ISO 37301 Compliance Management Systems Training

Welcome and Programme Overview

Introduction to the session, objectives, and housekeeping.

Why ISO 37301, and What Changed

The move from ISO 19600:2014 guidance to a certifiable Type A requirements standard, and what that changes in practice. The Annex SL high level structure shared with ISO 9001, ISO 14001, ISO 27001 and ISO 37001, and why that makes integration with existing management systems straightforward. How ISO 37301 relates to ISO 37001 anti-bribery: overlapping architecture, different scope.

Break

Clause 4: Context, Interested Parties and Scope

Determining internal and external issues, identifying interested parties and their requirements, and defining the boundaries of the compliance management system. Building the compliance obligations register: statutes and regulations, licences and permits, regulator guidelines, contractual commitments, industry codes and voluntary commitments. Distinguishing obligations the organisation must meet from commitments it has chosen to make, and why both belong in the register.

Clause 5: Leadership, Governance and the Compliance Function

What the standard requires of the governing body as distinct from top management. The compliance policy, the compliance function's authority, independence and direct access to the governing body, and adequate resourcing. Roles and responsibilities across the organisation, and the governance principles the standard sets out including integrity, transparency, accountability and sustainability.

Lunch

Clause 6: Compliance Risk Assessment and Objectives

Identifying compliance risks against each obligation, analysing likelihood and consequence, and evaluating against defined criteria. Setting compliance objectives that are measurable and assigned, planning to achieve them, and managing planned changes to the system. Where compliance risk assessment differs from enterprise risk assessment and where the two should connect.

Break

Clause 7: Support

Resources, competence and the evidence an auditor expects that people are actually competent rather than merely trained. Awareness, internal and external communication, and control of documented information including version control, retention and access. Practical guidance on the document set a certification auditor will ask for.

Clause 8: Operation

Operational planning and control, establishing controls and procedures proportionate to assessed risk, and embedding compliance into business processes rather than bolting it on. Raising concerns and whistleblowing channels, protection from retaliation, and investigation processes. Day 1 wrap-up.

Recap and Day 2 Objectives

Review of the clause requirements covered on Day 1 and the plan for the workshop day.

Clause 9: Performance Evaluation

Monitoring, measurement, analysis and evaluation, and choosing compliance indicators that reveal something rather than confirm what you hoped. The internal audit programme: scope, auditor competence and independence, and audit planning. Management review inputs and outputs, and reporting to the governing body in a form it can act on.

Break

Clause 10: Nonconformity and Continual Improvement

Handling nonconformity and noncompliance, correction against corrective action, root cause analysis that goes past the immediate failure, and demonstrating continual improvement to an auditor.

Workshop: Building a Compliance Obligations Register

Participants build a register for their own function: identifying obligations from source, recording the requirement rather than the citation alone, assigning owners, linking existing controls, and flagging obligations with no owner or no control. Facilitated review of the output.

Lunch

Workshop: Compliance Risk Assessment

Working from the register built in the morning, participants set assessment criteria, score inherent risk, evaluate control effectiveness, arrive at residual risk and decide treatment. Discussion of scoring disputes and how to keep an assessment defensible when the numbers are judgement calls.

Break

Gap Analysis and Certification Readiness

Running a self-assessment against the standard, the documented information set required, and what happens in a stage 1 and stage 2 certification audit. Common nonconformities and how to close them. Integrating ISO 37301 with an existing ISO 37001, ISO 9001 or ISO 27001 system to avoid running parallel bureaucracies.

Implementation Roadmap and Wrap-Up

Groups present a phased implementation roadmap for their own organisation with owners and sequencing. Key takeaways, next steps, and close.