Compliance Management Foundations

Course overview

This advanced certificate equips experienced professionals to design, run and improve an organisation-wide compliance management system (CMS) that stands up to regulators, auditors and boards. It moves beyond rule-following to treat compliance as a managed business system: risk-based, embedded in operations, measured and continually improved.

The programme is built around ISO 37301:2021 (Compliance management systems) and draws on related frameworks, including the IIA Three Lines Model, COSO internal control and enterprise risk guidance, and ISO 37001 (anti-bribery). Learners work through the modules at their own pace, apply each topic to their own organisation through short workplace tasks, and finish with a structured self-assessment of their organisation's compliance management system.

Who it is for

• Compliance officers, managers and team leads seeking to formalise their practice

• Risk, internal audit, legal, HSE, quality and governance professionals who carry compliance responsibilities

• Operations and project managers in regulated sectors (energy, construction, manufacturing, finance, healthcare)

Entry level

At least three years' relevant work experience, or a foundation-level qualification in compliance, risk, audit or a related field.

Programme at a glance

Item

Detail

Level

Advanced certificate

Delivery

Fully self-paced online: video lessons, readings, case studies and downloadable templates

Structure

8 modules plus a final self-assessment activity

Assessment

Module knowledge checks, two applied case assignments and a final self-assessment

Completion

Finish all modules, score at least 60% on each knowledge check, and submit both assignments and the final self-assessment

Award

Advanced Certificate in Compliance Management

Learning outcomes

On successful completion, learners will be able to:

1. Critically evaluate the role of compliance in corporate governance, including the duties of the board, senior management and the compliance function.

2. Interpret the requirements of ISO 37301 and related frameworks, and apply them to design a CMS fit for their organisation's size, sector and risk profile.

3. Identify and maintain a register of compliance obligations drawn from laws, regulations, licences, contracts and voluntary commitments.

4. Conduct a compliance risk assessment, rating likelihood and impact, and prioritise controls proportionate to the risks.

5. Design and evaluate preventive, detective and corrective controls, including policies, procedures, third-party due diligence and segregation of duties.

6. Develop a compliance culture strategy covering leadership tone, training, communication, incentives and speak-up arrangements.

7. Plan and oversee compliance monitoring, testing and internal audit, and select meaningful key performance and key risk indicators.

8. Manage breaches, investigations and regulatory engagement, including root-cause analysis, remediation and self-reporting decisions.

9. Assess the impact of emerging areas such as data protection, ESG reporting, sanctions and the use of technology and AI in compliance (RegTech).

10. Produce and present a board-ready compliance report and a CMS improvement plan with clear priorities, owners and timelines.

Course outline

The programme has eight self-paced modules, each closing with a knowledge check and a workplace task that feeds into the final self-assessment. LO numbers refer to the learning outcomes above.

Module 1: Compliance, governance and accountability (LO 1)

• Compliance versus ethics, integrity and legal risk

• Governance roles: board, senior management, compliance function, line managers

• The Three Lines Model and how compliance relates to risk and internal audit

• Independence, authority and reporting lines of the compliance officer

• Personal and corporate liability; the cost of compliance failure

• Task: map compliance roles and reporting lines in your organisation

Module 2: Designing a compliance management system (LO 2)

• Structure of ISO 37301: context, leadership, planning, support, operation, evaluation, improvement

• Determining scope and understanding the organisation's context and stakeholders

• Compliance policy and objectives

• Integrating the CMS with ISO 9001, 14001, 45001 and 37001 systems

• Certification versus self-assessment

• Task: gap analysis of your current arrangements against ISO 37301

Module 3: Compliance obligations and risk assessment (LO 3, 4)

• Sources of obligations: legislation, regulators, permits, contracts, codes, voluntary commitments

• Building and maintaining an obligations register; horizon scanning for regulatory change

• Compliance risk assessment methods: inherent and residual risk, likelihood and impact scales

• Risk appetite and tolerance for compliance risk

• Linking compliance risk to the enterprise risk register

• Case assignment 1: compliance risk assessment for a selected business unit

Module 4: Controls, policies and third-party risk (LO 5)

• Control design: preventive, detective and corrective; manual and automated

• Writing effective policies and procedures; policy lifecycle management

• Third-party and supply-chain due diligence: agents, contractors, joint ventures

• Key risk areas: anti-bribery and corruption, conflicts of interest, gifts and hospitality, fraud, competition law, sanctions and export controls

• Documentation and record-keeping that evidences compliance

• Task: design a control set for one high-rated compliance risk

Module 5: Compliance culture, training and speak-up (LO 6)

• Tone at the top and in the middle; leadership behaviours that shape culture

• Measuring compliance culture: surveys, indicators, behavioural signals

• Risk-based training needs analysis and training design

• Communication campaigns and embedding compliance in performance and incentives

• Whistleblowing and speak-up systems; protection against retaliation

• Task: draft a 12-month culture and training plan

Module 6: Monitoring, testing and reporting (LO 7, 10)

• Compliance monitoring plans and control testing

• Working with internal audit and external assurance providers

• KPIs and KRIs: choosing indicators that show effectiveness, not just activity

• Compliance dashboards and board reporting

• Management review and continual improvement

• Case assignment 2: produce a quarterly compliance report for the board

Module 7: Breaches, investigations and regulators (LO 8)

• Identifying, logging and escalating compliance breaches

• Planning and conducting internal investigations; evidence and interviews

• Root-cause analysis and corrective action

• Regulatory inspections, enforcement and self-reporting decisions

• Crisis communication and remediation programmes

Module 8: Emerging issues and the future of compliance (LO 9)

• Data protection and privacy compliance

• ESG, sustainability reporting and human-rights due diligence

• RegTech, data analytics and AI in compliance monitoring

• Compliance risks of AI and automated decision-making

• Building a compliance function that scales across regions and jurisdictions

Final self-assessment: CMS maturity review (LO 1–10)

Learners assess their own organisation (or a provided case organisation) using a structured self-assessment workbook, then turn the results into a short improvement summary.

1. Rate each CMS element on a five-level maturity scale (1 Initial, 2 Developing, 3 Defined, 4 Managed, 5 Optimised):

   • Governance, leadership and accountability

   • Compliance obligations register

   • Compliance risk assessment

   • Controls, policies and third-party management

   • Culture, training and speak-up

   • Monitoring, testing and reporting

   • Breach management and investigations

   • Readiness for emerging risks

2. Record the evidence behind each rating, such as documents, records or observed practice.

3. Identify the five most significant gaps, ranked by compliance risk.

4. Set an improvement action for each gap, with an owner and target date.

5. Reflect on personal competence against the ten learning outcomes and note development priorities.