Quick Read
In most organisations, compliance is run by the compliance department. It writes the policies, owns the risks, approves the transactions, delivers the training, investigates the concerns and reports to the board. Management receives compliance. ISO 37301 and ISO 37001 describe a different model: the governing body and top management lead, line management owns compliance in its own area, and the compliance function designs, supports, monitors and challenges. Moving from the first model to the second is the real transformation from programme to management system — and it is harder than it looks, because compliance teams often experience it as giving up control. This paper explains what Clause 5.1 asks of leaders, why compliance must learn to lead from behind, the mental work required on both sides, how to educate management, how management should take the reins, how the two should work together, and how to run the transition as a planned change.
Executive Summary
Speeki’s earlier whitepaper, A Compliance Programme Is Not a Compliance Management System, set out the structural differences between a collection of compliance activities and a system that ISO 37301 can certify. This paper addresses the human transformation underneath that structural one. The most important difference between a programme and a system is not the documentation. It is who owns compliance.
In a compliance-led programme, the compliance department is the engine. It decides, does and reports. Managers are recipients: they attend the training, follow the procedures, ask for approvals and wait to be told. The model is understandable — compliance teams were often built because management was not doing the job — but it has a ceiling. A compliance department cannot be present in every decision, cannot change a culture it does not lead, and cannot carry accountability that belongs to the business.
ISO 37301 places leadership firmly with the governing body and top management in Clause 5.1, and responsibility for compliance within each area of the business with management in Clause 5.3.3. The compliance function is responsible for the operation of the management system, but the standard is explicit that its duties do not relieve anyone else of their responsibilities. ISO 37001 takes the same approach for anti-bribery.
Getting there requires compliance to move from leading from the front to leading from behind: from doing compliance to building the system through which management does it. Compliance professionals often resist this, sometimes without realising it, because it feels like a loss of control, status or safety. It is not. It is a move from a role that cannot scale to one that can. This paper sets out how to make that move — for the compliance team, for management, and for the relationship between them.
CORE ARGUMENT A compliance department that runs compliance has built a programme. A compliance function that gets management to run compliance has built a management system. Leading from behind is not a retreat from responsibility; it is the only way compliance can achieve what it was created to achieve. |
1. Who Owns Compliance in a Management System
ISO 37301 allocates roles explicitly. Read together, Clauses 5.1 and 5.3 describe an organisation in which compliance is led from the top, owned in the line and supported by a specialist function.
Role | What ISO 37301 assigns to it, in substance |
|---|---|
Governing body | Demonstrates leadership and commitment; establishes and upholds the organisation’s values; ensures top management is measured against the achievement of compliance objectives; exercises oversight over top management regarding the operation of the system (5.1.1, 5.3.1). |
Top management | Demonstrates leadership and commitment; ensures the system is integrated into business processes and resourced; encourages behaviour that supports compliance and does not tolerate behaviour that compromises it; aligns targets with compliance obligations; establishes accountability mechanisms; integrates compliance performance into performance appraisals (5.1.1, 5.1.2, 5.3.1). |
Management | Is responsible for compliance within its area: ensures personnel comply, identifies and communicates compliance risks, integrates compliance obligations into business practices, supports training, encourages people to raise concerns and precludes retaliation, takes part in resolving incidents and ensures corrective action is implemented (5.3.3). |
Personnel | Adhere to compliance obligations, policies and procedures; report concerns; take part in training (5.3.4). |
Compliance function | Is responsible for the operation of the system: facilitating the identification of obligations, documenting the risk assessment, monitoring performance, establishing reporting and the system for raising concerns; exercises oversight that responsibilities are allocated and obligations integrated; provides advice (5.3.2). |
The note to Clause 5.3.2 is the sentence on which this paper turns: the specific duties of the compliance function do not relieve other personnel of their responsibilities for compliance. Annex A.5.3.3 makes the same point about management, observing that the responsibilities of top management should not be seen as absolving other levels of management of theirs, and that managers’ compliance responsibilities should be set out in their job descriptions.
The introduction to ISO 37301 frames the aim: while maintaining its independence, compliance management is preferably integrated with the organisation’s other management processes and operational requirements. Integration is impossible if compliance remains a separate activity performed by a separate department.
1.1 The same model in ISO 37001
ISO 37001:2025 follows the same architecture for anti-bribery, and in places is more explicit. Clause 5.1.1 sets out the governing body’s role, Clause 5.1.2 top management’s — including supporting other relevant roles to demonstrate leadership in preventing and detecting bribery in their areas — and Clause 5.1.3 requires an anti-bribery culture worded almost identically to ISO 37301’s compliance culture clause. Clause 5.3.1 states that managers at every level are responsible for requiring that the anti-bribery management system is applied and complied with in their department or function, and the note to Clause 5.3.3 confirms that delegating decisions does not relieve top management or the governing body of their duties. The structure is the same: an anti-bribery function responsible for overseeing the design and implementation of the management system, and responsibility for anti-bribery controls embedded in the roles that perform the relevant activities. Organisations certified to both standards should apply one ownership model across the two systems, not two.
THE TEST Ask a business unit head who owns the compliance obligations in their area. In a programme, the answer is “compliance”. In a management system, the answer is “I do — compliance helps me”. |
2. What Clause 5.1 Actually Asks of Leaders
Clause 5.1 is often read as a requirement for a statement of commitment from the chief executive. It asks for much more. Clause 5.1.1 lists the ways in which the governing body and top management must demonstrate leadership and commitment, and a second list of things they must do.
Clause 5.1 expectation, in substance | What it looks like in practice |
|---|---|
Ensure the compliance policy and objectives are established and compatible with strategy | Leaders debate and approve compliance objectives alongside commercial ones, rather than receiving them for noting |
Ensure the system is integrated into business processes | Compliance steps sit inside sales, procurement, hiring and finance processes owned by the business |
Ensure resources are available | Leaders fund first-line controls in their own budgets, not only the compliance department’s |
Communicate the importance of effective compliance | Leaders talk about compliance in their own words, in their own forums, without being scripted by compliance |
Direct and support people to contribute to effectiveness | Managers know what is expected of them and are given time and tools to do it |
Support other relevant roles to demonstrate leadership in their areas | Senior leaders hold their own managers accountable for compliance in their areas |
Ensure they are informed in a timely way about compliance matters, including noncompliance, and ensure appropriate action | Leaders ask for bad news, act on it and are seen to act |
Ensure noncompliance and noncompliant behaviour are dealt with appropriately | Consequences apply regardless of seniority or commercial performance |
Ensure compliance responsibilities are included in job descriptions as appropriate | Managers’ job descriptions state their compliance responsibilities |
Appoint a compliance function and ensure a system for raising concerns | Leaders protect the compliance function’s access and independence, and the speak-up channel |
Clause 5.1.2 adds that the governing body, top management and management must show an active, visible, consistent and sustained commitment to a common standard of behaviour. Notice that management — not only top management — is named. Annex A.5.1.2 lists factors that support a compliance culture, including management visibly implementing and abiding by the values, consistent treatment of noncompliance regardless of position, leading by example, and performance appraisal that takes account of compliance behaviour. It also describes evidence of culture, including corrective actions being owned and actioned at the appropriate levels of the organisation.
Annex A.5.3.1 says top management should be knowledgeable about the content and operation of the system, and suggests it review compliance performance at planned intervals — for example quarterly or monthly — against key indicators. None of this can be delegated to a compliance department.
THE UNCOMFORTABLE IMPLICATION Most of what Clause 5.1 requires cannot be done by the compliance function, however capable. If the compliance team is doing it on management’s behalf, the requirement is not being met — it is being simulated. |
3. Why Compliance-Led Programmes Stall
Compliance-led programmes deliver real value in their early years. They build the policies, the hotline, the training and the due diligence process from nothing. Then they hit a ceiling. The symptoms are consistent.
Symptom | What is happening underneath |
|---|---|
Compliance is a bottleneck | Every approval, question and decision routes to a small team; the business experiences compliance as delay |
Managers outsource judgement | “Compliance approved it” replaces “I decided it was right”; managers stop thinking about compliance risk themselves |
The board hears only from compliance | Business leaders never report on compliance in their own areas; the board cannot test whether management owns it |
Culture surveys do not move | Employees perceive compliance as the compliance department’s concern, not their manager’s |
Key-person dependency | The system works because of the head of compliance; it would weaken quickly if they left |
Compliance cannot challenge what it decided | When compliance performs operational decisions, it loses the distance needed to monitor and challenge them |
Audit evidence of leadership is thin | Auditors find compliance documents, but little evidence of management doing anything |
The last two symptoms deserve emphasis. Annex A.5.3.2 explains independence as the compliance function being, as far as possible, not personally involved in activities exposed to compliance risks. A compliance team that approves the transactions, negotiates the exceptions and owns the outcomes is not in a position to oversee them objectively. Moving operational ownership to management strengthens the compliance function’s independence rather than reducing its role.
4. From Leading From the Front to Leading From Behind
The idea of leading from behind is old. Nelson Mandela, in his autobiography Long Walk to Freedom (1994), described the leader as a shepherd who stays behind the flock, letting the most nimble go ahead while directing the whole from behind. Linda Hill of Harvard Business School developed the idea in modern management writing — in a 2010 Harvard Business Review piece, “Leading from Behind”, and in Collective Genius (2014), written with Greg Brandeau, Emily Truelove and Kent Lineback — describing leaders who create the conditions in which others step forward, rather than leading every charge themselves.
For a compliance function, leading from behind means that management is visibly out in front — owning risks, making decisions, talking about integrity, dealing with misconduct — while compliance designs the system, equips managers, watches the results and intervenes when things go wrong. Compliance is no less influential. Its influence is exercised through others.
Leading from the front (programme) | Leading from behind (management system) |
|---|---|
Compliance owns the risks | Management owns the risks; compliance facilitates and challenges the assessment |
Compliance approves transactions | Management approves within designed controls; compliance sets the rules, monitors exceptions and handles the genuinely difficult cases |
Compliance delivers the message | Leaders deliver the message; compliance equips them |
Compliance produces the evidence | Management produces evidence of its controls operating; compliance tests it |
Compliance reports to the board | Management reports on compliance in its areas; compliance reports independently on the system and can say where management’s account is incomplete |
Compliance is measured by activity | Compliance is measured by how well management is running compliance |
Compliance is indispensable to every decision | Compliance is indispensable to the design, integrity and oversight of the system |
4.1 Leading from behind is not abdication
Leading from behind does not mean stepping back and hoping. The compliance function retains everything that gives it power in a management system: direct access to the governing body and independence under Clause 5.1.3, the authority to obtain information under Clause 5.3.2, oversight of how responsibilities are allocated and obligations integrated, monitoring and measurement of compliance performance, and its own reporting line. The three lines model published by the Institute of Internal Auditors in 2020 captures the same division: management holds first-line responsibility for managing risk, while second-line roles provide complementary expertise, support, monitoring and challenge.
WHAT DOES NOT CHANGE Compliance still sets the standard, still monitors, still challenges, still reports independently and still escalates. What changes is that it stops doing management’s job for it. |
5. The Mental Work for the Compliance Team
The structural changes in this transition are straightforward to describe. The hardest part is internal. Compliance professionals have often built their careers, credibility and sense of purpose on being the people who make compliance happen. Asking them to step behind management can feel like asking them to become less important.
5.1 Why it feels like loss
William Bridges, in Managing Transitions (1991), observed that every transition begins with an ending — something people must let go of — and that resistance to change is usually resistance to loss. It is worth naming honestly what a compliance team may feel it is losing:
Control: the certainty that things are done properly because compliance did them.
Visibility: being the face of compliance to the board and the business.
Indispensability: being the person everyone has to ask.
Safety: the belief that if compliance does it, compliance cannot be blamed for management’s failures.
Identity: a professional self-image built around expertise in doing, not enabling.
These feelings are rational, and dismissing them slows the transition. The answer is to examine each one and show what replaces it.
5.2 Hidden competing commitments
Robert Kegan and Lisa Laskow Lahey, in Immunity to Change (2009), describe how people can be genuinely committed to a change while holding a hidden competing commitment that keeps them from making it. A compliance team may sincerely want management to own compliance while being equally committed — without saying so — to never being seen to have let something go wrong. That second commitment produces behaviour that undermines the first: re-checking everything managers do, taking back tasks that were handed over, intervening before managers have a chance to decide.
A practical exercise, adapted from Kegan and Lahey’s approach, is for the compliance team to write down the goal (management owns compliance), the things they are doing or not doing that work against it, the worries those behaviours protect against, and the assumptions underneath — for example, “if a manager makes a compliance mistake, it will be seen as my failure”. Assumptions written down can be tested; assumptions left unspoken quietly run the team.
5.3 An adaptive challenge, not a technical one
Ronald Heifetz, in Leadership Without Easy Answers (1994) and later work with Marty Linsky and Alexander Grashow, distinguishes technical problems, which can be solved with existing expertise, from adaptive challenges, which require people to change their values, habits and ways of working. Rewriting a procedure to give managers ownership is technical. Getting compliance professionals to let managers own it, and managers to accept it, is adaptive. Treating it as a purely technical project — a new RACI chart, a revised policy — is the most common reason the transition fails.
5.4 What compliance gives up, and what it gains
The concern | The reality |
|---|---|
“We are giving up control.” | Compliance gives up control of individual decisions and gains control of the system that governs all decisions — a far larger lever. |
“Management will get it wrong.” | Some managers will, especially early. A management system is designed to detect that through monitoring, testing, speak-up and nonconformity management. A compliance department doing everything also gets things wrong; it simply has fewer people looking. |
“We will be blamed for their failures.” | Under ISO 37301, accountability for compliance in an area sits with management. Compliance is accountable for the design, monitoring and oversight of the system, and for escalating what it finds. Clear allocation protects compliance better than ambiguity does. |
“We will lose visibility with the board.” | Compliance keeps its direct access and independent reporting under Clause 5.1.3. Its reports become more valuable, because they assess management’s performance rather than describing compliance’s own activity. |
“We will become irrelevant.” | The skills required become more senior: system design, risk judgement, coaching leaders, data analysis, challenge. These are harder to replace than processing approvals. |
“It will be slower to do it through management.” | Initially, yes. Over time, a system run by hundreds of managers moves faster and reaches further than one run by a small team. |
A REFRAME The question for a compliance professional is not “how much compliance work do I do?” but “how much compliance happens because of what I built?”. Leading from behind is how the answer to the second question grows. |
6. Educating Management on Clause 5.1
Managers cannot take on responsibilities they do not understand. Most have never read ISO 37301 or ISO 37001 and have no reason to. Education must translate the standard into specific, observable expectations for each level of management, and be delivered in a way that treats leaders as owners, not as trainees.
6.1 Principles
Start at the top. The governing body and top management must understand and accept their role first. Expectations cascaded to middle managers by a compliance department, without visible ownership from the top, will be treated as compliance’s project.
Translate requirements into behaviours. “Demonstrate leadership and commitment” means nothing to a sales director. “Open each quarterly business review with your compliance risks and what you are doing about them” does.
Explain why, not only what. Managers respond to the risk to their business, their people and themselves, and to the protection a well-run system gives them.
Make it role-specific. A plant manager, a country head and a procurement director own different obligations and risks.
Make it measurable. Every expectation should have evidence that shows whether it is being met.
6.2 A leadership expectations framework
A practical tool is a short, written set of compliance leadership expectations for each level, approved by top management and, for its own role, by the governing body. It becomes the basis for job descriptions, objectives, appraisals and audit.
Level | Example expectations | Evidence |
|---|---|---|
Governing body | Approves the compliance policy and objectives; holds a private session with the head of compliance at least annually; challenges management on compliance performance; ensures top management’s objectives include compliance | Minutes recording questions and decisions; objectives of top management |
Top management | Sets compliance objectives for each direct report; reviews compliance performance at planned intervals; speaks about compliance in leadership forums; deals visibly and consistently with misconduct; funds first-line controls | Objectives and appraisals; review records; communications; disciplinary outcomes |
Senior and middle management | Owns the obligations and risks in their area; ensures first-line controls operate; discusses compliance with their teams; encourages concerns and prevents retaliation; raises nonconformities found in their area; implements corrective actions | Register ownership; first-line review records; team meeting records; nonconformities raised by the line |
First-line supervisors | Explains expectations to staff; spots and escalates issues; models the behaviour | Training of teams; escalations; culture survey results for the team |
6.3 Delivering the education
Effective approaches include a governing body session on its responsibilities under the standard; a top management workshop that ends with leaders drafting their own compliance objectives; short, scenario-based sessions for managers built on real cases from the organisation; and one-to-one sessions between the compliance function and each senior leader to map the obligations and risks they now own. Compliance training for managers should be assessed for effectiveness, as Clause 7.2.3 requires, not merely completed.
7. Management Taking the Reins
For managers, receiving ownership of compliance can feel like an additional burden handed down by a department that previously did the work. How the handover is framed matters. Managers already own the commercial, operational and people risks of their areas; compliance risk is part of the same job.
7.1 What management should focus on
Know your obligations and risks. Understand which compliance obligations apply to your area and which compliance risks are highest. Own the entries in the register and the risk assessment.
Run the first-line controls. Make sure the controls in your processes operate — approvals, checks, reconciliations — and review them yourself periodically.
Talk about it. Make compliance part of normal management conversation: team meetings, business reviews, one-to-ones. Your team takes its cue from what you talk about.
Set the example. Follow the rules yourself, visibly, including when it is inconvenient or commercially costly.
Make it safe to speak up. Encourage concerns, thank people who raise them, and never allow retaliation.
Act on problems. When something goes wrong in your area, raise it, take part in resolving it, and see the corrective action through — rather than passing it to compliance.
Use the compliance function. Seek advice early, especially on difficult judgements. Using compliance as an adviser is a sign of ownership, not a failure of it.
7.2 What management should not do
Hand it back. Asking compliance to “just approve it” or “just do it” reverses the transition.
Treat it as administration. Completing a form is not owning a risk.
Shoot the messenger. When compliance monitoring finds a problem in your area, the monitoring is working.
Delegate it entirely. A manager can delegate tasks, but under Clause 5.3.3 remains responsible for compliance in their area.
FOR LEADERS Owning compliance is not doing compliance’s work. It is running your area in a way that meets your obligations — which you were already responsible for. The management system simply makes that responsibility visible and gives you the tools to discharge it. |
8. How Compliance and Management Work Together
The transition succeeds when both sides understand the new division of work and have regular forums in which to exercise it. Ambiguity breeds the two worst outcomes: tasks that both sides think the other is doing, and tasks that both sides keep doing at once.
8.1 A division of work
Activity | Management | Compliance function |
|---|---|---|
Obligations register | Owns the obligations in its area; confirms completeness | Facilitates identification; maintains the register; monitors changes |
Compliance risk assessment | Identifies and assesses risks in its operations; owns treatment | Designs the method; facilitates; documents; challenges |
Controls | Operates first-line controls; performs first-line reviews | Designs or validates controls; tests them independently |
Training and awareness | Ensures its people attend; reinforces messages; explains relevance | Designs curriculum; assesses effectiveness |
Speak-up | Encourages concerns; prevents retaliation | Operates the system; ensures concerns are addressed |
Investigations | Supports; implements outcomes in its area | Ensures investigations are independent and competent |
Nonconformities | Raises nonconformities found in its area; owns corrective action | Maintains the register; verifies effectiveness |
Reporting | Reports on compliance in its area | Reports independently on the system’s performance |
Management review | Top management reviews and decides | Prepares inputs; reports on independence and resources |
8.2 Forums and cadence
Common arrangements include a compliance committee chaired by a senior business leader rather than the head of compliance, with business unit heads as members; compliance as a standing agenda item in business reviews, presented by the business; and regular private sessions between the head of compliance and the governing body or its committee. Chairing by the business sends an unmistakable signal about ownership.
8.3 When compliance should step in
Leading from behind includes knowing when to step forward. Compliance should intervene directly when a matter is beyond management’s competence, when management has a conflict of interest, when a serious breach requires immediate containment or independent investigation, or when management repeatedly fails to act. The escalation route to top management and the governing body under Clause 5.1.3 exists precisely for these cases. Using it is not a failure of the model; it is the model working.
9. Running the Transition as a Planned Change
Moving ownership from compliance to management is a significant change to the management system, and Clause 6.3 of ISO 37301 requires it to be carried out in a planned manner, considering its purpose and consequences, its effect on the system, resources and the reallocation of responsibilities. Speeki’s whitepaper on Clause 6.3 sets out the change management models in detail; Kotter’s eight-step process is a natural fit for a change of this scale.
Phase | Typical timing | Activities |
|---|---|---|
1. Diagnose | Months 1–2 | Map who actually does what today against Clauses 5.1 and 5.3; identify where compliance performs management’s role; run a culture survey on perceived management commitment; hold an honest conversation within the compliance team about the transition. |
2. Align leaders | Months 2–4 | Governing body and top management sessions; agree the ownership model and leadership expectations; appoint a senior business sponsor; set the first compliance objectives for top management. |
3. Design | Months 3–5 | Redesign processes so that ownership sits in the line; reallocate obligations, risks and controls in the register; update job descriptions, delegations and committee terms of reference; define what compliance stops doing. |
4. Pilot | Months 5–8 | Transfer ownership in one business unit or country; coach its managers; monitor closely; learn and adjust. |
5. Extend | Months 8–14 | Roll out in waves; use early adopters as examples; recognise managers who take ownership well. |
6. Embed | Months 12–18 and ongoing | Integrate compliance into objectives, appraisals and promotion decisions; move the compliance committee chair to the business; measure; report progress to management review. |
Timings are indicative and depend on the size and maturity of the organisation.
9.1 Measuring the shift
Indicator | What it shows |
|---|---|
Share of obligations and risks owned by line roles rather than compliance | Whether ownership has actually moved |
Share of nonconformities raised by the first line | Whether management is detecting and owning problems |
Senior leaders with compliance objectives, and their appraisal outcomes | Whether accountability is real |
Compliance items presented by business leaders at committees and to the board | Whether management, not compliance, is reporting on its own areas |
Employee perception of their own manager’s commitment to compliance | Whether culture is shifting at the level that matters, as Annex A.5.1.2 suggests measuring |
Share of compliance function time spent on design, oversight and challenge versus transaction processing | Whether compliance has moved behind |
10. Common Failures
Failure | Why it matters | What a sound transition does instead |
|---|---|---|
Ownership changed on paper only | The RACI says management; compliance still does the work. | Redesigns processes and stops compliance performing first-line tasks. |
Compliance takes tasks back | The first mistake by a manager leads compliance to reclaim the activity. | Treats mistakes as nonconformities to be corrected through the system. |
Expectations cascaded without top management | Middle managers see it as compliance’s project. | Starts with the governing body and top management, visibly. |
No measures of ownership | Nobody can tell whether the transition has happened. | Tracks ownership, first-line detection and leadership indicators. |
Compliance team’s concerns ignored | Hidden resistance slows the change. | Names the losses openly and works through them. |
Leading from behind confused with stepping back | Oversight weakens; problems go undetected. | Strengthens monitoring, testing and independent reporting as ownership moves. |
Managers given ownership without capability | They fail and confidence collapses. | Educates, equips and coaches before and during the handover. |
11. What Speeki’s Auditors Look For
Speeki tests leadership and ownership primarily by talking to management, not to the compliance function.
Interviews with leaders and managers. Can the governing body, top management and line managers describe their own compliance responsibilities, the obligations and risks they own, and what they did about compliance in the last quarter — without the compliance team in the room?
Evidence of leadership under Clause 5.1. Compliance objectives for top management; minutes showing leaders debating and deciding on compliance; communications from leaders; consistent treatment of misconduct regardless of seniority.
Evidence of management responsibility under Clause 5.3.3. Register entries owned by line roles; first-line reviews performed; nonconformities raised by management; corrective actions implemented by the business.
Job descriptions and appraisals. Compliance responsibilities in managers’ job descriptions; compliance performance considered in appraisals, as Clause 5.3.1 requires top management to ensure.
Independence of the compliance function. Whether the compliance function is performing operational activities that compromise its ability to monitor and challenge them.
Finding pattern | Typical grading |
|---|---|
Top management has taken no steps to demonstrate leadership and commitment; the system is run entirely by the compliance function | Major nonconformity |
Leadership activity exists but managers cannot describe their compliance responsibilities, or responsibilities are not in job descriptions | Minor nonconformity |
Compliance performance is not integrated into performance appraisals | Minor nonconformity |
Management responsibilities are allocated but there is no evidence of managers performing them | Minor nonconformity |
Ownership has moved to management and is evidenced, but leadership indicators are not yet monitored | Opportunity for improvement |
Grading is illustrative and depends on the evidence and its effect on the system.
Conclusion
The transformation from compliance programme to compliance management system is often described in terms of documents, processes and registers. Those matter. But the deeper transformation is a transfer of ownership — from a compliance department that does compliance to a management team that leads it, supported by a compliance function that designs, equips, monitors and challenges.
That transfer asks something of both sides. Management must accept that compliance is part of running the business, not a service delivered to it. Compliance must accept that its greatest influence comes from building the system through which others act, not from acting on their behalf. Leading from behind is harder than leading from the front. It is also the only way a compliance function builds something that is bigger than itself — and that keeps working when it is not in the room.
About Speeki
Speeki is an accredited certification body operating across more than 100 countries, providing ISO management system certification, ESG and sustainability assurance, and executive education. Speeki provides no consulting of any kind. Our independence is structural, not a promise.
Speeki delivers its audits through AI working alongside a body of experts. Nicole, Speeki’s AI team member, works with our auditors to test full populations of evidence rather than samples, so that certification reflects how a management system actually performs, not how it looks on the day of the audit.
To learn more, see ISO 37301 certification with Speeki.
References
International Organization for Standardization (2021). ISO 37301:2021 Compliance management systems — Requirements with guidance for use. Geneva: ISO.
International Organization for Standardization (2025). ISO 37001:2025 Anti-bribery management systems — Requirements with guidance for use. Geneva: ISO.
Bridges, W. (1991). Managing Transitions: Making the Most of Change. Reading, MA: Addison-Wesley.
Heifetz, R.A. (1994). Leadership Without Easy Answers. Cambridge, MA: Belknap Press of Harvard University Press.
Heifetz, R.A., Grashow, A. and Linsky, M. (2009). The Practice of Adaptive Leadership: Tools and Tactics for Changing Your Organization and the World. Boston, MA: Harvard Business Press.
Hill, L.A. (2010). Leading from behind. Harvard Business Review (online), May 2010.
Hill, L.A., Brandeau, G., Truelove, E. and Lineback, K. (2014). Collective Genius: The Art and Practice of Leading Innovation. Boston, MA: Harvard Business Review Press.
Institute of Internal Auditors (2020). The IIA’s Three Lines Model: An Update of the Three Lines of Defense. Lake Mary, FL: IIA.
Kegan, R. and Lahey, L.L. (2009). Immunity to Change: How to Overcome It and Unlock the Potential in Yourself and Your Organization. Boston, MA: Harvard Business Press.
Kotter, J.P. (1996). Leading Change. Boston, MA: Harvard Business School Press.
Mandela, N. (1994). Long Walk to Freedom. London: Little, Brown.
Related Reading
A Compliance Programme Is Not a Compliance Management System
Independence or Theatre? The Compliance Function and the Governing Body
Fixed Is Not Closed: Nonconformity Management Under ISO 37001 and ISO 37301
This whitepaper provides general information on ISO 37301:2021 and does not reproduce the text of the standard. Organisations should refer to the published standard for its exact requirements.