Your cart is empty.
Keep shopping
Teach on Udemy
Turn what you know into an opportunity and reach millions around the world.
Learn MoreISO 37301:2021 Compliance Management Systems
ISO 37301:2021 Compliance Management Systems
Master the global standard for compliance management — from Clause 4 context to Clause 10 improvement and certification
Role Play
Created byISO Horizon
Last updated 6/2026
English
What you'll learn
- Apply every clause of ISO 37301:2021 from context (Clause 4) through improvement (Clause 10)
- Build a compliance obligations register and conduct a defensible compliance risk assessment
- Design a compliance function with the independence, authority, and reporting lines ISO 37301 demands
- Establish good faith reporting channels with strong non-retaliation protections
- Run credible investigations that withstand regulatory and legal scrutiny
- Implement risk-based third-party due diligence across vendors, distributors, and intermediaries
- Prepare for Stage 1 and Stage 2 certification audits and manage surveillance cycles
- Integrate ISO 37301 with ISO 37001 anti-bribery and other management system standards
- Transition cleanly from ISO 19600 guidance to ISO 37301 certifiable requirements
- Foster a measurable culture of compliance using behavioral science and culture metrics
Explore related topics
Course content
24 sections • 33 lectures
- What Is ISO 37301 and Why It Matters9:46This lecture introduces ISO 37301:2021, the international standard for compliance management systems (CMS), published by ISO in April 2021. The student will learn what a CMS actually is, why ISO 37301 is classified as a Type A management system standard (meaning organizations can be certified against it), and how it provides a structured, auditable framework for identifying, preventing, detecting, and responding to compliance failures. The lecture explains the business case for adopting ISO 37301, including reduced regulatory enforcement risk, demonstrable due diligence, improved organizational reputation, lower insurance costs, and tangible signals to regulators, investors, and customers. It also positions compliance not as a cost center but as a value driver and explores the surge in demand for certified CMS programs across financial services, healthcare, energy, manufacturing, and the public sector.
- From ISO 19600 to ISO 37301: The Evolution8:57This lecture traces the lineage from ISO 19600:2014, the original guidance standard for compliance management systems, to its successor ISO 37301:2021. The student will learn why ISO 19600 was deliberately written as a non-certifiable guidance document, why the market demanded a certifiable equivalent, and what concrete changes the technical committee introduced when upgrading it. Topics include the migration to the Harmonized Structure (formerly the High-Level Structure) used across all modern ISO management system standards, the addition of normative shall-clauses that make certification possible, expanded requirements around the independence and authority of the compliance function, sharper expectations on raising concerns and non-retaliation, and stronger language on compliance culture. The lecture also discusses what organizations already aligned with ISO 19600 must do to transition cleanly to ISO 37301.
- Core Principles of an Effective Compliance Management System9:54This lecture unpacks the principles that underpin every clause of ISO 37301: integrity, good governance, proportionality, transparency, accountability, and sustainability. The student will learn how these principles translate into design choices for a real CMS, including risk-based prioritization, the segregation of duties, the tone from the top, the freedom to raise concerns without fear, and the commitment to continual improvement through the Plan-Do-Check-Act cycle. The lecture grounds each principle in recognizable scenarios, such as how proportionality means a small nonprofit and a global bank can both achieve certification with very differently scaled systems, and how accountability is operationalized through documented roles, escalation paths, and board-level oversight. It also previews how each principle reappears throughout Clauses 4 through 10.
- ISO 37301 and ISO 37001: How They Work Together10:11This lecture clarifies the relationship between ISO 37301 (compliance management systems) and ISO 37001:2016 (anti-bribery management systems), two standards that are often confused or treated as alternatives. The student will learn that ISO 37301 is the broad umbrella covering all compliance obligations an organization faces, while ISO 37001 is a deep, specialized standard focused exclusively on bribery risk. The lecture explains how the two share the same Harmonized Structure, making integration straightforward, and how an organization with mature ISO 37301 processes can layer ISO 37001 controls on top to address bribery-specific risks such as facilitation payments, gifts and hospitality, and third-party intermediaries. It also covers when to certify against one, the other, or both, and how regulators and prosecutors view each.
- Section 1 Quiz: Foundations of ISO 37301:2021
- Roleplay: Foundations of ISO 37301:2021
- Understanding the Organization and Its Context (4.1)9:10This lecture examines Clause 4.1 of ISO 37301, which requires organizations to determine the external and internal issues relevant to their purpose and that affect their ability to achieve the intended outcomes of the CMS. The student will learn practical techniques for environmental scanning, including PESTLE analysis applied to compliance (political shifts, evolving regulatory expectations, social pressure around ESG, technological disruption such as AI regulation, legal frameworks, and environmental obligations). The lecture explains how to map internal issues such as organizational structure, culture, capabilities, contractual relationships, and historical incidents, and how to document this context analysis in a way that auditors will accept. Examples include a fintech grappling with sandbox regulations and a manufacturer adjusting to extended producer responsibility laws.
- Interested Parties and Stakeholder Expectations (4.2)10:13This lecture covers Clause 4.2, which requires organizations to identify the interested parties relevant to the CMS and determine which of their requirements will be addressed through compliance processes. The student will learn how to build a comprehensive stakeholder map covering regulators, customers, employees, shareholders, communities, suppliers, NGOs, courts, and industry bodies. The lecture distinguishes between mandatory requirements (laws, regulations, permits, court orders, binding contracts) and voluntary commitments (codes of conduct, industry standards, public pledges, ESG commitments) and explains why ISO 37301 treats both as part of the compliance universe once adopted. It introduces stakeholder prioritization tools such as power-interest grids and shows how stakeholder expectations feed directly into compliance obligations identification.
- Determining the Scope of the CMS (4.3 and 4.4)9:06This lecture explains Clauses 4.3 and 4.4, which require organizations to define the boundaries and applicability of their compliance management system and to establish, implement, maintain and continually improve it. The student will learn how scope decisions cover legal entities, geographies, business lines, processes, and types of compliance obligations, and why a deliberately narrow but well-implemented scope is usually preferable to an aspirational but unenforceable one. The lecture covers how to document scope statements that withstand auditor scrutiny, the justifications required when something is excluded, and the relationship between scope and the certificate of conformity an organization eventually receives. Examples include multinationals scoping by region and conglomerates scoping by business unit.
- Identifying Compliance Obligations (4.5)9:41This lecture focuses on Clause 4.5, the heart of any CMS, which requires organizations to systematically identify, analyze, and access their compliance obligations and to translate them into requirements. The student will learn how to build and maintain a compliance obligations register that captures statutes, regulations, permits, judicial decisions, contracts, codes of conduct, internal policies, and voluntary commitments. The lecture covers sourcing strategies including subscription regulatory intelligence services, in-house legal monitoring, trade association alerts, and government bulletins. It also explains how obligations must be cascaded to process owners with clear ownership, evidence of analysis, and triggers for re-assessment when laws change, and shows how a well-maintained register becomes the single source of truth for the entire compliance program.
- Compliance Risk Assessment (4.6)10:02This lecture covers Clause 4.6, which requires organizations to conduct a systematic compliance risk assessment that identifies, analyzes, and evaluates compliance risks arising from the obligations identified under 4.5. The student will learn how to apply inherent risk versus residual risk thinking, how to score risks using likelihood and impact criteria tailored to compliance consequences (fines, license loss, criminal prosecution, debarment, reputational harm), and how to use heat maps, risk registers, and qualitative narratives. The lecture explains why this assessment must be repeated at planned intervals and when significant changes occur, how it feeds directly into Clause 8 control design, and how to avoid the common trap of producing a risk register that nobody actually uses to make decisions.
- Section 2 Quiz: Context of the Organization (Clause 4)
- Roleplay: Context of the Organization (Clause 4)
- Leadership Commitment and Governance (5.1.1)7:13This lecture examines Clause 5.1.1, which assigns specific compliance leadership responsibilities to the governing body and top management. The student will learn what ISO 37301 expects from boards of directors, audit committees, and executive teams, including approving the compliance policy, providing adequate resources, ensuring the CMS is integrated into business processes, and holding management accountable for compliance outcomes. The lecture distinguishes the role of the governing body (oversight, challenge, and strategic direction) from that of top management (operational accountability and resource allocation) and explains why ISO 37301 places such a strong emphasis on documented evidence of leadership engagement. Examples include board compliance dashboards, executive compensation tied to compliance KPIs, and visible tone-from-the-top communications.
- Building a Compliance Culture (5.1.2)7:55This lecture explores Clause 5.1.2, which uniquely requires organizations to actively foster a culture of compliance throughout the organization. The student will learn that compliance culture is more than posters and slogans, encompassing the shared values, beliefs, and behaviors that determine how people act when nobody is watching. The lecture covers the drivers of culture identified by behavioral science and compliance research, including leadership behavior, peer norms, incentive structures, the perceived legitimacy of rules, and psychological safety. It introduces measurement techniques such as culture surveys, ethical climate assessments, exit interview analysis, and speak-up rate benchmarking, and explains how auditors will probe for evidence that culture is being measured and improved rather than merely asserted.
- The Compliance Policy (5.2)8:48This lecture covers Clause 5.2, which requires top management to establish, implement, and maintain a compliance policy that is appropriate to the purpose of the organization. The student will learn the mandatory ingredients ISO 37301 specifies, including a commitment to satisfying applicable compliance obligations, a commitment to continual improvement of the CMS, support for raising concerns in good faith, prohibition of retaliation, and the consequences of non-compliance. The lecture explains how the policy must be communicated within the organization and made available to interested parties, how it should be reviewed periodically, and how it sits at the top of a documented policy hierarchy that cascades down to procedures and work instructions. Examples of strong and weak policy language are contrasted.
- The Compliance Function: Independence, Authority, Reporting Lines (5.3.2)12:04This lecture focuses on Clause 5.3.3, which establishes the compliance function as a defining feature of an ISO 37301-conforming CMS. The student will learn the standard's specific requirements that the compliance function must have appropriate authority, adequate resources, direct access to the governing body, and sufficient independence to perform its role objectively. The lecture explores common reporting line structures (solid line to the CEO with dotted line to the audit committee, or solid line to the general counsel, or directly to the board), the trade-offs of each, and why ISO 37301 demands that the compliance officer can escalate concerns without obstruction. It also covers safeguards against improper influence, including protections around appointment, removal, and remuneration of the Chief Compliance Officer.
- Roles and Responsibilities Across the Organization (5.3)9:10This lecture examines the full sweep of Clause 5.3, which allocates compliance responsibilities not just to the compliance function but to the governing body, top management, line management, and every employee. The student will learn how to apply the three-lines model in a compliance context, with business operations as the first line owning compliance risk in their processes, the compliance function as the second line setting standards and providing oversight, and internal audit as the third line providing independent assurance. The lecture covers how to document responsibilities in role descriptions, RACI matrices, and policy documents, and how to avoid the common failure mode where compliance is treated as someone else's job. Practical examples illustrate handovers between lines.
- Actions to Address Risks and Opportunities (6.1)7:38This lecture covers Clause 6.1, which requires organizations to plan actions to address the compliance risks and opportunities identified in Clause 4.6 and to integrate those actions into business processes. The student will learn the four classic risk treatment options (avoid, reduce, share, accept) applied through a compliance lens, with concrete examples of each, such as exiting a high-risk jurisdiction (avoid), implementing enhanced controls (reduce), procuring directors and officers insurance (share), and formally accepting low residual risks at the appropriate authority level. The lecture explains how to document treatment decisions, assign owners, set deadlines, and verify effectiveness, and how this clause links Clause 4 risk identification to Clause 8 operational controls.
- Compliance Objectives and Planning of Changes (6.2 and 6.3)10:09This lecture covers Clauses 6.2 and 6.3, which require organizations to establish measurable compliance objectives and to plan changes to the CMS in a controlled manner. The student will learn how to write SMART compliance objectives that are specific, measurable, achievable, relevant, and time-bound, with examples spanning training completion rates, time to remediate findings, third-party due diligence coverage, and reduction in repeat issues. The lecture explains how objectives must be aligned with the compliance policy and consistent with strategic business goals, and how Clause 6.3 requires changes to the CMS (such as restructures, new product launches, or M&A activity) to be evaluated for compliance impact before implementation rather than reactively after problems emerge.
- Section 3 Quiz: Leadership and Planning (Clauses 5 and 6)
- Roleplay: Leadership and Planning (Clauses 5 and 6)
- Resources for the Compliance Management System (7.1)9:36This lecture examines Clause 7.1, which requires organizations to determine and provide the resources needed for the establishment, implementation, maintenance, and continual improvement of the CMS. The student will learn that resources span far more than headcount, including budget, technology platforms, external advisors, training capacity, and time allocation from business stakeholders. The lecture covers benchmarking approaches to size a compliance function appropriately for an organization's risk profile, common warning signs of under-resourcing (chronic backlogs, delayed investigations, missed regulatory deadlines), and how to make the business case for additional resources using risk-adjusted metrics. It also discusses how technology investments in case management, regulatory intelligence, and analytics multiply the effectiveness of human resources.
- Competence of Personnel (7.2)8:56This lecture covers Clause 7.2, which requires organizations to determine the necessary competence of persons doing work that affects compliance performance and to ensure they are competent on the basis of appropriate education, training, or experience. The student will learn how to build competency frameworks for the compliance function itself (including knowledge of relevant laws, investigative skills, risk assessment techniques, and stakeholder management) and for business roles with compliance touchpoints (such as procurement teams handling third-party due diligence). The lecture explains how to evidence competence through certifications, training records, and performance reviews, and how to close competence gaps through targeted development plans rather than generic e-learning rollouts.
- Awareness and Training (7.3)8:00This lecture explores Clause 7.3, which requires organizations to ensure that persons doing work under the organization's control are aware of the compliance policy, their contribution to the effectiveness of the CMS, the implications of not conforming with compliance obligations, and how to raise concerns. The student will learn modern approaches to compliance training that move beyond annual tick-box e-learning, including microlearning, scenario-based simulations, role-specific training paths, and just-in-time reminders embedded in business workflows. The lecture covers how to measure training effectiveness using knowledge assessments, behavior change indicators, and incident trend analysis, and how to document training in a way that satisfies both auditors and regulators in the event of an enforcement matter.
- Internal and External Communication (7.4)9:36This lecture covers Clause 7.4, which requires organizations to determine the internal and external communications relevant to the CMS, including what, when, with whom, and how to communicate. The student will learn how to design a layered communication strategy spanning routine awareness messages, urgent regulatory updates, incident notifications, board reporting, and external disclosures to regulators and the public. The lecture introduces the specific ISO 37301 expectations around making the compliance policy publicly available, the channels for raising concerns, and the protection of confidentiality. It also explores how communication must work in both directions, with bottom-up channels carrying intelligence about emerging risks back to leadership rather than only top-down cascades of policies.
- Documented Information (7.5)8:47This lecture focuses on Clause 7.5, which sets the rules for creating, updating, and controlling documented information across the CMS. The student will learn the distinction ISO 37301 draws between documents (policies, procedures, work instructions that prescribe what should happen) and records (evidence that prescribed things actually happened), and why both are essential for certification. The lecture covers document control disciplines including version control, approval workflows, distribution control, retention schedules, and protection from loss or unauthorized changes. It addresses the practical realities of digital document management systems, the risks of shadow procedures living in personal drives, and how to right-size documentation so that it supports rather than smothers the people who must use it.
- Section 4 Quiz: Support (Clause 7)
- Roleplay: Support (Clause 7)
- Operational Planning and Control (8.1)8:07This lecture covers Clause 8.1, which requires organizations to plan, implement, and control the processes needed to meet the requirements of the CMS and to address the risks and opportunities identified in Clause 6.1. The student will learn how to translate compliance obligations into operational processes that are owned by business units, embedded in day-to-day workflows, and supported by appropriate controls. The lecture introduces process mapping techniques, the SIPOC framework (Suppliers, Inputs, Process, Outputs, Customers) applied to compliance, and how to identify control points where compliance risks materialize. It also covers control of outsourced processes, recognizing that ISO 37301 makes the organization accountable for compliance even when activities are performed by third parties.
- Establishing Controls and Procedures (8.2)9:11This lecture explores Clause 8.2, which requires organizations to establish, implement, and maintain controls and procedures to manage their compliance obligations and the associated compliance risks. The student will learn the taxonomy of control types (preventive, detective, corrective; manual versus automated; first-line versus second-line) and how to select control mixes that match risk profiles efficiently. The lecture covers control design principles such as segregation of duties, four-eyes review, system-enforced approvals, exception reporting, and reconciliation, with examples drawn from sanctions screening, gifts and hospitality approvals, conflict of interest disclosure, and trade compliance. It also discusses how to evidence control operation for auditors and how to identify when controls have become stale or circumvented.
- Raising Concerns: Good Faith Reporting and Non-Retaliation (8.3)10:01This lecture focuses on Clause 8.3, which requires organizations to establish, implement, and maintain processes for raising concerns about suspected or actual non-compliance, ensuring confidentiality, allowing anonymous reporting where legally permitted, and prohibiting retaliation against good faith reporters. The student will learn how to design speak-up channels that people will actually use, including hotlines, web portals, ombudsperson schemes, manager escalation, and direct access to the compliance function. The lecture explains the legal landscape around whistleblower protection (such as the EU Whistleblowing Directive, the Sarbanes-Oxley Act, and the Dodd-Frank Act) and how ISO 37301 layers organizational commitments on top of legal minimums. It also covers retaliation prevention, monitoring, and the cultural conditions needed for trust in the reporting system.
- Investigation Processes (8.4)13:20This lecture covers Clause 8.4, which requires organizations to establish processes for assessing and investigating reports of suspected or actual non-compliance and for taking appropriate action based on the findings. The student will learn the anatomy of a credible compliance investigation, including intake and triage, conflict-of-interest screening of investigators, evidence preservation, interview protocols, privilege considerations, documentation standards, and reporting of findings to appropriate decision-makers. The lecture covers the principles of fairness, proportionality, and independence that auditors look for, the trade-offs between in-house and external investigators, and the disciplines around closing out investigations with remediation actions, lessons learned, and feedback to the reporter where appropriate. It also addresses the data protection and employment law constraints that shape investigations across jurisdictions.
- Third-Party Due Diligence9:51This lecture addresses third-party due diligence, a critical operational control area that ISO 37301 expects organizations to address through their Clause 8 processes given that a significant share of compliance failures originate with intermediaries, suppliers, distributors, joint venture partners, and agents. The student will learn how to design a risk-based due diligence program that segments third parties by risk tier and applies proportionate scrutiny, ranging from basic screening for low-risk vendors to enhanced due diligence with on-site visits and beneficial ownership analysis for high-risk intermediaries in high-risk geographies. The lecture covers ongoing monitoring, contractual safeguards such as audit rights and compliance representations, red flag identification, and the integration of third-party risk into procurement, onboarding, and renewal workflows.
- Section 5 Quiz: Operation (Clause 8)
- Roleplay: Operation (Clause 8)
- Monitoring, Measurement and Compliance Reporting (9.1)9:57This lecture covers Clause 9.1, which requires organizations to determine what needs to be monitored and measured, the methods for doing so, when results will be analyzed, and how compliance performance will be reported. The student will learn how to design a balanced set of compliance metrics combining leading indicators (training completion, risk assessment coverage, control testing pass rates, speak-up volume) with lagging indicators (incidents, regulatory findings, sanctions, litigation outcomes). The lecture introduces compliance reporting practices including periodic dashboards, escalation protocols, board reports under Clause 9.1.5, and external reporting to regulators where required. It also covers the principle that what gets measured gets managed and the pitfall of metrics that drive perverse behaviors such as suppressing reports.
- Internal Audit (9.2)11:35This lecture explores Clause 9.2, which requires organizations to conduct internal audits at planned intervals to provide information on whether the CMS conforms to the organization's own requirements and to the requirements of ISO 37301, and whether it is effectively implemented and maintained. The student will learn how to build a risk-based internal audit program, the importance of auditor independence and competence, audit planning, fieldwork techniques, the writing of clear findings with root cause analysis, and the management response process. The lecture distinguishes internal audit of the CMS from external certification audit and from compliance monitoring activities, and explains how to use internal audit results as critical input to management review and continual improvement.
- Management Review (9.3)7:40This lecture covers Clause 9.3, which requires top management to review the CMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness. The student will learn the mandatory inputs ISO 37301 specifies for management review, including the status of actions from previous reviews, changes in external and internal issues, compliance performance information, audit results, non-conformities, opportunities for improvement, and adequacy of resources. The lecture covers the required outputs, including decisions related to continual improvement opportunities, any need for changes to the CMS, and resource needs. It addresses how to structure management review meetings to be genuinely strategic rather than procedural, the documentation that auditors will examine, and the cadence that suits different organizational scales.
- Continual Improvement and Corrective Action (10.1 and 10.2)14:01This lecture covers Clause 10, which requires organizations to continually improve the suitability, adequacy, and effectiveness of the CMS (10.1) and to react to non-conformities by taking action to control and correct them, evaluating the need for action to eliminate causes, and reviewing the effectiveness of any corrective actions taken (10.2). The student will learn the discipline of root cause analysis using techniques such as the Five Whys, fishbone diagrams, and bow-tie analysis applied to compliance failures, and how to distinguish symptoms from underlying causes such as cultural drift, control design weaknesses, or resource gaps. The lecture explains how to build a continual improvement engine that learns from incidents, near-misses, audit findings, and external benchmarks rather than treating each issue in isolation.
- The Certification Audit Process13:42This lecture walks through the end-to-end certification audit process under ISO 37301, from selecting an accredited certification body through Stage 1 documentation review, Stage 2 on-site implementation audit, surveillance audits, and the three-year recertification cycle. The student will learn what auditors actually look for at each stage, how to prepare evidence packs aligned to each clause, the categories of audit findings (major non-conformity, minor non-conformity, opportunity for improvement, observation) and their consequences, and how to manage corrective action plans within required timelines. The lecture also covers the role of accreditation bodies such as the IAF, how to verify a certification body's credentials, and the difference between certification of the CMS and certification of individuals.
- Common Pitfalls and Success Factors in CMS Implementation8:12This lecture distills the recurring failure modes and the proven success patterns observed across ISO 37301 implementations. The student will learn the traps that derail projects, including treating ISO 37301 as a documentation exercise rather than a behavior change effort, building a CMS that satisfies auditors but does not actually reduce compliance risk, under-resourcing the compliance function while over-promising on scope, neglecting the cultural dimensions of Clause 5.1.2, and allowing the compliance obligations register and risk assessment to go stale. The lecture also covers success factors such as visible executive sponsorship, integration with existing management systems, phased scope expansion, investment in technology, and the cultivation of compliance champions in business units.
- Building a Sustainable Compliance Management System9:58This concluding lecture looks beyond initial certification to the question of how to build a CMS that delivers value year after year as the business, regulatory environment, and stakeholder expectations evolve. The student will learn how to use compliance maturity models to chart a multi-year improvement journey from reactive to managed to proactive to integrated and ultimately to optimized. The lecture covers strategies for integrating ISO 37301 with adjacent management systems such as ISO 37001 (anti-bribery), ISO 27001 (information security), ISO 9001 (quality), and ISO 14001 (environmental) to avoid duplicate effort, and explores emerging trends shaping the future of compliance including AI-assisted regulatory intelligence, real-time controls monitoring, and ESG-driven compliance obligations. It closes with a vision of compliance as a strategic capability and source of competitive advantage.
- Section 6 Quiz: Performance Evaluation, Improvement, and Certification
- Roleplay: Performance Evaluation, Improvement, and Certification
Requirements
- Basic familiarity with corporate governance or organizational risk management concepts
- General awareness of regulatory or legal obligations applicable to organizations
- No prior knowledge of ISO standards or the Harmonized Structure required
- Working English comprehension to follow regulatory terminology and definitions
- Access to your organization's policies or compliance program documents will help you apply the concepts
Description
This course contains the use of artificial intelligence.
Regulatory pressure is at an all-time high, enforcement penalties are climbing into the billions, and stakeholders from boards to investors to employees expect organizations to demonstrate that compliance is more than a slogan. ISO 37301:2021 has emerged as the global benchmark for compliance management systems, replacing the earlier guidance-only ISO 19600 with a certifiable Type A standard that regulators, prosecutors, customers, and insurers increasingly recognize as credible evidence of good faith compliance efforts. Whether you are building a compliance program from scratch, modernizing a legacy framework, or preparing for certification, fluency in ISO 37301 has become an indispensable skill for compliance professionals.
This course provides comprehensive, clause-by-clause coverage of ISO 37301:2021, walking you through every requirement from the context of the organization (Clause 4) through leadership and the compliance function (Clause 5), planning and compliance risk assessment (Clause 6), support including competence, awareness, communication and documented information (Clause 7), operation including controls, raising concerns, investigations, and third-party due diligence (Clause 8), performance evaluation through monitoring, internal audit, and management review (Clause 9), and continual improvement (Clause 10). You will learn how to identify compliance obligations, design risk-based controls, build a credible speak-up culture with non-retaliation protections, conduct fair investigations, and prepare for the formal certification audit process.
This course is built for compliance officers, ethics and compliance managers, legal counsel, internal auditors, risk professionals, governance specialists, and anyone tasked with implementing or auditing a compliance management system. You will gain practical understanding of the relationship between ISO 37301 and ISO 37001 anti-bribery, the transition from ISO 19600, and how to integrate compliance with adjacent management systems. By the end you will be equipped to design, implement, monitor, and continually improve a CMS that withstands regulatory scrutiny and certification audits.
What makes this course different is its uncompromising focus on the actual text of ISO 37301 paired with the practical implementation wisdom regulators and certification auditors expect to see. Every lecture maps directly to a clause or topic the standard requires, and every concept is grounded in concrete examples drawn from regulated industries. Enroll now to gain the structured knowledge you need to lead compliance with confidence.
Who this course is for:
- Compliance officers and chief compliance officers building or maturing a CMS
- Ethics and compliance managers preparing for ISO 37301 certification
- Legal counsel and regulatory affairs professionals advising on compliance frameworks
- Internal auditors and risk professionals assessing compliance management systems
- Governance professionals and board members overseeing compliance and ethics programs