ISO 37301 certification, explained
ISO 37301 is the standard for compliance management systems. It helps an organization work out which laws, regulations, contractual and voluntary commitments apply, assess the risk of not meeting them, and manage this through a joined-up system rather than scattered checklists. It suits regulated businesses, groups with several functions handling obligations, and organizations wanting a clear compliance culture. Independent certification bodies audit it.
Updated 5 November 2026
Info. Showing a standard does not mean a partner holds scope for it. How matching works.
Who it may be relevant for
- Regulated businesses with many licences, permits and reporting duties
- Groups where legal, finance, HR and operations each handle separate obligations
- Organizations that want a single method for compliance risk across jurisdictions
- Companies adding anti-bribery or data protection controls to an existing system
What it covers
- Identifying compliance obligations and keeping the list up to date
- Assessing the risk of failing to meet those obligations
- A compliance policy, a compliance function with authority and top-level commitment
- Training, communication, reporting concerns and handling breaches
- Monitoring, internal audit, management review and continual improvement
What it can help with
- One place where obligations, owners and controls are recorded
- A repeatable method for assessing compliance risk and prioritising action
- A route for staff to raise concerns and for management to respond and learn
- A structure that works alongside ISO 37001 and other management systems
What the pathway means
ISO 37301 is a certifiable management-system standard. An independent certification body audits your compliance management system through Stage 1, Stage 2, a decision, surveillance audits and recertification. A certificate is not a statement of legal compliance and does not remove liability. Which certification schemes are available for your scope should be checked. MIYAAR CONNECT does not audit or certify. We connect your inquiry with independent certification bodies.
Edition. ISO 37301:2021 is the current edition, with Amendment 1:2024 on climate-change considerations. Ask the certification body which text will apply to your audit.
The typical process
Steps and timing vary by body and scope. This is the usual shape, not a promise.
- You and us
Your inquiry
You describe your needs and share the basics.
- Certification body
Application and contract review
The body reviews your scope, sites and size, then quotes.
- Certification body
Stage 1 audit
A readiness review of your management system documentation.
- Certification body
Stage 2 audit
An evaluation of how the system works in practice.
- This part is theirs
Certification decision
Made by the certification body, never by MIYAAR CONNECT.
- Certification body
Surveillance and recertification
Periodic surveillance audits, then recertification at the end of the cycle.
Where it is typically used
- A multi-site operator mapping licences, inspection duties and renewals to named owners
- A financial or healthcare supplier building a compliance risk register shared by departments
- A contractor aligning contract obligations, labour rules and permit conditions in one system
What affects cost
- Number of employees
- Number of sites
- Complexity of what you do and its risks
- Breadth of the obligations covered, such as number of laws, licences and contractual commitments
- Number of sites, jurisdictions and business units in the scope
- Extent of regulation in your sector, which can need auditors with specialist knowledge
- Whether you combine the audit with ISO 37001 or other standards
What affects timing
- Time to compile a trustworthy register of obligations and assign owners
- Evidence of compliance risk assessments and of obligations being monitored in practice
- Coordination across departments that previously managed obligations separately
- Availability of certification schemes and auditors for your scope
What to have ready
- A summary of the types of obligations that matter most: licences, permits, contracts, reporting
- Existing policies, registers or compliance tools, described but not uploaded
- The sites, countries and business units you want covered
- Any buyer or regulator expectations that mention a compliance management system
- Who would own compliance in the organization
Accreditation and recognition
Value depends on the certification body and the scope. Accreditation bodies assess certification bodies for defined scopes. Ask for the certificate number and scope statement, then confirm the body's accreditation for this standard with its accreditation body or through the Global Accreditation Cooperation Incorporated (Global ACI) arrangement, which took over from the IAF and ILAC on 1 January 2026. Certification does not make an organization legally compliant, and regulators and buyers decide what they accept.
Common questions
Does certification mean we comply with the law?
ISO 37301 replaced ISO 19600. What is the difference?
Which laws does it include?
Can it be combined with other standards?
Related standards
Relevant industries
Useful reading
Sources
- ISO: ISO 37301:2021 compliance management systems (checked 5 November 2026)
Ask about availability for ISO 37301
We review availability for each inquiry. If no verified certification body fits your request, we will tell you plainly.