ISO 37301 compliance management system certification

What ISO 37301 certification covers

ISO 37301:2021 sets the requirements for a compliance management system. It replaced the earlier guidance standard ISO 19600 and, unlike it, can be certified. It applies to any organization that wants a structured way to meet its compliance obligations: the laws and regulations it must follow, and the voluntary commitments it has chosen, such as industry codes, customer requirements and its own policies.

The audit follows the chain from obligations to results. You identify your compliance obligations, assess the risk of failing to meet them, put controls and responsibilities in place, train people, monitor and report, investigate concerns and correct problems. Leadership commitment and a compliance culture run through all of it.

Compliance is wide. Depending on your business it can include competition law, data protection, sanctions and export control, anti-money laundering, consumer protection, product regulation, environmental permits and employment law. ISO 37301 does not tell you what the law says; it checks that you have a reliable system for knowing and meeting it.

• Stage 1 review of the compliance obligations register, risk assessment and documented system
• Stage 2 audit of controls, reporting, investigations and culture
• Certification decision and three-year certificate
• Listing on verify.eurotechcertification.com
• Yearly surveillance audits and recertification

Proportionality runs through the standard. A small company with a few clear obligations needs a lighter system than a regulated multinational, and the auditor judges the system against your size, risks and context, not against a fixed template.

Scope and how ISO 37301 fits with other standards

Some organizations certify their whole compliance programme; others start with the areas regulators or customers care about most. Either way, the scope on the certificate should make clear which parts of the organization and which compliance areas are covered.

ISO 37301 is often used as the umbrella for other systems. Anti-bribery under ISO 37001, information security under ISO/IEC 27001 and AI governance under ISO/IEC 42001 can all sit inside a wider compliance management system, sharing risk assessment, reporting channels, investigations and management review. Integrated audits save time and give leadership one view of compliance.

Much of the evidence is documentary and comes from interviews: registers, risk assessments, training records, reports to the board, investigation files. That suits online auditing well. For large or multi-country organizations, some interviews at key locations may be planned in person.

The auditor also looks at whether the compliance function has the authority, resources and access to the governing body that the standard expects.

Documented information should be proportionate too: a short, clear policy and procedures people actually read are worth more than a long manual nobody opens.

What drives the price

ISO 37301 certification with EUROTECH starts at $800. Audit time depends on the breadth of obligations and the size of the organization.

• Number of people in scope
• Number and complexity of compliance areas covered
• Regulated activities, such as financial services, healthcare or energy
• Countries and sites in scope
• Integration with ISO 37001, ISO 27001 or other systems

We confirm audit days and every fee in a written quote. A clear obligations register, mapped to owners and controls, is the document that most shortens the audit.

Organizations in heavily regulated sectors usually need more audit time, because the auditor samples more obligations and more evidence of monitoring in the areas regulators watch closely.