Quick Read
Clause 6.3 of ISO 37301 requires that, when an organisation determines the need for changes to its compliance management system, those changes are carried out in a planned manner. It names four things the organisation must consider: the purpose and potential consequences of the change, the design and operational effectiveness of the system, the availability of resources, and the allocation of responsibilities and authorities. Most organisations have no method for this. They approve a new policy, switch a hotline provider or launch a new training curriculum, announce it, and assume it has happened. It has not. This paper explains what Clause 6.3 requires and why, draws on the established change management models — Kotter, Lewin, ADKAR, GE’s Change Acceleration Process, Bridges and the change formula — and works through five real compliance changes to show the clause in practice.
Executive Summary
Every compliance management system changes. Laws change, the business changes, a hotline contract expires, an investigation exposes a weak control, a regulator raises expectations, the board asks for something new. ISO 37301 assumes this. What it does not accept is change made casually. Clause 6.3 requires changes to the compliance management system to be carried out in a planned manner, with their purpose, consequences, effect on the system, resources and responsibilities thought through before they are made.
In Speeki’s experience, this is one of the least mature areas of most compliance management systems. Organisations that are sophisticated about policy content are often unsophisticated about change. A new gifts, travel and entertainment process is designed carefully, approved by the right committee and published on the intranet — and six months later most managers are still approving hospitality the old way. The design was good. The change was never managed.
Change management is a mature discipline with well-tested models. They were not written for compliance, but they apply to it directly, because compliance change is ultimately behavioural change: people in the organisation have to do something differently. This paper translates those models into the language of a compliance management system and sets out a practical method that satisfies Clause 6.3 and actually works.
The paper covers what the clause requires and how it connects to the rest of the standard, why compliance changes fail, the principal change management models and when to use each, a step-by-step method for planning and embedding a change, five worked examples, how to handle resistance, common failures and what Speeki’s auditors test.
CORE ARGUMENT A change to a compliance management system is not complete when it is approved, published or announced. It is complete when the people affected are doing the new thing, the old thing has stopped, the system’s other elements have been updated to match, and there is evidence of all three. Clause 6.3 exists to make that outcome planned rather than accidental. |
1. What Clause 6.3 Requires
Clause 6.3 is short. In substance it requires that, when the organisation determines the need for changes to the compliance management system, those changes are carried out in a planned manner, and that the organisation considers four matters.
Required consideration | The question it asks | What planning it demands |
|---|---|---|
The purpose of the change and its potential consequences | Why are we changing this, and what could happen — intended and unintended — when we do? | A stated objective for the change; an assessment of consequences, including risks created during the transition |
The design and operational effectiveness of the compliance management system | Will the system still hang together and still work, during and after the change? | An assessment of which other elements are affected — obligations, risks, controls, documents, training, communication, indicators — and how they will be kept aligned |
The availability of adequate resources | Do we have the people, budget, time, technology and expertise to make this change properly? | A resourced plan, not an aspiration; a decision to defer or phase the change if resources are not available |
The allocation or reallocation of responsibilities and authorities | Who owns what after the change, and who owns the change itself? | Named owners for the change and for every obligation, control and process whose ownership moves |
1.1 What triggers the clause
The clause is triggered when the organisation determines that the compliance management system needs to change. That determination can come from many places, and the standard builds several of them in explicitly:
New and changed compliance obligations. Clause 4.5 requires processes to identify new and changed obligations, evaluate the impact of those changes and implement any necessary changes in how the obligations are managed.
Material change in circumstances. Clause 4.6 requires compliance risks to be reassessed whenever there are material changes in circumstances or organisational context. Annex A.4.6 lists examples, including new activities, structural change, mergers and acquisitions, and non-compliance — noting that even a single incident can be a material change.
Management review. Clause 9.3.3 requires the results of management review to include decisions on any need for changes to the compliance management system.
Corrective action. Clause 10.2 requires the organisation, where necessary, to make changes to the compliance management system in response to a nonconformity or non-compliance.
Internal audit, monitoring and feedback. Findings from Clauses 9.1 and 9.2 frequently identify elements that need to be redesigned.
Each of these routes produces a decision that something should change. Clause 6.3 governs what happens next.
1.2 How it connects to the rest of the standard
Clause 6.3 does not stand alone. Several other requirements engage directly with change, and a sound change method satisfies them together.
Clause | What it requires in relation to change |
|---|---|
8.1 Operational planning and control | The organisation must control planned changes and review the consequences of unintended changes, taking action to mitigate adverse effects as necessary. |
7.4 Communication | The organisation must internally communicate information relevant to the system, including changes to the compliance management system, as appropriate. |
7.5.3 Control of documented information | Documented information must be controlled, including control of changes such as version control. |
7.2.3 Training | Training must be appropriate, assessed for effectiveness and reviewed regularly. Annex A.7.2.3 recommends considering retraining whenever there is a change in internal policies, processes and procedures, in organisational structure, in compliance obligations or in activities, products or services. |
10.1 Continual improvement (Annex A.10.1) | Annex A.10.1 cautions that changes to individual elements should take account of their dependency on, and impact on, the effectiveness of the system as a whole, including operations, resources, compliance risk assessments, compliance obligations and continual improvement processes. |
READ TOGETHER Taken with Clause 8.1 and Annex A.10.1, Clause 6.3 asks for more than a sign-off. It asks the organisation to understand how a change ripples through the system, to resource it, to give it an owner, and to control both the planned change and any unintended effects it causes. |
2. Why the Clause Exists
Management system standards include a planning-of-changes requirement because uncontrolled change is one of the most reliable ways to break a working system. In compliance, the damage is often silent. Nothing visibly fails on the day of the change; the failure appears months later, when an obligation turns out to have had no owner, a control stopped operating during a system migration, or a population of employees never received the new rule.
2.1 The anatomy of an unmanaged change
Speeki sees the same pattern repeatedly. The content of the change is well designed. What is missing is everything around it.
What was done | What was missed | What it produced |
|---|---|---|
A new policy was approved by the compliance committee and published | No assessment of which procedures, systems and forms still reflected the old policy | Two conflicting rules in force; managers followed the one in their system |
The hotline provider was replaced on contract expiry | No parallel running, no update to posters, intranet, supplier codes or translated materials | Reports fell sharply for two quarters; the old number still appeared at several sites |
A reorganisation merged two business units | No reallocation of the obligations and controls owned by roles that disappeared | Orphaned obligations; a monthly control simply stopped |
A new e-learning curriculum was launched | No analysis of who needed what, no change to manager expectations, no measure of effect | High completion rates; no change in behaviour |
2.2 Compliance change is behavioural change
The deeper reason the clause matters is that almost every compliance change asks people to behave differently. A new screening step, a new approval threshold, a new expectation that managers talk about integrity in team meetings: each succeeds or fails on whether people adopt it. Documents do not comply; people do. A change plan that addresses only documents, systems and contracts addresses the easy half of the problem.
That is why the change management discipline is directly relevant. It exists to answer the question compliance teams most often skip: how do we get people to actually make this change, and to keep making it?
THE TEST OF A CHANGE Ask three questions six months after any significant change to the system. Are the affected people doing the new thing? Has the old thing stopped? Do the rest of the system’s elements — obligations, risks, controls, training, communications, indicators — reflect the change? If any answer is no, the change was approved but not managed. |
3. The Change Management Models
Several well-established models can guide a change to a compliance management system. None is complete on its own. Some describe how to lead an organisation through change; others describe how individuals experience it. The most effective approach is to select the right model, or combination of models, for the size and nature of the change.
3.1 Kotter’s eight-step process
John Kotter of Harvard Business School set out his model in a 1995 Harvard Business Review article, “Leading Change: Why Transformation Efforts Fail”, and developed it in his 1996 book Leading Change. The model has eight steps, in sequence. (It is sometimes misremembered as a nine-step plan; it has eight. In his 2014 book Accelerate, Kotter reframed the steps as eight “accelerators” that run concurrently within what he calls a dual operating system.)
Kotter’s step | Applied to a compliance management system change |
|---|---|
1. Establish a sense of urgency | Make the case for the change with evidence: the enforcement trend, the investigation finding, the regulator’s expectation, the control failure. Urgency built on facts outlasts urgency built on fear. |
2. Create the guiding coalition | Assemble a group with the authority to make the change happen — business leaders, not only the compliance function. A change owned by compliance alone is perceived as compliance’s project. |
3. Develop a vision and strategy | State in one or two sentences what will be different and why it matters, and set out how the change will be delivered. |
4. Communicate the change vision | Communicate repeatedly, through many channels, and above all through the behaviour of leaders. One intranet article is not communication. |
5. Empower broad-based action | Remove the obstacles: systems that still enforce the old process, targets that reward the old behaviour, managers who have not been equipped. |
6. Generate short-term wins | Plan visible early successes — the first business unit live, the first case handled well under the new process — and recognise the people responsible. |
7. Consolidate gains and produce more change | Use the credibility of early wins to tackle the harder parts: the remaining units, the more resistant functions, the linked processes. |
8. Anchor new approaches in the culture | Embed the change in the system: performance objectives, onboarding, internal audit, management review. The change is anchored when it no longer depends on the people who led it. |
Kotter’s model is best suited to large changes that need leadership commitment and cross-functional effort, such as a new speak-up regime or a new standard of management accountability for culture. It is heavier than a small change needs.
3.2 Lewin’s three stages
Kurt Lewin’s work on group dynamics, notably his 1947 article “Frontiers in Group Dynamics” in the journal Human Relations, is the origin of the familiar description of change as unfreezing, moving and refreezing. Later scholarship, notably Cummings, Bridgman and Brown (2016), has argued that the neat three-step model attributed to Lewin was largely constructed and popularised by later writers, and that Lewin’s own thinking was more nuanced. The three stages nonetheless remain a useful lens.
Unfreeze. Create readiness: explain why the current way is no longer acceptable and address the reasons people hold on to it.
Move. Implement the change: new process, new system, training, support.
Refreeze. Stabilise: embed the new way in documents, controls, objectives and monitoring so that the organisation does not drift back.
For compliance, the refreeze stage is where most changes fail. The new process is launched, but the old forms, approval routes and habits remain available, and the organisation slides back.
3.3 ADKAR
The ADKAR model was developed by Jeff Hiatt, founder of Prosci, and set out in his 2006 book ADKAR: A Model for Change in Business, Government and our Community. Where Kotter focuses on leading the organisation, ADKAR focuses on the individual. It holds that each person affected must reach five outcomes, in order.
Outcome | Meaning | Compliance example: a new gifts, travel and entertainment register |
|---|---|---|
Awareness | Of the need for change | Sales managers understand why pre-approval of hospitality for public officials is now required |
Desire | To participate and support it | They see that the register protects them personally and speeds up routine approvals |
Knowledge | Of how to change | They know which items need pre-approval, the thresholds and how to use the tool |
Ability | To implement the skills and behaviours | They can submit, approve and record items in practice, on mobile, in the field |
Reinforcement | To sustain the change | Exceptions are followed up; good practice is recognised; the register is tested by the compliance function |
ADKAR is particularly useful for diagnosing why a change has stalled. Completion of training gives Knowledge; it does not give Desire or Ability. Many compliance changes stall at exactly those two stages.
3.4 GE’s Change Acceleration Process
General Electric developed its Change Acceleration Process (CAP) in the 1990s as an internal methodology to speed up and embed change across the company; it is widely described in management literature, though there is no single canonical publication of it. It is often summarised by the formula Quality × Acceptance = Effectiveness: a technically excellent solution that people do not accept produces a poor result. CAP identifies seven elements of successful change.
CAP element | Applied to compliance change |
|---|---|
Leading change | Visible sponsorship by leaders who own the outcome |
Creating a shared need | A reason for change that the affected population accepts, not only the compliance function |
Shaping a vision | A clear picture of the end state, expressed in terms of behaviour |
Mobilising commitment | Engaging the stakeholders whose support is needed, and addressing those who resist |
Making change last | Planning from the start for how the change will be sustained |
Monitoring progress | Defined measures of adoption and effect, reviewed by the owner |
Changing systems and structures | Aligning incentives, approval workflows, IT systems and reporting lines with the change |
The Quality × Acceptance insight is especially relevant to compliance functions, which tend to invest heavily in the quality of a policy or process and very little in its acceptance.
3.5 Bridges’ transition model
William Bridges, in Managing Transitions (1991), distinguishes change — the external event — from transition — the internal psychological process people go through. He describes three phases: an ending, in which people let go of the old way; a neutral zone, in which the old has gone but the new is not yet comfortable; and a new beginning.
For compliance, Bridges explains why the period immediately after a change is the riskiest. In the neutral zone, people are unsure which rule applies, workarounds appear and errors increase. A good change plan expects this, provides extra support and monitoring during the transition, and does not mistake temporary confusion for resistance.
3.6 The change formula
Richard Beckhard and Reuben Harris, in Organizational Transitions (1977), presented a formula for change that they credited to David Gleicher. It is now usually written in the form popularised by Kathleen Dannemiller: D × V × F > R. Change happens when dissatisfaction with the present (D), a vision of what is possible (V) and concrete first steps (F), multiplied together, outweigh resistance (R).
Because the elements are multiplied, if any one is zero, the change fails. That makes the formula a fast readiness test before launching a change to the compliance management system: is there genuine dissatisfaction with the current state, is the future state clear, and do people know what to do first?
A NOTE ON STATISTICS Change management literature often repeats the claim that around 70 per cent of change programmes fail. The evidence behind that figure is weak (see Hughes, 2011), and Speeki does not rely on it. The point does not need a statistic: unmanaged change routinely fails to change behaviour, and auditors can see the evidence. |
4. Choosing the Right Model for the Change
Not every change needs a guiding coalition. A proportionate approach classifies each change by its size and its behavioural impact, and applies a depth of change management to match. The classification itself, and the criteria for it, should be documented so that the approach is consistent.
Class | Typical examples | Change management depth | Models most useful |
|---|---|---|---|
Minor | Correcting a procedure, updating a contact, clarifying wording, adjusting a threshold with little behavioural effect | Change record, impact check, document control and targeted communication | Change formula as a quick check |
Moderate | A new approval process, a new register, a revised training module, a new third-party screening step | Full impact assessment, owner, resourced plan, training, adoption measures, post-implementation review | ADKAR; Lewin; Bridges for the transition period |
Major | A new speak-up platform and process, a new third-party management provider, a new compliance curriculum, new expectations of management on culture, a reorganisation of the compliance function | Sponsored programme with a steering group, stakeholder plan, phased rollout, parallel running where needed, governance reporting | Kotter or GE CAP for leadership; ADKAR for individuals; Bridges for the transition |
The models are complementary rather than competing. A major change typically uses Kotter or CAP to structure the leadership effort, ADKAR to plan and diagnose adoption by each affected population, and Bridges to manage the transition period.
5. A Method for Planning and Embedding Change
The models describe the human side of change. A compliance management system also needs a procedural method that makes Clause 6.3 operational, produces evidence and connects to the rest of the system. The eight stages below combine both.
Trigger and log. Record every proposed change to the system, whatever its source — regulatory change, management review, corrective action, audit finding, business change — in a single change log.
Classify. Classify the change as minor, moderate or major against documented criteria, and assign a change owner.
Assess impact. Work through the four Clause 6.3 considerations and map the effect on every other element of the system: obligations, risk assessment, controls, documents, training, communication, third parties, indicators and reporting.
Plan. Build a plan proportionate to the class: actions, owners, resources, timeline, communication, training, transition arrangements such as parallel running, and a fallback if the change fails. For moderate and major changes, include the people side, using the models above.
Approve. Approve the plan at a level commensurate with the change. Major changes should be visible to top management and, where they affect the governing body’s oversight, to the governing body.
Implement and communicate. Deliver the change, update and version-control documents, retire superseded material, and communicate internally (and externally where relevant), consistent with Clause 7.4.
Verify adoption and effectiveness. Measure whether the change has been adopted and whether it works: usage, exceptions, control test results, feedback, indicators. Watch for unintended consequences, as Clause 8.1 requires.
Close and review. Close the change only when adoption is evidenced, record lessons learned, and report significant changes to management review.
5.1 The impact assessment
The impact assessment is where Clause 6.3’s requirement to consider the design and operational effectiveness of the system becomes practical. A simple checklist prevents the most common omissions.
System element | Impact question |
|---|---|
Obligations (4.5) | Does the change affect which obligations apply, how they are met or who owns them? |
Compliance risk assessment (4.6) | Does the change create, remove or alter compliance risks, including temporary risks during transition? |
Controls (8.2) | Which controls are added, removed, redesigned or moved to a new owner or system? How will they be tested after the change? |
Roles and authorities (5.3) | Whose responsibilities change? Are job descriptions, delegations and committee terms of reference affected? |
Documented information (7.5) | Which policies, procedures, forms and records must be updated, and which must be withdrawn? |
Competence and training (7.2) | Who needs to learn what, by when? Does any role need new competence? |
Communication (7.4) | Who must be told, what, when and how — internally and externally? |
Third parties (8.1) | Are outsourced processes, providers or business partners affected? Do contracts or service levels change? |
Indicators and reporting (9.1) | Do indicators, data sources or reports change? How will adoption be measured? |
Speak-up and investigations (8.3, 8.4) | Does the change affect how concerns are raised or handled? |
5.2 The change record
Each moderate or major change should have a change record that provides the evidence Clause 6.3 requires and that an auditor can follow from start to finish.
Field | Content |
|---|---|
Change reference and version | Unique reference, with version control as the plan evolves |
Trigger and source | What prompted the change and where it came from |
Purpose | What the change is intended to achieve |
Classification and owner | Minor, moderate or major; named change owner and sponsor |
Consequences assessed | Intended and potential unintended consequences, including transition risks |
System impact | Completed impact checklist across system elements |
Resources | People, budget, technology and time allocated |
Responsibilities | Changes to ownership of obligations, controls, processes and roles |
Plan | Actions, dates, communications, training, transition and fallback arrangements |
Approval | Who approved, when, at what level |
Adoption and effectiveness measures | How success will be measured and when |
Verification and closure | Evidence of adoption, effectiveness review, lessons learned, closure date |
6. Clause 6.3 in Practice: Five Worked Examples
The examples below are typical of the changes Speeki sees in compliance management systems. Each shows why Clause 6.3 applies, how the four required considerations play out, which change management lens helps, and what an auditor would expect to see.
6.1 Example one: changing the whistleblowing system
An organisation replaces its telephone-and-email hotline, run by one provider, with a new web and app-based platform from a different provider, offering two-way anonymous communication and case management.
Clause 6.3 consideration | How it applies |
|---|---|
Purpose and consequences | Purpose: better accessibility, anonymous dialogue and case tracking. Consequences: a risk that reports fall during the transition; open cases on the old system must be migrated or closed without loss of confidentiality; anonymous reporters on the old system must still be able to follow up. |
Design and effectiveness of the system | Clause 8.3 requirements must be met continuously — confidentiality, anonymous reporting, protection from retaliation, advice. Every reference to the old channel must be replaced: code of conduct, policies, posters, intranet, supplier codes, training, translated materials. Investigation workflows and indicators change. |
Resources | Budget for parallel running; administrators trained on the new platform; translation; communication campaign; data migration and security review. |
Responsibilities | Who administers the platform, who triages, who has access to which cases; updated data protection roles with the new provider. |
Change lens: this is a major change. Bridges is particularly helpful, because the transition period is where trust is lost. Run both channels in parallel for a defined period, redirect the old number, and monitor report volumes by location weekly. Kotter’s short-term wins matter too: publicise the first cases handled well through the new channel.
WHAT AN AUDITOR EXPECTS A change record showing the four considerations; a migration plan for open cases; evidence that every reference to the old channel was updated; parallel-running dates; report volumes before, during and after the change, with an explanation of any dip; and the change reported to management review. |
6.2 Example two: moving to a new third-party management provider
An organisation moves its third-party due diligence and screening from an in-house spreadsheet process and one data vendor to an integrated third-party risk management platform from a new provider.
Clause 6.3 consideration | How it applies |
|---|---|
Purpose and consequences | Purpose: consistent risk-based due diligence, continuous monitoring, an audit trail. Consequences: legacy third parties may not be migrated or re-screened; risk-rating logic may change, reclassifying existing relationships; continuous monitoring alerts may create a backlog nobody planned for. |
Design and effectiveness of the system | Third-party controls under Clause 8.1 and the compliance risk assessment for outsourced and third-party processes under Clause 4.6 are directly affected. Procurement and onboarding workflows, contract templates and approval authorities must be aligned. Control testing must be redesigned for the new evidence. |
Resources | Data migration and cleansing; analyst capacity for alert review; integration with procurement and finance systems; training for business owners of relationships. |
Responsibilities | Who owns each third-party relationship, who reviews alerts, who can approve high-risk third parties; the provider’s own responsibilities in the contract. |
Change lens: a major change in systems, a moderate one in behaviour. GE CAP’s “changing systems and structures” is central: if the procurement system still allows a supplier to be paid without a completed due diligence record, the new platform will be bypassed. ADKAR applies to business relationship owners, who need Desire and Ability, not only Knowledge.
WHAT AN AUDITOR EXPECTS Evidence that the full legacy population was migrated or re-screened, with exceptions resolved; alert volumes and backlog tracked from go-live; a system block preventing onboarding or payment without completed due diligence; and control testing re-performed on the new platform. |
6.3 Example three: implementing a new gifts, travel and entertainment mechanism
An organisation replaces an annual paper declaration of gifts and hospitality with a mobile pre-approval and registration tool, introducing new thresholds and mandatory pre-approval for anything involving public officials.
Clause 6.3 consideration | How it applies |
|---|---|
Purpose and consequences | Purpose: real-time visibility and prevention rather than after-the-fact disclosure. Consequences: initial friction for sales and procurement staff; possible under-registration if the tool is cumbersome; a spike in approval requests for line managers. |
Design and effectiveness of the system | The gifts and hospitality policy, the code of conduct, expense policies and the expense system must align so that hospitality cannot be expensed without a register entry. Indicators shift from declaration completion to pre-approval compliance and exception rates. |
Resources | Tool configuration and support; manager guidance; a helpdesk during launch; compliance function capacity to review exceptions. |
Responsibilities | Approval authorities by value and recipient type; compliance function oversight; finance responsible for the expense-system link. |
Change lens: a moderate change that touches many people. ADKAR is the right tool: plan explicitly for Desire (why this helps the individual) and Ability (can they use it at a client dinner on a phone?). Lewin’s refreeze is essential: withdraw the paper form and block expense claims without a register reference, or the old way will persist.
WHAT AN AUDITOR EXPECTS The old mechanism formally withdrawn; expense-system matching showing hospitality expenses reconciled to register entries; exception rates tracked over time; and evidence that managers were briefed on their approval role. |
6.4 Example four: a new compliance training curriculum
An organisation replaces a single annual code-of-conduct module for all staff with a risk-based curriculum: a core module for everyone, role-specific modules for high-risk populations, manager modules, and refresher micro-learning triggered by events.
Clause 6.3 consideration | How it applies |
|---|---|
Purpose and consequences | Purpose: training that is appropriate to roles and the compliance risks people face, as Clause 7.2.3 requires, and assessed for effectiveness. Consequences: some populations may be missed in the role mapping; workload rises for high-risk roles; completion reporting becomes more complex. |
Design and effectiveness of the system | The curriculum must derive from the compliance risk assessment, map to roles in the HR system, and connect to onboarding, transfers and promotions under Clause 7.2.2. Indicators must move from completion rates to measures of effectiveness. Third parties acting on the organisation’s behalf may need their own training under Clause 7.2.3. |
Resources | Content development in relevant languages; learning platform configuration; HR data quality for role mapping; manager time. |
Responsibilities | Who owns each module’s content and its update when obligations change; HR’s responsibility for role data; managers’ responsibility for follow-up. |
Change lens: a moderate to major change. The change formula is a useful check: is there real dissatisfaction with the old annual module, a clear vision of what the new curriculum achieves, and clear first steps for each population? Kotter’s guiding coalition matters if business leaders are expected to give staff time for training.
WHAT AN AUDITOR EXPECTS A documented link between the compliance risk assessment and the curriculum design; role mapping with exceptions resolved; evidence that training effectiveness is assessed, not only completion; and arrangements to keep content current when obligations change. |
6.5 Example five: new expectations of management for compliance culture
Following an investigation that found managers had ignored warning signs, the governing body sets new expectations: every people manager must discuss compliance and speak-up with their team quarterly, include compliance behaviour in performance appraisals, and escalate concerns within a defined period.
Clause 6.3 consideration | How it applies |
|---|---|
Purpose and consequences | Purpose: to give effect to Clause 5.1.2 — an active, visible, consistent and sustained commitment to compliance by management — and to Clause 5.3.3 on management’s responsibilities. Consequences: managers may treat it as a box-ticking exercise; inconsistent application across regions; potential for perceived unfairness in appraisals. |
Design and effectiveness of the system | Job descriptions and performance appraisal criteria change, consistent with Clause 5.3.1 on integrating compliance performance into appraisals. Culture indicators must be defined. Speak-up processes must be ready for increased reporting. Internal audit and management review inputs change. |
Resources | Manager briefing materials and conversation guides; HR system changes for appraisals; culture survey capability. |
Responsibilities | Managers’ new accountabilities; HR’s role in appraisals; the compliance function’s role in supporting and monitoring; top management’s role in modelling the behaviour. |
Change lens: this is the hardest kind of change, because it is purely behavioural and depends on leaders. Kotter is the natural framework: urgency from the investigation, a coalition of senior leaders who visibly model the behaviour, short-term wins in the form of recognised examples, and anchoring in appraisal and promotion decisions. Bridges warns that managers who have succeeded under the old norms will experience this as a loss of autonomy and need time and support.
WHAT AN AUDITOR EXPECTS The expectations documented and communicated; evidence that they have reached appraisals in practice; culture survey or similar measures showing whether employees perceive the change; interviews in which managers can describe what they now do differently; and management review consideration of progress. |
6.6 Other changes that engage Clause 6.3
Change | Typical risk if unmanaged |
|---|---|
A new law brings a new domain into scope (for example, a new sanctions regime or data law) | Obligations identified but never translated into controls, training or ownership |
Reorganisation, acquisition or divestment | Orphaned obligations and controls; acquired business operating outside the system |
Replacing the compliance function’s head or restructuring the function | Loss of direct access or independence during transition |
Moving a compliance process to a shared service centre or outsourcing it | Loss of control and evidence; Clause 8.1 obligations overlooked |
Introducing AI or automation into a compliance control | Control design changes without testing; unclear accountability for automated decisions |
Changing risk methodology or appetite | Prior assessments not reconciled; controls not recalibrated |
7. Managing Resistance and Stakeholders
Resistance is a normal response to change, not a sign that the change is wrong. In compliance, it often reflects a legitimate concern — the new process is slower, it was designed without input from those who use it, or it appears to signal distrust. Treating resistance as information improves the change.
7.1 A simple stakeholder analysis
For major changes, a practical approach is to list the individuals whose support matters, rate each on a scale — for example from one to ten — for both their influence and their current support or opposition, and plan engagement person by person. The aim is to move the most influential stakeholders towards support before launch, not to manage opposition after it.
Stakeholder position | Approach |
|---|---|
High influence, supportive | Involve in the guiding coalition; ask them to communicate and model the change |
High influence, opposed | Engage early and personally; understand the objection; adapt the design where the objection has merit |
Low influence, supportive | Use as champions and early adopters; recognise them |
Low influence, opposed | Address concerns through clear information, training and support; monitor adoption |
7.2 Answering “what’s in it for me?”
People adopt change when they can see its value to them. For compliance changes, the honest answers are often strong: a register that protects the individual if a gift is later questioned, a screening tool that removes personal judgement from a difficult decision, a speak-up channel that resolves a problem before it becomes a crisis. These benefits need to be stated explicitly, in the terms of the people affected.
7.3 Practical responses to common pushback
Build the case with evidence. Use the investigation finding, the enforcement trend or the control failure that prompted the change, and the risk of not changing.
Address concerns directly. Create channels for questions during the transition and respond to them visibly.
Involve the people affected. Test the new process with users before rollout; it is the fastest way to find design flaws.
Phase and pilot. Introduce major changes in one business unit or country first, learn, then extend.
Celebrate progress. Recognise the units and individuals who adopt well, and share what worked.
8. Common Failures
Failure | Why it matters | What a sound approach does instead |
|---|---|---|
No change method at all | Changes are made ad hoc; there is no evidence that Clause 6.3 considerations were addressed. | Operates a documented change process with a change log, classification and change records. |
Change equated with document update | The policy changes; systems, controls, training and behaviour do not. | Assesses impact across every element of the system and plans the people side. |
Old process left available | People revert to the familiar route; two rules coexist. | Formally withdraws superseded documents, forms and channels, and blocks old routes in systems. |
Responsibilities not reallocated | Obligations and controls lose their owners after reorganisations or provider changes. | Reallocates ownership explicitly as part of the change record. |
No measure of adoption | The change is declared complete on launch day. | Defines adoption and effectiveness measures and closes the change only on evidence. |
Transition risk ignored | Controls lapse during migrations; reporting dips go unnoticed. | Plans parallel running, extra monitoring and a fallback for the transition period. |
Change owned by the compliance function alone | The business treats it as compliance’s project, not its own. | Assigns business sponsorship and builds a guiding coalition for significant changes. |
9. What Speeki’s Auditors Test
Speeki tests Clause 6.3 by following changes, not by reading a change procedure.
9.1 Tracing a change
The auditor selects one or more significant changes made to the system during the audit period — often one identified from management review minutes, a corrective action or a regulatory change — and traces it from trigger to evidence of adoption: the change record, the impact assessment, the four Clause 6.3 considerations, approval, updated and withdrawn documents, communication, training, reallocated responsibilities, and measures showing the change took hold.
9.2 Looking for unmanaged change
Auditors also look for changes that were not managed: a provider replaced without a record, a reorganisation that left obligations without owners, a policy updated while the old version remains in use at a site. Where Speeki has access to document repositories, HR data or system logs, these can be compared in full — for example, every reference to a hotline number across published materials, or every obligation owner against current HR records.
9.3 Interview questions
“What was the most significant change to the compliance management system this year, and how was it planned?”
“How did you decide who needed to know about this change, and how do you know they acted on it?”
“When the old provider was replaced, what happened to the open cases and the old contact details?”
“What do you do differently since the new process was introduced?” — asked of the people affected, not the change owner.
Finding pattern | Typical grading |
|---|---|
A significant change to the system was made with no planning of any kind | Major nonconformity |
Changes are planned, but consequences, system impact, resources or responsibilities were not considered | Minor nonconformity |
Superseded documents or channels remain in use after a change | Minor nonconformity |
Unintended consequences of a change were not reviewed or mitigated (Clause 8.1) | Minor nonconformity |
Change planned and implemented, but adoption not verified | Minor nonconformity or opportunity for improvement, depending on effect |
Grading is illustrative and depends on the evidence and its effect on the system.
Conclusion
Clause 6.3 is one of the shortest requirements in ISO 37301 and one of the most revealing. It shows whether an organisation treats its compliance management system as a set of documents to be updated or as a living system that has to be steered through change without breaking.
The organisations that do this well combine two disciplines. They have a procedural method that logs, classifies, assesses, plans, approves, implements, verifies and closes every significant change. And they draw on the established change management models — Kotter, Lewin, ADKAR, GE’s Change Acceleration Process, Bridges and the change formula — to make sure the people affected actually change what they do. A change is finished when the behaviour has changed and the evidence shows it.
About Speeki
Speeki is an accredited certification body operating across more than 100 countries, providing ISO management system certification, ESG and sustainability assurance, and executive education. Speeki provides no consulting of any kind. Our independence is structural, not a promise.
Speeki delivers its audits through AI working alongside a body of experts. Nicole, Speeki’s AI team member, works with our auditors to test full populations of evidence rather than samples, so that certification reflects how a management system actually performs, not how it looks on the day of the audit.
To learn more, see ISO 37301 certification with Speeki.
References
International Organization for Standardization (2021). ISO 37301:2021 Compliance management systems — Requirements with guidance for use. Geneva: ISO.
International Organization for Standardization (2021). ISO 37002:2021 Whistleblowing management systems — Guidelines. Geneva: ISO.
Beckhard, R. and Harris, R.T. (1977). Organizational Transitions: Managing Complex Change. Reading, MA: Addison-Wesley.
Bridges, W. (1991). Managing Transitions: Making the Most of Change. Reading, MA: Addison-Wesley.
Cummings, S., Bridgman, T. and Brown, K.G. (2016). Unfreezing change as three steps: Rethinking Kurt Lewin’s legacy for change management. Human Relations, 69(1), 33–60.
Dannemiller, K.D. and Jacobs, R.W. (1992). Changing the way organizations change: A revolution of common sense. Journal of Applied Behavioral Science, 28(4), 480–498.
Hiatt, J.M. (2006). ADKAR: A Model for Change in Business, Government and our Community. Loveland, CO: Prosci Learning Center Publications.
Hughes, M. (2011). Do 70 per cent of all organizational change initiatives really fail? Journal of Change Management, 11(4), 451–464.
Kotter, J.P. (1995). Leading change: Why transformation efforts fail. Harvard Business Review, 73(2), 59–67.
Kotter, J.P. (1996). Leading Change. Boston, MA: Harvard Business School Press.
Kotter, J.P. (2014). Accelerate: Building Strategic Agility for a Faster-Moving World. Boston, MA: Harvard Business Review Press.
Lewin, K. (1947). Frontiers in group dynamics: Concept, method and reality in social science; social equilibria and social change. Human Relations, 1(1), 5–41.
Related Reading
Paper 1 — A Compliance Programme Is Not a Compliance Management System
Paper 7 — The Channel and the Verdict: Raising Concerns and Investigations
This whitepaper provides general information on ISO 37301:2021 and does not reproduce the text of the standard. Organisations should refer to the published standard for its exact requirements.