ISO 37301 and ISO 19011 explained: compliance and audit standards

ISO 37301 is the international standard for compliance management systems. ISO 19011 is the international guidance for auditing management systems. One tells an organization what a compliance system must include. The other explains how to audit it. This guide gives a plain definition of ISO 37301 first and then the practical detail, with a section on ISO 19011 and how the two fit together.

What is ISO 37301?

ISO 37301 is the international standard that sets out requirements for a compliance management system. It helps an organization identify its compliance obligations, manage the risk of breaching them and build a culture where compliance is part of normal work. ISO published it in 2021 and it replaced ISO 19600, which was guidance only.

ISO 37301 is a requirements standard, so an organization can be audited and certified against it. Certification is voluntary and is carried out by an accredited certification body.

Who ISO 37301 is for

• Organizations of any size, sector or type, including private companies, public bodies and non-profits
• Compliance and risk teams building or improving a compliance program
• Organizations that want to show customers, regulators or partners that their compliance system meets a recognized benchmark
• Teams that already use other ISO management system standards and want a consistent structure

What ISO 37301 requires

ISO 37301 follows the same high-level structure as other ISO management system standards, such as ISO 9001 and ISO 14001. That makes it easier to combine with systems an organization already runs.

Clause	Area	What it covers
4	Context of the organization	Understanding the organization, interested parties and the scope of the system, plus identifying compliance obligations and assessing compliance risks
5	Leadership	Board and top management commitment, a compliance policy, a compliance culture, and defined roles and responsibilities
6	Planning	Addressing risks and opportunities, setting compliance objectives and planning changes
7	Support	Resources, competence, awareness, communication and documented information
8	Operation	Operational controls, processes to meet obligations, and ways to raise concerns and investigate them
9	Performance evaluation	Monitoring, measurement, internal audit and management review
10	Improvement	Continual improvement and handling nonconformity and corrective action

Compliance obligations

A compliance obligation is a requirement the organization must meet or has chosen to meet. ISO 37301 separates these into two groups.

Type	Examples
Mandatory requirements	Laws, regulations, permits, licenses and court orders
Voluntary commitments	Contracts, industry codes, internal policies, ethical commitments and agreements with community groups

The standard expects the organization to keep these obligations current, link them to processes and owners and assess the risk of not meeting them. That is where many compliance programs struggle, because laws and rules change constantly.

Ideagen's regulatory compliance solution helps teams track regulatory updates and see which policies and processes they affect, which supports the work of keeping an obligations register up to date. People still decide how each requirement applies and what the organization commits to.

ISO 37301 and ISO 19600

Item	ISO 19600	ISO 37301
Type	Guidance	Requirements
Certifiable	No	Yes
Published	2014	2021
Status	Replaced by ISO 37301	Current

How to get started with ISO 37301

• Agree the scope: which entities, activities and locations the system will cover
• Gain top management commitment and name an owner for the compliance function
• List compliance obligations and assess the risk of not meeting each one
• Write or update a compliance policy and the procedures that support it
• Set objectives and controls linked to the highest risks
• Train staff and set up ways to raise concerns safely
• Monitor results, run internal audits and hold management reviews
• Fix findings and improve, then consider certification if it adds value

ISO issued Amendment 1 in 2024 to add climate change considerations to its management system standards, including ISO 37301. Check the current edition and amendments on the ISO site before using the standard for certification.

What is ISO 19011?

ISO 19011 is the international standard that gives guidance on auditing management systems. It explains how to plan and run an audit program, how to carry out individual audits and what competence auditors need. The current edition is ISO 19011:2018.

ISO 19011 gives guidance, not requirements, so organizations cannot be certified against it. It is used alongside requirements standards such as ISO 37301, ISO 9001, ISO 14001 and ISO 45001, and it supports internal audits, supplier audits and certification audits.

The principles of auditing in ISO 19011

Principle	What it means
Integrity	Auditors act ethically, honestly and competently
Fair presentation	Findings and reports are truthful and accurate
Due professional care	Auditors apply diligence and sound judgment
Confidentiality	Information is protected and not misused
Independence	Auditors are impartial and free from conflict of interest
Evidence-based approach	Conclusions rest on verifiable evidence
Risk-based approach	Audit effort focuses on what matters most

The audit process in ISO 19011

• Manage the audit program: set objectives, scope, resources and schedule across all audits
• Start the audit: agree the objectives, scope and criteria and choose the audit team
• Prepare: review documents and plan the audit work
• Conduct: hold an opening meeting, gather evidence, form findings and reach conclusions
• Report: prepare and distribute the audit report
• Complete: close the audit and keep the records
• Follow up: check that corrective actions were completed and worked

Auditor competence

ISO 19011 expects auditors to have knowledge of audit principles and methods, the management system and the sector, as well as personal behaviors such as ethics, observation and tact. It also covers how to evaluate auditors and keep their skills up to date. The 2018 edition added guidance on remote audits and on the risk-based approach.

Tips for applying ISO 19011

• Plan the audit program from risk, so higher-risk areas are audited more often
• Use clear audit criteria, such as the clauses of the standard and the organization's own procedures
• Collect evidence by sampling records, observing work and interviewing people
• Write findings so that each one links to a criterion and to evidence
• Agree actions with owners and due dates, then track them to closure
• Use trends across audits to find root causes

How ISO 37301 and ISO 19011 work together

Item	ISO 37301	ISO 19011
Purpose	Sets requirements for a compliance management system	Gives guidance on auditing management systems
Type	Requirements standard	Guidance standard
Certifiable	Yes	No
Typical user	Compliance and risk teams	Auditors and audit program managers
Link	Requires internal audit and management review of the system	Provides the method for carrying out those audits

ISO 37301 requires internal audits of the compliance management system at planned intervals. ISO 19011 gives a recognized method for running them. Audit findings should feed back into the obligations register, policies and controls. Keeping that register current is the ongoing job behind both standards, and Ideagen's regulatory compliance solution supports it by tracking regulatory change and showing the policies and processes it affects.

Frequently asked questions

What is ISO 37301 in simple terms?

It is the international standard for building and running a compliance management system, and organizations can be certified against it.

Is ISO 37301 mandatory?

No. It is voluntary. Laws and regulations may still require an organization to have compliance controls, and ISO 37301 is one way to organize and show them.

What is ISO 19011 in simple terms?

It is guidance on how to audit management systems, covering audit programs, audit steps and auditor competence.

Can an organization be certified to ISO 19011?

No. ISO 19011 is guidance, so there is no certification. It supports audits against standards that can be certified.

What replaced ISO 19600?

ISO 37301 replaced ISO 19600 in 2021. ISO 19600 was guidance only, while ISO 37301 sets requirements that can be audited and certified.