Quick Read
ISO 37301 makes compliance governance structural. The governing body and top management must ensure the compliance function has direct access to the governing body, independence, and appropriate authority and competence. They must be informed in a timely manner about compliance matters, reports from the compliance function must be protected from alteration, and management review must produce decisions. Many organisations meet the letter of these requirements on an organisation chart and fail them in practice: the head of compliance sits three layers below the board, reports through the general counsel or the chief financial officer, has never met the audit committee without management present, and sends reports that have been edited before they arrive. This paper sets out what the standard requires, the structural tests Speeki’s auditors apply, and what genuine compliance governance looks like.
Executive Summary
Every compliance management system eventually comes down to one question: when something important goes wrong, does the governing body find out, accurately and in time, from someone with the standing to make it listen? If the answer is no, every other element of the system is weakened.
ISO 37301 addresses this directly. Clause 5.1 requires the governing body and top management to demonstrate leadership and commitment to the compliance management system, and to develop and promote a compliance culture. Within it, Clause 5.1.3 obliges the governing body and top management to ensure three principles are implemented: the compliance function’s direct access to the governing body, its independence, and its appropriate authority and competence. Clause 5.3 assigns responsibilities to the governing body, top management, the compliance function, management and personnel. Clause 5.1.1 requires the governing body and top management to ensure they are informed in a timely manner about compliance matters, including non-compliance, and Clause 9.1.4 requires defined compliance reporting processes and protects the compliance function’s reports from alteration. Clause 9.3 requires management review that produces decisions.
Organisations certified to ISO 37001 will recognise these requirements in the anti-bribery compliance function. ISO 37301 widens them across every compliance domain in scope, which often exposes structures that worked for a narrow anti-bribery role but cannot carry the full compliance remit.
This paper examines each safeguard, tests common reporting structures against them, sets out what effective compliance reporting looks like, and explains what Speeki’s auditors look for when they assess whether governance is real or theatrical.
CORE ARGUMENT Independence is not a reporting line on an organisation chart. It is whether the compliance function can tell the governing body something top management would rather it did not hear — and keep its job, its budget and its access afterwards. |
1. What the Standard Requires
Clause | Requirement in substance | What it means in practice |
|---|---|---|
5.1 Leadership and commitment | The governing body and top management demonstrate leadership and commitment to the compliance management system | Evidence of direction, resourcing and oversight, not statements |
5.1.2 Compliance culture | Develop, maintain and promote a compliance culture at all levels | Culture is assessed and acted on, not assumed |
5.1.3 Compliance governance | The governing body and top management ensure direct access of the compliance function to the governing body, its independence, and its appropriate authority and competence | Three safeguards that can be tested |
5.2 Compliance policy | Among other things, the policy supports the governance principles in 5.1.3, refers to and describes the compliance function, encourages raising concerns and prohibits retaliation | Policy states the compliance function’s mandate and independence |
5.3 Roles, responsibilities and authorities | Assign and communicate responsibilities for the governing body, top management, compliance function, management and personnel | Each layer knows what it owns |
5.3.1 and 5.3.2 Oversight and access | The governing body ensures top management is measured against compliance objectives and oversees its operation of the system; the compliance function is given access to senior decision-makers early in decisions, to all levels, to all personnel and data, and to expert advice | Oversight and access that can be evidenced |
9.1.4 Compliance reporting | Define reporting criteria, timelines for regular reporting and an exception reporting system for ad hoc matters; ensure accuracy and completeness; protect the compliance function’s reports to the governing body and top management from alteration | Reporting is designed, not improvised |
9.3 Management review | The governing body and top management review the system at planned intervals, taking into account defined inputs including the independence of the compliance function, and record decisions | Minutes record decisions, actions and resources |
1.1 Governing body and top management are different
ISO 37301 distinguishes the governing body — typically the board or an equivalent — from top management, the executives who direct the organisation day to day. The distinction matters because the safeguards exist largely to protect the governing body’s ability to oversee top management. A compliance function that can only reach the chief executive cannot alert the board to a problem the chief executive is part of.
THE TEST CASE Ask how the compliance function would report a serious compliance concern involving the chief executive or the chief financial officer. If the only route runs through one of them, the direct access safeguard is not met. |
2. What Carries Over from ISO 37001
Organisations certified to ISO 37001 already operate much of the governance architecture ISO 37301 expects. The table shows what carries over and what must be widened.
ISO 37001 element | ISO 37301 counterpart | What changes |
|---|---|---|
Anti-bribery compliance function (5.3.2) with direct access to the governing body and independence | Compliance governance principles (5.1.3) and compliance function (5.3.2) | Same safeguards, but the function must now be competent and resourced across every obligation domain in scope, not only bribery. |
Governing body and top management leadership (5.1) | Leadership and commitment, including compliance culture (5.1) | The culture requirement applies to compliance generally; evidence must cover attitudes across domains. |
Review by the anti-bribery compliance function (9.4) | Compliance reporting (9.1.4) | Reporting must be designed: criteria, timing, ad hoc escalation and accuracy controls, across the full scope. |
Management review by top management and the governing body (9.3) | Management review (9.3) | Inputs widen to all obligation domains; decisions must address resourcing for the broader function. |
3. The Three Safeguards
3.1 Direct access
Direct access means the compliance function can raise matters with the governing body, or the relevant committee, without first obtaining permission or passing through management filters. It does not mean the head of compliance must report hierarchically to the board. It does mean there is a defined, used and protected channel. The note to Clause 5.1.3 gives examples of what direct access can include: a direct reporting line to the governing body, periodic reports to it, and participation in its meetings. Annex A.5.1.3 describes a common pattern — a direct report to the chief executive with a dotted line to the audit committee, the chair or the board — and stresses that the access should be planned and systematic.
A standing agenda item at the audit, risk or compliance committee, presented by the head of compliance personally.
Regular private sessions with the committee chair or committee without executive management present.
A documented right to escalate directly to the committee chair at any time.
Evidence that the channel has actually been used, not merely described.
3.2 Independence
Independence means the compliance function can form and express its view without undue influence from those whose conduct it oversees. The standard’s own note defines independence as the absence of undue interference or pressure with the operation of the compliance function, and Annex A.5.3.2 adds that the function should, as far as possible, not be personally involved in activities exposed to compliance risks, and should be free from conflicts of interest. Independence has structural and practical dimensions.
Dimension | Indicators of independence | Red flags |
|---|---|---|
Reporting line | Functional reporting to a board committee; administrative line that does not create conflict | Reporting to a revenue-generating executive or to the function whose obligations it monitors |
Appointment and removal | Committee approves appointment and removal of the head of compliance | Executive can remove the head of compliance without board involvement |
Remuneration | Not linked to commercial targets; reviewed by the committee | Bonus driven by business unit revenue or profit |
Budget | Committee reviews adequacy of compliance resources | Budget set and cut by the executive being monitored |
Dual roles | Compliance role separated from roles it oversees | Head of compliance also runs a business function, or approves the transactions they review |
Reports | Delivered unedited; Clause 9.1.4 requires the compliance function’s reports to the governing body and top management to be protected from alteration | Reports reviewed and amended by executives before reaching the board |
3.3 Authority and competence
Authority means the compliance function can obtain information, access people and records, escalate, and where appropriate stop or delay activity pending review. Competence means the people in the function have the knowledge and skills for the domains in scope. Breadth is the issue for ISO 37301: a function competent in anti-bribery may lack competence in sanctions, data protection or sector regulation. The competence requirements of Clause 7.2 apply to the compliance function as much as anyone. Clause 5.3.2 also requires the organisation to give the compliance function access to senior decision-makers and the opportunity to contribute early in decision-making, to all levels of the organisation, to all personnel, documented information and data, and to expert advice. Annex A.5.1.3 is blunt: the compliance function is not a junior position that can be overruled or have its reports altered.
COMMON FINDING The compliance policy grants the compliance function unrestricted access to records. In interview, the head of compliance explains that requests to the commercial division routinely take months and are sometimes refused. Authority on paper, not in practice. |
4. Testing Common Reporting Structures
There is no single correct structure. The test is whether the three safeguards are met in practice. The table below sets out how common structures typically perform and what compensating measures are needed.
Structure | Typical risks | Compensating measures required |
|---|---|---|
Head of compliance reports to the general counsel | Legal’s role is to defend the organisation; compliance’s is to surface problems. Reports may be shaped by privilege and litigation considerations | Direct functional line to a board committee; private sessions; committee approval of appointment and removal |
Reports to the chief financial officer | Compliance concerns about financial reporting, revenue recognition or fraud run through the executive accountable for them | As above, plus separate escalation route for finance-related concerns |
Reports to the chief executive | Visible seniority, but no protection where the concern involves the chief executive | Direct functional line to the committee; documented escalation right |
Reports to the chief risk officer | Can work well; risk of compliance being reduced to one line in enterprise risk | Distinct compliance reporting to the committee; adequate specialist competence |
Reports functionally to a board committee, administratively to an executive | Usually the strongest structure; administrative line can still constrain budget | Committee oversight of budget and resources |
Compliance embedded in business units | Proximity to the business; high risk of capture | Dotted line to central compliance with veto and escalation rights; central oversight of local reporting |
4.1 Proportionality
In smaller organisations the compliance function may be one person, a part-time role or combined with another function. ISO 37301 does not demand a large department. It demands that the safeguards exist in a form proportionate to the organisation. A sole compliance officer with a documented right of direct access to the board chair, who meets the board privately twice a year and whose role does not oversee their own work, can satisfy the standard. A department of fifty that reports through the business it monitors may not.
5. Compliance Reporting That Informs
Clause 5.1.1 requires the governing body and top management to ensure they are informed in a timely manner about compliance matters, including non-compliance. Clause 9.1.4 sets out how: defined reporting criteria, timelines for regular reporting, an exception reporting system for ad hoc matters, controls over the accuracy and completeness of information, and delivery of that information to the functions that need to act. It also requires reports from the compliance function to the governing body and top management to be protected from alteration. Timeliness and integrity are the operative ideas. A report that is long, late, sanitised or full of activity statistics does not inform.
5.1 Design the reporting, do not improvise it
Effective reporting starts with defined criteria: what must be reported, to whom, how often, and what triggers immediate escalation outside the normal cycle.
Element | What to define |
|---|---|
Audiences | Governing body or committee; top management; compliance function; obligation owners |
Cadence | Routine reporting cycle for each audience, aligned to committee calendars |
Content | Compliance performance against objectives; indicator trends; significant breaches and near misses; control failures; speak-up and investigation themes; regulatory developments; resource adequacy |
Escalation thresholds | Events requiring immediate reporting to the committee chair — e.g. regulator inquiry, potential criminal exposure, involvement of senior management, systemic control failure |
Independence | Who prepares the report, who may review it, and confirmation that it is delivered unedited |
Records | How reports and the governing body’s responses are retained |
5.2 From activity to performance
Activity reporting (does not inform) | Performance reporting (informs) |
|---|---|
97% of staff completed annual compliance training | Breaches in the domain fell from 14 to 6; four of the six occurred in a unit where role-specific training was not yet deployed |
12 policies reviewed this year | Three obligations changed materially; two related controls redesigned and tested effective; one remains partially effective |
48 hotline reports received | Reports from two countries are near zero despite high risk; culture survey shows low trust in the channel there |
Internal audit completed on schedule | Internal audit found the sanctions re-screening control ineffective; corrective action due next quarter, compliance function rates residual risk high |
THE “NOTED” PROBLEM If the minutes of the committee meeting record that the compliance report was “noted”, and nothing else, reporting has not done its job. Either the report gave the committee nothing to decide, or the committee did not decide. Both are findings waiting to happen. |
6. Management Review That Decides
Management review under Clause 9.3 is where governance becomes visible. The standard specifies inputs — including the status of previous actions, changes in issues and obligations, compliance performance, audit results, opportunities for improvement and the adequacy of resources; notably, it also requires the review to take into account the independence of the compliance function — and requires outputs that include decisions on continual improvement opportunities and any need for changes to the system. Annex A.9.3 recommends that a copy of the documented results be provided to the governing body.
Speeki’s experience across anti-bribery and compliance management systems is that management review is the most consistently underperformed requirement. Reviews become presentations. The compliance function presents; executives ask a few questions; the meeting moves on. ISO 37001 management review has been addressed in depth in an earlier Speeki whitepaper, and the same principles apply to ISO 37301.
Inputs are circulated in advance, not presented for the first time in the room.
Each input is accompanied by a proposed decision or a question requiring one.
Minutes record decisions, owners and dates, not discussion.
Resource requests are decided, not deferred.
The next review opens with the status of the last review’s decisions.
7. Implementation Roadmap
Horizon | Actions |
|---|---|
First 30 days | Map the current reporting line, appointment, removal, remuneration and budget arrangements for the head of compliance against the three safeguards; identify dual roles; document the gaps. |
60 days | Agree with the governing body (or its committee) a charter or terms of reference confirming direct access, private sessions and authority to obtain information; define compliance reporting criteria and an ad hoc escalation route. |
90 days | Run the first designed compliance report, including exceptions and unresolved issues; hold the first private session; record decisions at management review. |
12 months | Assess competence of the compliance function across every domain in scope; resolve conflicts arising from dual roles; review whether the safeguards have actually been used. |
8. Common Failures
Failure | Why it matters | What genuine governance does instead |
|---|---|---|
Direct access exists on paper but has never been used | An unused route provides no evidence that it would work under pressure. | Builds routine use: standing agenda items and private sessions, minuted. |
Executive pre-approves board compliance reports | The governing body receives a curated view; the safeguard is defeated. | Allows the compliance function to report unedited, with management comments shown separately. |
Head of compliance’s bonus tied to commercial results | Creates a personal incentive not to escalate. | Links remuneration to the effectiveness of the CMS, reviewed by the committee. |
Compliance function competent in one domain only | Obligations outside that domain receive no effective oversight. | Maps competence to every domain in scope and fills gaps through hiring, training or access to experts. |
Board minutes record noting, not deciding | There is no evidence the governing body exercised oversight. | Records questions asked, decisions taken and actions assigned. |
9. What Speeki’s Auditors Look For
9.1 Documents
Compliance policy and compliance function charter: mandate, authority, independence and access rights.
Committee terms of reference: oversight of compliance, appointment and removal of the head of compliance, private sessions.
Committee minutes and management review records for the period: what was reported, what was decided.
Compliance reports as delivered, and any drafts showing management amendment.
9.2 Interviews
Speeki interviews the head of compliance, members of top management and, wherever possible, the chair of the relevant board committee. The same questions asked at each level reveal whether governance is shared or imagined.
“When did the compliance function last raise something with the committee that management did not want raised?”
“What did the committee decide at its last review of compliance?”
“Who sets the compliance budget, and when was a request last refused?”
“If the concern involved the chief executive, what would happen?”
“What does the committee know about compliance performance that it did not know a year ago?”
Finding pattern | Typical grading |
|---|---|
No mechanism for direct access to the governing body | Major nonconformity |
Head of compliance has conflicting operational responsibilities in the domains overseen | Major or minor depending on effect |
Reports to the governing body edited by management without disclosure | Major or minor depending on effect |
Management review produces no recorded decisions | Minor nonconformity |
Compliance function lacks competence for one or more in-scope domains | Minor nonconformity |
Grading is illustrative and depends on the evidence and its effect on the system.
Conclusion
ISO 37301 does not let compliance governance rest on good intentions. It requires the compliance function to have direct access to the governing body, independence and authority; it requires reporting that genuinely informs; and it requires management review that decides. Each of these can be tested, and Speeki tests them.
The organisations that pass this part of an audit easily are not those with the most elaborate charters. They are those where the board can describe what it learned from compliance this year, the head of compliance can describe a time they told the board something uncomfortable, and the minutes show what was done about it.
About Speeki
Speeki is an accredited certification body operating across more than 100 countries, providing ISO management system certification, ESG and sustainability assurance, and executive education. Speeki provides no consulting of any kind. Our independence is structural, not a promise.
Speeki delivers its audits through AI working alongside a body of experts. Nicole, Speeki’s AI team member, works with our auditors to test full populations of evidence rather than samples, so that certification reflects how a management system actually performs, not how it looks on the day of the audit.
To learn more, see ISO 37301 certification with Speeki.
Related Reading
Beyond the Compliance Presentation: ISO 37001 Clause 9.3 Management Review
Beyond the Policy: Building a Genuine Culture of Anti-Bribery Compliance
Paper 6 — Documented Isn’t Operating: Controls and Indicators (Clauses 8.2, 9.1.3)
This whitepaper provides general information on ISO 37301:2021 and does not reproduce the text of the standard. Organisations should refer to the published standard for its exact requirements.