Quick Read
ISO 37301 is less prescriptive about controls than ISO 37001. It does not list the controls an organisation must have; it requires the organisation to design, implement and maintain controls that manage its compliance obligations and the risks of breaching them, and to maintain, periodically review and test them to ensure their continuing effectiveness. That freedom is also a burden: the organisation must show why each control exists and prove that it works. Clause 9.1 then requires indicators that measure compliance performance. Most organisations measure activity — training completion, policies reviewed, reports received — rather than whether controls operate and obligations are met. This paper explains how to design controls that generate their own evidence and indicators that tell the board something true.
Executive Summary
Auditors do not certify controls because they exist. They certify them because there is evidence they work. That distinction catches more organisations at ISO 37301 certification than any other.
Clause 8.1 requires the organisation to plan, implement and control the processes needed to meet its compliance obligations, including outsourced processes. Clause 8.2 requires it to establish and maintain controls to manage its obligations and associated compliance risks, and to maintain, periodically review and test those controls to ensure their continuing effectiveness. Clause 9.1 requires monitoring, measurement, analysis and evaluation of the system, drawing on multiple sources of feedback, using appropriate indicators, and supported by records.
For organisations certified to ISO 37001, the discipline is familiar but the content is not. ISO 37001 prescribes many anti-bribery controls — due diligence, financial and non-financial controls, gifts and hospitality, contractual commitments. ISO 37301 prescribes none of them for other domains. The organisation must derive controls from its own risk assessment, which makes the link between risk and control the central thing an auditor will test.
This paper sets out how to design controls that can be tested, how to test them, how to build a control register that holds the system together, how to select indicators that measure performance rather than activity, and what Speeki’s auditors look for.
CORE ARGUMENT A control that does not generate evidence of its own operation is a control you will have to defend from memory. Design controls so that operating them produces the proof, and measure the system by whether controls work and obligations are met — not by how much compliance activity took place. |
1. What the Standard Requires
Clause | Requirement in substance |
|---|---|
8.1 Operational planning and control | Plan, implement and control the processes needed to meet compliance obligations and implement the actions from planning; establish criteria for those processes; control planned changes; ensure outsourced processes are controlled and monitored |
8.2 Controls and procedures | Implement controls to manage compliance obligations and associated compliance risks; maintain, periodically review and test them to ensure their continuing effectiveness |
9.1.1 General monitoring | Determine what is monitored and measured, the methods, when, and when results are analysed and evaluated |
9.1.2 Sources of feedback | Seek and receive feedback on compliance performance from a range of sources; analyse it to identify root causes of non-compliance and reflect it in the periodic risk assessment |
9.1.3 Indicators | Develop, implement and maintain appropriate indicators to evaluate achievement of objectives and compliance performance |
9.1.5 Record-keeping | Keep accurate, up-to-date records of compliance activities to support monitoring, review and demonstration of conformity |
Read together, these clauses describe a loop. Controls are designed against risks. Controls produce records. Records feed indicators. Indicators feed compliance reporting and management review. Evaluation of controls feeds back into control design and the risk assessment.
2. What Carries Over from ISO 37001
ISO 37001 users will recognise most of the control disciplines in this paper. The difference is breadth: ISO 37001 names bribery-specific controls, whereas ISO 37301 requires the organisation to design controls for whatever obligations are in scope.
ISO 37001 element | ISO 37301 counterpart | What changes |
|---|---|---|
Financial and non-financial controls (8.3, 8.4) | Establishing controls and procedures (8.2) | No prescribed control list; every control must trace to an obligation and a compliance risk. |
Due diligence (8.2) and controls over business associates (8.5) | Controls over outsourced and third-party processes (8.1, 8.2) | Extends beyond bribery to any obligation that third parties can cause the organisation to breach. |
Monitoring, measurement, analysis and evaluation (9.1) | Monitoring, sources of feedback, indicators and record-keeping (9.1.1–9.1.5) | Indicators must be developed deliberately and draw on multiple feedback sources. |
ABMS dashboard practice | Compliance indicators reported under 9.1.4 | The same dashboard architecture works; it simply carries more obligation domains. |
3. Designing Controls That Can Be Tested
3.1 Every control needs a reason
Under ISO 37301, every control should trace to at least one risk in the compliance risk assessment, and through it to at least one obligation in the register. A control with no mapped risk is either addressing an unrecognised risk — in which case the risk assessment is incomplete — or is a legacy of a previous regime and should be reconsidered.
3.2 The attributes of a well-designed control
Attribute | Question it answers | Weak example | Strong example |
|---|---|---|---|
Objective | What failure does it prevent or detect? | “Ensure sanctions compliance” | “Prevent onboarding of any counterparty matching a designated-person list” |
Owner | Who performs it? | “Procurement” | “Supplier onboarding analyst” |
Trigger and frequency | When does it operate? | “Regularly” | “Before every new supplier is activated; full base re-screened monthly” |
Method | How is it performed? | “Check lists” | “Automated screening in the onboarding workflow; matches above threshold routed to compliance” |
Evidence | What record proves it ran? | None defined | “Screening log entry per supplier with timestamp, result and reviewer decision” |
Exception handling | What happens when it fails or flags? | Undefined | “Activation blocked until compliance clears; overrides require compliance approval and are logged” |
3.3 A balanced control set
A control set that relies only on preventive controls is brittle; one that relies only on detective controls lets breaches happen before anyone notices. ISO 37001 users will recognise the taxonomy Speeki applies.
Type | Purpose | Compliance examples |
|---|---|---|
Preventive | Stop the breach occurring | System blocks; approvals; segregation of duties; mandatory fields; pre-launch regulatory sign-off; contractual clauses |
Detective | Identify breaches or failures quickly | Exception reports; reconciliations; data analytics; monitoring reviews; speak-up channel; second-line testing |
Corrective | Contain harm and prevent recurrence | Investigation process; remediation; regulator notification protocol; disciplinary framework; root-cause analysis |
Automation changes the economics. An automated preventive control that blocks a prohibited action and logs every attempt is more reliable and far easier to evidence than a manual review performed by a busy manager. Where controls remain manual, design them so that performing the control creates the record.
3.4 Outsourced and third-party processes
Clause 8.1 requires outsourced processes to be controlled and monitored. If a payroll provider files regulatory returns, a logistics provider performs export screening or a cloud provider holds regulated data, the obligation remains the organisation’s. The control set must include how the organisation satisfies itself that the third party performs: contractual requirements, assurance reports, audit rights, performance data and escalation. Annex A.8.1 describes a well-designed outsourcing process as including initial and ongoing due diligence, appropriate controls, ongoing monitoring, review of contractual agreements and service-level agreements, and the option of using third parties that are themselves certified to ISO 37301. The note to Clause 8.1 is a reminder that outsourcing does not relieve the organisation of its legal responsibilities or compliance obligations.
4. Testing Controls
Clause 8.2 requires controls to be maintained, periodically reviewed and tested to ensure their continuing effectiveness. The note to the clause describes testing as a designed exercise to see whether a control does what was intended, cannot be bypassed, and is actually effective in reducing the likelihood or impact of the risk. Speeki structures that exercise around three questions, in order.
Question | Test approach | Typical evidence |
|---|---|---|
Is it designed adequately? | Walk-through against the risk; challenge whether the control would actually prevent or detect the scenario | Design assessment; process map; gap notes |
Is it implemented as designed? | Observe or re-perform the control once | Walk-through record; system configuration |
Has it operated effectively over the period? | Test the population or a statistically meaningful sample across the period | Test results, exceptions, conclusions |
4.1 Who tests
Control owners self-assess; the compliance function tests independently of the owners; internal audit provides periodic independent assurance under Clause 9.2. The three are complementary. Self-assessment alone is not testing, and internal audit cannot test every control every year. A risk-based testing plan assigns frequency and depth by net risk.
Net risk of scenario | Testing by compliance function | Internal audit coverage |
|---|---|---|
Extreme / High | Quarterly, full population where data permits | Annually |
Medium | Semi-annually or annually | Within audit cycle |
Low | Annually or on trigger | Rotational |
4.2 Full-population testing
Where controls operate in systems and generate electronic records, testing the full population is now practical. Every onboarding record, every screening decision, every regulatory filing date can be checked. Full-population testing removes sampling risk and surfaces patterns — repeat overrides, clustering of exceptions in one location — that samples miss. It is how Speeki increasingly tests controls at certification, and organisations that test this way internally arrive at audit with fewer surprises.
COMMON FINDING The control register rates the export screening control “effective”. The rating is based on the control owner’s self-assessment. No independent test has been performed in the period, and the screening log shows 31 manual overrides with no recorded approval. The control is not effective, and the risk assessment’s net score is wrong. |
5. The Control Register
The control register is the spine of an ISO 37301 system. It connects the obligations register and the risk assessment to evidence and indicators. Minimum fields:
Field | Content |
|---|---|
Control ID and name | Unique reference; short descriptive name |
Linked obligations and risks | Obligation IDs (Clause 4.5) and risk scenario IDs (Clause 4.6) |
Objective | The failure it prevents, detects or corrects |
Type | Preventive / detective / corrective; manual / automated; key / secondary |
Owner | Role performing the control |
Frequency and trigger | When it operates |
Evidence | Record generated and where it is held |
Test plan | Frequency, method and tester |
Latest test result | Date, result, exceptions and effectiveness rating |
Linked indicator(s) | Indicators that measure the control (Clause 9.1.3) |
Open actions | Corrective actions from testing (Clause 10.2) |
6. Indicators That Measure Performance
6.1 Three kinds of indicator
Clause 9.1.3 requires indicators that help evaluate the achievement of compliance objectives and compliance performance. Annex A.9.1.3 offers its own classification — general indicators, reactive indicators such as non-compliances by type, area and frequency and the time taken to correct them, and predictive indicators such as non-compliance trends — and its training example speaks of employees trained effectively, not merely trained. The three-way split below is a practical complement to that guidance.
Kind | Measures | Examples | Value |
|---|---|---|---|
Activity | What the compliance function did | Training completion; policies reviewed; audits performed | Low on its own |
Control effectiveness | Whether controls operate | Exception rate in screening; override rate; on-time filing rate; test pass rate | High |
Compliance outcome | Whether obligations are met | Confirmed breaches; regulator findings; repeat issues; time to remediate | High, but lagging |
Activity indicators have a place: they show whether the system is resourced and running. But a dashboard dominated by them tells the board how busy the compliance function is, not whether the organisation is compliant.
6.2 Leading and lagging
Outcome indicators lag: by the time breaches are counted, harm has occurred. Leading indicators signal rising risk before a breach: growing exception backlogs, rising override rates, falling speak-up volumes in high-risk units, delays in closing corrective actions, overdue obligation reviews. A good indicator set balances both.
6.3 Properties of a good indicator
Linked — tied to an objective, an obligation or a control.
Defined — a precise formula, data source and owner, so that the number means the same thing every period.
Thresholded — a target and a tolerance, so that the reader knows whether the number is good or bad.
Actionable — someone knows what to do when it moves.
Reliable — the underlying data is controlled; an indicator built on unreliable data is worse than none.
Domain | Activity indicator (insufficient alone) | Effectiveness or outcome indicator |
|---|---|---|
Sanctions | Number of staff trained | Percentage of counterparties screened before activation; unapproved overrides; time to clear matches |
Data protection | Privacy notices updated | Access requests answered within deadline; reportable incidents; repeat incident causes |
Regulatory reporting | Returns calendar maintained | Returns filed on time and without resubmission |
Competition | Trade association attendance logged | Meetings with pre-cleared agendas and compliance attendance; issues escalated |
Safety compliance monitoring | Monitoring audits completed | Findings closed within required timeframe; repeat findings; overdue escalations |
6.4 Multiple sources of feedback
Clause 9.1.2 requires processes for seeking and receiving feedback on compliance performance from a range of sources, and requires that information to be analysed to identify root causes of non-compliance and reflected in the periodic compliance risk assessment. Indicators built only from compliance-function data miss much of the picture. Effective systems draw on employees and managers, the speak-up channel, investigations, customers and complaints, suppliers and business partners, regulators, internal audit, control testing and external audit. Divergence between sources is itself informative: a unit reporting no issues while its customers complain is a unit to look at.
7. Implementation Roadmap
Phase | Activities | Output |
|---|---|---|
1. Inventory | Collect every existing control across functions; record owner, frequency, evidence produced. | Raw control inventory |
2. Trace | Link each control to the obligations and risk scenarios it addresses; identify orphan controls and uncontrolled risks. | Traced control register |
3. Rationalise | Remove or redesign orphan controls; design controls for gaps; rebalance preventive, detective and corrective. | Approved control set |
4. Test | Agree a risk-based test plan; test design, implementation and operation; use full populations where data allows. | Test results and ratings |
5. Measure | Define indicators for control effectiveness and compliance outcomes, with thresholds and owners. | Indicator set |
6. Report and improve | Report results through compliance reporting; feed failures into nonconformity management. | Closed loop |
8. Common Failures
Failure | Why it matters | What a sound system does instead |
|---|---|---|
Policies counted as controls | A policy states an expectation; it does not prevent or detect a breach. | Distinguishes policy from the operational controls that implement it. |
Testing by the control owner only | Self-assessment confirms what the owner believes. | Combines owner attestation with independent testing by the compliance function or internal audit. |
Sampling where full data is available | A well-prepared sample hides exceptions that a full population reveals. | Tests full populations wherever control evidence is electronic. |
Indicators without thresholds | Nobody knows when a number means action is required. | Sets tolerance thresholds and escalation rules for every indicator. |
Training completion as the headline indicator | Measures attendance, not behaviour or control performance. | Leads with control effectiveness, breach trends and remediation timeliness. |
9. What Speeki’s Auditors Look For
Traceability. Every key control maps to a risk and an obligation; every high risk has at least one tested control.
Design quality. Controls have defined objectives, owners, triggers, methods, evidence and exception handling.
Operating evidence. Records show controls operated throughout the period, not just recently.
Independent testing. Effectiveness ratings rest on testing by someone other than the control owner.
Outsourced processes. The organisation can show how it monitors third parties that perform compliance-relevant processes.
Indicator quality. Indicators measure effectiveness and outcomes, have definitions and thresholds, and draw on multiple sources.
Use. Indicator results visibly drive compliance reporting, management review decisions and corrective action.
Speeki tests controls directly. Where evidence is electronic, Nicole, Speeki’s AI team member, works with the audit team to analyse full populations of control records, so that conclusions about whether a control operated rest on every instance rather than a handful.
AUDITOR PERSPECTIVE When Speeki’s auditors open the compliance dashboard, the first question is: which of these numbers would change if a key control stopped working tomorrow? If the answer is none of them, the indicators are measuring the wrong things. |
Conclusion
ISO 37301 gives organisations the freedom to design their own controls. With that freedom comes the obligation to explain every control and prove that it works. The organisations that meet this well design controls that generate their own evidence, test them independently and in proportion to risk, and keep a control register that ties the whole system together.
They also measure what matters. A small set of well-defined indicators showing whether controls operate and obligations are met is worth more than a dashboard full of completion rates. When the indicators move, someone acts. That is what a management system is for.
About Speeki
Speeki is an accredited certification body operating across more than 100 countries, providing ISO management system certification, ESG and sustainability assurance, and executive education. Speeki provides no consulting of any kind. Our independence is structural, not a promise.
Speeki delivers its audits through AI working alongside a body of experts. Nicole, Speeki’s AI team member, works with our auditors to test full populations of evidence rather than samples, so that certification reflects how a management system actually performs, not how it looks on the day of the audit.
To learn more, see ISO 37301 certification with Speeki.
Related Reading
This whitepaper provides general information on ISO 37301:2021 and does not reproduce the text of the standard. Organisations should refer to the published standard for its exact requirements.