Quick Read
Most organisations already run a compliance programme: a code of conduct, policies, training, a hotline, some monitoring. ISO 37301 asks a different question. It does not ask whether those activities exist; it asks whether they are connected into a system that identifies obligations, assesses the risk of breaching them, designs controls against those risks, measures whether the controls work, and corrects itself when they do not. The gap between a programme and a system is rarely a missing policy. It is missing connections, missing evidence and missing accountability. This paper sets out where that gap sits, clause by clause, and what a certification auditor will test.
Executive Summary
Ask a compliance team whether it has a compliance programme and the answer is almost always yes. Ask it to show how the training calendar was derived from the compliance risk assessment, how the risk assessment was derived from a register of obligations, and how the board knows whether any of it is working, and the answer becomes much less certain.
That is the difference between a compliance programme and a compliance management system. A programme is a set of activities. A management system is a set of interrelated elements that establish policies, objectives and processes to achieve those objectives, and then measure and improve them. ISO 37301:2021 is a requirements standard for the second, not the first. It replaced the guidance-only ISO 19600 in 2021 precisely so that organisations could be independently certified against a defined, auditable set of requirements.
Organisations that already hold ISO 37001 anti-bribery certification will find much of ISO 37301 familiar. Both follow the harmonised structure common to all ISO management system standards, and many clauses — leadership, competence, documented information, internal audit, management review, nonconformity — are near-identical in architecture. The material differences lie in scope and design freedom. ISO 37001 addresses one risk and prescribes many of the controls. ISO 37301 addresses every compliance obligation the organisation chooses to bring into scope, and expects the organisation to design its own controls from its own risk assessment.
This paper explains the structural difference between a programme and a system, maps the typical programme against each clause of ISO 37301, identifies the six connections most programmes are missing, and sets out what Speeki’s auditors look for when they test whether a system genuinely exists.
CORE ARGUMENT A compliance programme can have every component ISO 37301 mentions and still fail certification. The standard does not certify components. It certifies the connections between them: obligation to risk, risk to control, control to evidence, evidence to decision. |
1. The Structural Difference
1.1 What a programme looks like
Most compliance programmes have grown by accretion. A policy is written after an incident. Training is added after a regulator’s speech. A hotline is installed because a listing rule or a customer contract requires one. Each component is defensible on its own. Together they form an inventory, not a system.
The tell-tale signs are consistent across sectors. Policies are reviewed on a fixed calendar rather than when the obligations behind them change. Training content is the same for every employee regardless of role. Monitoring measures activity — completion rates, number of policies, number of hotline reports — rather than whether obligations are being met. The board receives an annual compliance presentation that describes what the compliance team did, not whether the organisation complied.
1.2 What a management system looks like
A management system is built from the obligation outwards. Every element exists because something upstream requires it, and every element produces evidence that something downstream consumes. The register of obligations drives the risk assessment. The risk assessment drives the selection and design of controls. Controls generate evidence. Evidence feeds indicators. Indicators feed compliance reporting and management review. Management review produces decisions, and those decisions change the system.
Dimension | Compliance programme | ISO 37301 management system |
|---|---|---|
Starting point | Policies and activities | A documented register of compliance obligations (Clause 4.5) |
Risk basis | Enterprise risk heat map or none | Compliance risk assessment tied to obligations and activities (Clause 4.6) |
Controls | Whatever exists, often undocumented | Controls and procedures designed against assessed risks (Clause 8.2) |
Accountability | Compliance officer “owns compliance” | Defined roles for governing body, top management, compliance function, managers and personnel (Clause 5.3) |
Measurement | Activity metrics | Indicators of compliance performance and control effectiveness (Clause 9.1.3) |
Board reporting | Annual presentation | Defined reporting criteria, content and escalation (Clause 9.1.4) |
Self-correction | Ad hoc, after incidents | Internal audit, management review, nonconformity and corrective action (Clauses 9.2, 9.3, 10.2) |
Evidence | Assembled for the audit | Generated by operating the system (Clause 7.5) |
1.3 Why the distinction matters beyond certification
Regulators and prosecutors in most major jurisdictions now assess compliance programmes by asking whether they are well designed, adequately resourced and working in practice. Those three questions are, in substance, the questions a management system is built to answer. An organisation that can show its obligations register, its risk assessment, its control testing and its management review decisions is in a materially stronger position when something goes wrong than one that can only show its policies. The introduction to ISO 37301 itself notes that courts in a number of jurisdictions have considered an organisation’s compliance management system when determining penalties, and that regulators and courts can use the standard as a benchmark.
THE PRACTICAL TEST Pick any control in your compliance programme. Can you name the obligation it exists to satisfy, the risk assessment entry that justified its design, the evidence that it operated last quarter, and the person who would be told if it failed? If not, it belongs to a programme, not a system. |
2. Where ISO 37301 and ISO 37001 Are the Same — and Where They Are Not
Organisations certified to ISO 37001 have already built roughly half of an ISO 37301 system. The harmonised structure means the governance, support, performance evaluation and improvement clauses carry over almost unchanged. The work lies in Clause 4 and Clause 8, where ISO 37301 is broader and less prescriptive.
Area | ISO 37001 (anti-bribery) | ISO 37301 (compliance) | What carries over |
|---|---|---|---|
Context and scope | Bribery-focused context | Context across all in-scope obligations | Method; broader content needed |
Obligations | Implicit in anti-bribery law | Explicit register of obligations (4.5) | Little — new build |
Risk assessment | Bribery risk assessment | Compliance risk assessment per obligation (4.6) | Methodology carries over fully |
Leadership and culture | Leadership, culture, policy | Leadership, culture, compliance governance (5.1) | Largely the same |
Compliance function | Anti-bribery compliance function | Compliance function with governance safeguards (5.1.3, 5.3.2) | Largely the same; wider remit |
Competence and training | Competence, HR due diligence, training | Competence, employment process, training (7.2) | Largely the same |
Controls | Many prescribed controls | Controls designed by the organisation (8.2) | Design discipline; content differs |
Raising concerns | Raising concerns | Raising concerns (8.3) | Same channel can serve both |
Investigations | Investigating and dealing with bribery | Investigation processes (8.4) | Same process can serve both |
Performance evaluation | Monitoring, audit, review | Adds feedback sources, indicators, compliance reporting (9.1) | Most carries over; reporting expands |
Improvement | Nonconformity, corrective action | Same (10) | Fully |
The practical consequence is that an organisation with a mature ISO 37001 system should not build ISO 37301 as a second, parallel system. It should extend the existing one: one leadership structure, one compliance function, one speak-up channel, one investigation process, one internal audit programme, one management review, and one nonconformity process, with anti-bribery treated as one domain inside a broader register of obligations.
INTEGRATION PRINCIPLE If your ISO 37301 implementation creates a second management review, a second internal audit programme or a second hotline, it is being built as a programme. Integrate first; add only what the broader scope genuinely requires. |
3. The Six Missing Connections
In Speeki’s experience auditing compliance and anti-bribery management systems, the organisations that struggle at certification rarely lack documents. They lack the connections between them. Six are missing far more often than any others.
3.1 Obligation to risk
The risk assessment is conducted without reference to a register of obligations, so it assesses broad categories — “regulatory risk”, “data protection risk” — rather than the risk of breaching specific obligations in specific activities. The result cannot be traced back to anything the organisation is actually required to do.
3.2 Risk to control
Controls exist, but nobody can show which risk each control was designed to address. Some high risks have no control; some low risks carry heavy controls inherited from a previous regime. The control set reflects history rather than the current risk profile.
3.3 Control to evidence
Controls are documented in procedures but generate no routine evidence of operation. When the auditor asks for proof that a control worked last quarter, the evidence has to be reconstructed.
3.4 Evidence to indicator
The organisation collects data, but its indicators measure compliance activity rather than compliance performance. Training completion of 98% says nothing about whether the obligations the training addresses are being met.
3.5 Indicator to decision
Compliance reports reach the board, but nothing changes as a result. Management review minutes record that reports were “noted”. ISO 37301 expects management review to produce decisions on improvement, changes to the system and resources.
3.6 Decision to change
Where decisions are made, there is no mechanism to confirm they were implemented and effective. Corrective actions are closed when the action is completed, not when the cause has been shown to be removed.
Missing connection | How it shows up in an audit | Clauses engaged |
|---|---|---|
Obligation to risk | Risk register cannot be reconciled to obligations register | 4.5, 4.6 |
Risk to control | High-rated risks with no mapped control; controls with no mapped risk | 4.6, 6.1, 8.2 |
Control to evidence | No records of control operation for the audit period | 7.5, 8.1, 9.1.5 |
Evidence to indicator | Indicators limited to training and policy counts | 9.1.1, 9.1.3 |
Indicator to decision | Management review outputs list no decisions or resources | 9.1.4, 9.3 |
Decision to change | Corrective actions closed without effectiveness verification | 10.1, 10.2 |
4. Clause-by-Clause: Programme Reality Against System Expectation
The table below maps the typical state of a mature compliance programme against what an ISO 37301 auditor expects to see. It is deliberately written from the auditor’s side of the table.
Clause | Typical programme state | What the auditor expects to see |
|---|---|---|
4.1–4.3 Context and scope | Scope assumed to be “the whole company”; no documented boundaries | A documented scope stating entities, activities and obligation domains covered, with justification for exclusions |
4.5 Obligations | A list of applicable laws maintained by legal | Obligations broken down to the requirement level, mapped to owners and processes, with a process for capturing change |
4.6 Risk assessment | Compliance appears as one line on the enterprise risk register | Risks of non-compliance assessed per obligation and activity, reviewed periodically and on material change |
5.1 Leadership and culture | Tone-from-the-top statements | Evidence that the governing body and top management direct, resource and oversee the system, and that culture is assessed |
5.1.3 Compliance governance | Compliance reports through legal or finance | Demonstrable direct access to the governing body, independence and authority for the compliance function |
5.2 Policy | A code of conduct | A compliance policy established by the governing body and top management that requires compliance with obligations, describes the compliance function, supports the governance principles, states the consequences of non-compliance, encourages raising concerns and prohibits retaliation |
6.2 Objectives | Objectives exist but are not monitored, measured or linked to the compliance policy | Objectives at relevant functions and levels, consistent with the policy, measurable where practicable, monitored and communicated, with plans stating what will be done, by whom, by when, with what resources and how results will be evaluated |
7.2 Competence | Training records | Defined competence requirements per role, evaluated, with action taken where gaps exist |
8.2 Controls | Policies and procedures | Controls designed against assessed risks, implemented, maintained, periodically reviewed and tested for continuing effectiveness |
8.3 Raising concerns | A hotline | A visible, accessible channel that treats reports confidentially, accepts anonymous reports, protects reporters from retaliation, offers advice, and shows evidence of use |
8.4 Investigations | Investigations by whoever is available | A defined process with fair and impartial decision-making, conducted independently by competent people without conflicts, with regular reporting of numbers and outcomes to the governing body or top management |
9.1 Monitoring | Activity metrics | Indicators, multiple sources of feedback, defined compliance reporting and record-keeping |
9.2 Internal audit | Internal audit occasionally covers compliance | An internal audit programme covering the CMS, weighted by the importance of the processes and the results of previous audits, conducted by objective and impartial auditors |
9.3 Management review | An annual compliance presentation | A review with defined inputs producing documented decisions |
10.2 Nonconformity | Actions tracked in a spreadsheet | Root-cause analysis, corrective action and verification of effectiveness |
5. Converting a Programme into a System
Conversion does not mean discarding what exists. Most of the components of a mature programme survive. What changes is the order in which they are justified and the evidence they produce. Speeki’s auditors see the most successful conversions follow a consistent sequence.
Define the scope deliberately. Decide which entities, activities and obligation domains are in scope. A narrower, well-defined scope operated rigorously is better than a sprawling one operated on paper. Paper 4 in this series addresses scoping in depth.
Build the obligations register. Decompose applicable laws, regulations, licences, contracts and voluntary commitments into specific requirements, and assign each to an owner and a process. Paper 2 addresses this.
Re-perform the risk assessment from the register. Assess the risk of breaching each obligation, at gross and net level, testing the controls you rely on. Paper 3 addresses this.
Map every existing control to a risk. Retire controls that address no current risk; design controls for risks that have none. Paper 6 addresses control design and indicators.
Fix the governance line. Confirm the compliance function’s authority, independence and direct access to the governing body, and define what the board will be told and when. Paper 5 addresses this.
Redesign measurement. Replace activity metrics with indicators of compliance performance and control effectiveness.
Run the self-correction loop at least once before certification. Complete an internal audit, a management review that produces decisions, and at least one root-cause-driven corrective action, so that the system has demonstrably operated.
TIMING REALITY Certification audits examine whether the system has operated, not whether it has been designed. An organisation needs enough operating history — typically several months — to show controls generating evidence, an internal audit completed and a management review held before a Stage 2 audit is meaningful. |
6. Common Failures
Organisations moving from a programme to a system fail in predictable ways. Most of them share a root cause: treating certification as a documentation project rather than a re-wiring of how compliance decisions are made.
Failure | Why it undermines the system | What a genuine system does instead |
|---|---|---|
Writing a CMS manual on top of the existing programme | The manual describes connections that do not exist in practice. Auditors test practice, and the gap between text and reality becomes the finding. | Builds the connections first (register, risk assessment, control mapping) and documents what is actually done. |
Treating the compliance function as the system | The system becomes dependent on a few individuals. Line management sees compliance as someone else’s job, contrary to the role allocation in Clause 5.3. | Allocates ownership of obligations, risks and controls to line roles, with the compliance function designing, overseeing and challenging. |
Certifying the programme’s strongest area and calling it the CMS | The scope statement claims more than the evidence supports, and surveillance audits expose it. | Sets an honest scope and expands it deliberately (see Paper 4). |
Measuring activity instead of performance | Training completion and hotline volumes show that things happen, not that obligations are met. | Uses indicators of control effectiveness and compliance outcomes, reported against defined thresholds. |
Running management review as a presentation | No decisions are recorded, so the system has no mechanism to change itself. | Records decisions, resources, changes to objectives and actions, and tracks them to closure. |
Closing nonconformities by fixing the instance | The same failure recurs in another business unit or obligation area. | Requires root cause analysis and checks whether the cause exists elsewhere before closing. |
7. What Speeki’s Auditors Look For
Certification against ISO 37301 is a substantive assessment, not a document review. Speeki’s auditors test whether the system exists by following threads through it.
7.1 Thread testing
The auditor selects a small number of obligations from the register and follows each one through the system: to the risk assessment entry, to the controls mapped against it, to the evidence of those controls operating, to the indicators that measure them, to the compliance reports that summarised them, and to the management review that considered them. A break anywhere in the thread is a finding.
7.2 Interview questions that distinguish a programme from a system
“How did you decide what to train this group of employees on?” — tests whether training is derived from risk.
“What changed in your controls after the last change in law that affected you?” — tests the obligations-change process.
“What did the board decide at the last management review?” — tests whether review produces decisions.
“How do you know this control worked last quarter?” — tests control evidence.
“Who would you tell if you found a serious compliance failure in this area, and how quickly?” — tests escalation and reporting.
7.3 Full-population testing
Where control evidence is held electronically, Speeki tests full populations rather than samples wherever practicable. A gifts register, a screening log or a regulatory-filing calendar can be tested end to end. This changes the nature of the audit: organisations cannot rely on a well-prepared sample, and genuine systems are recognised faster because their evidence is complete.
Conclusion
Every organisation that operates in a regulated environment has a compliance programme. Far fewer have a compliance management system. The difference is not the number of policies or the size of the compliance team. It is whether the components are connected so that obligations drive risk, risk drives controls, controls generate evidence, and evidence drives decisions.
ISO 37301 is valuable precisely because it forces those connections to be made and then has them independently tested. For organisations already certified to ISO 37001, much of the architecture is already in place; the task is to widen the register of obligations and let the existing system carry it. For organisations starting from a programme, the task is to rebuild from the obligation outwards.
The remaining papers in this series take each of the critical connections in turn: the obligations register, compliance risk assessment, scoping, governance and the compliance function, controls and indicators, and speak-up and investigations.
About Speeki
Speeki is an accredited certification body operating across more than 100 countries, providing ISO management system certification, ESG and sustainability assurance, and executive education. Speeki provides no consulting of any kind. Our independence is structural, not a promise.
Speeki delivers its audits through AI working alongside a body of experts. Nicole, Speeki’s AI team member, works with our auditors to test full populations of evidence rather than samples, so that certification reflects how a management system actually performs, not how it looks on the day of the audit.
To learn more, see ISO 37301 certification with Speeki.
Related Reading
Paper 2 — The Obligations Register Nobody Owns (ISO 37301 Clause 4.5)
Beyond Compliance: Understanding the Difference Between an ABAC Programme and ISO 37001
This whitepaper provides general information on ISO 37301:2021 and does not reproduce the text of the standard. Organisations should refer to the published standard for its exact requirements.