are built: plan, do, check and act.
Basis of clause 10.
AENORCertifier
Certification body
Accredited body (AENOR, Bureau Veritas, BSI, TÜV...) that audits the CMS and issues the ISO 37301 certificate.
Accredited by ENAC or equivalent.
Contact
Book a call
Tell us where your organization is starting from and we will explain how to reach ISO 37301 certification with a realistic plan and no cost overruns.
ISO 37301 certification: the standard, its scope and strategic benefits
ISO 37301 certification is the recognition, by an independent accredited certification body, that an organization has implemented a Compliance Management System in line with the requirements of the international standard UNE-ISO 37301:2021. Today it is the global benchmark in regulatory compliance management.
Origin of the standard
ISO 37301:2021 was published by the International Organization for Standardization in April 2021 and replaced ISO 19600:2014. The key difference is that ISO 19600 was only a non-certifiable guideline; ISO 37301 is a Type A standard, with auditable requirements and therefore certifiable by an independent third party.
Structure and content
The standard adopts the high-level structure (HLS) common to management system standards (ISO 9001, ISO 14001, ISO 27001, ISO 37001). It has 10 clauses, of which clauses 4 to 10 are auditable: context of the organization, leadership, planning, support, operation, performance evaluation and improvement.
Approach: obligations and risks
ISO 37301 focuses on two interrelated axes: identifying the obligations that affect the organization (legal, regulatory, contractual and voluntary) and assessing non-compliance risks, prioritizing controls proportionate to the risk. This approach makes it applicable to any organization, regardless of size, sector or legal form.
Integration with UNE 19601, ISO 37001 and UNE 19602
ISO 37301 is a cross-cutting framework that integrates with specific compliance solutions: UNE 19601 (criminal compliance, for a mitigating circumstance or exemption under Art. 31 bis of the Criminal Code), ISO 37001 (anti-bribery) and UNE 19602 (tax). An integrated system allows joint audits and reduces duplicated documentation.
Certification process
Certification is obtained through an external audit by an accredited body (AENOR, Bureau Veritas, BSI, TÜV or others). The audit takes place in two stages: stage 1 (documentation review and readiness) and stage 2 (on site, verification of implementation). If both are passed without major nonconformities, the body issues the certificate, typically valid for three years with annual surveillance audits.
Strategic value
For the governing body, ISO 37301 certification is the most reliable way to demonstrate its commitment to compliance to regulators, investors, clients and public tenders. It brings a preventive approach, better reputation, risk mitigation and operational efficiency, provided the system is designed to operate, not to decorate.