ISO 37301 Explained: The Compliance Management Standard With a Training Clause of Its Own

ISO 37301 is the international standard for compliance management systems. It is the standard a compliance function would reach for when it wants an auditable framework rather than a set of good intentions, and it has one feature that sets it apart from every other major ISO management system standard: a numbered requirement called, simply, Training.

It is also, by adoption, tiny. Understanding both of those facts at once is the point of this guide.

What it is and what it replaced

ISO 37301:2021, "Compliance management systems — Requirements with guidance for use", is the first edition, published on 13 April 2021. Its foreword records that it cancels and replaces ISO 19600:2014, "Compliance management systems — Guidelines", which has been withdrawn.

That replacement is the substantive change, not just a renumbering. ISO 19600 was a guidelines document with no auditable requirements. ISO 37301 specifies requirements, and ISO’s own technical committee classes it as a Type A management systems standard — the certifiable class. So an organisation can now be certified to a compliance management standard, which it could not before.

Current status: the standard was systematically reviewed between January and June 2026 and confirmed. ISO’s record shows stage 90.93, "International Standard confirmed", dated 3 August 2026, and states that it remains current. No revision is under development. It has been amended once, by Amendment 1:2024 on climate action changes, in line with the wider ISO portfolio.

The clause structure

ISO 37301 uses the same harmonised structure as the quality and safety standards, which is what makes integration possible. The requirement clauses are:

• 4 Context of the organization — 4.1 Understanding the organization and its context; 4.2 Understanding the needs and expectations of interested parties; 4.3 Determining the scope of the compliance management system; 4.4 Compliance management system; 4.5 Compliance obligations; 4.6 Compliance risk assessment
• 5 Leadership — 5.1 Leadership and commitment (5.1.1 Governing body and top management; 5.1.2 Compliance culture; 5.1.3 Compliance governance); 5.2 Compliance policy; 5.3 Roles, responsibilities and authorities (5.3.1 Governing body and top management; 5.3.2 Compliance function; 5.3.3 Management; 5.3.4 Personnel)
• 6 Planning — 6.1 Actions to address risks and opportunities; 6.2 Compliance objectives and planning to achieve them; 6.3 Planning of changes
• 7 Support — 7.1 Resources; 7.2 Competence (7.2.1 General; 7.2.2 Employment process; 7.2.3 Training); 7.3 Awareness; 7.4 Communication; 7.5 Documented information
• 8 Operation — 8.1 Operational planning and control; 8.2 Establishing controls and procedures; 8.3 Raising concerns; 8.4 Investigation processes
• 9 Performance evaluation — 9.1 Monitoring, measurement, analysis and evaluation (9.1.1 General; 9.1.2 Sources of feedback on compliance performance; 9.1.3 Development of indicators; 9.1.4 Compliance reporting; 9.1.5 Record-keeping); 9.2 Internal audit; 9.3 Management review
• 10 Improvement — 10.1 Continual improvement; 10.2 Nonconformity and corrective action

Three clause titles are worth pausing on, because they do not appear in the quality or safety standards at all: 4.5 Compliance obligations, 4.6 Compliance risk assessment, and 5.1.2 Compliance culture.

Clause 7.2.3: a named Training requirement

Most ISO management system standards handle training obliquely. Competence is the requirement; training is one of three permitted means of achieving it, alongside education and experience. ISO 37301 goes further. Clause 7.2 Competence has three numbered sub-clauses:

• 7.2.1 General
• 7.2.2 Employment process
• 7.2.3 Training

Clause 7.2.2 is itself unusual — it places competence obligations at the point of recruitment and appointment, not only on people already in post. And 7.2.3 makes training an auditable requirement in its own right rather than an optional route to competence. For a compliance function, that is a useful lever: the standard, not the training budget holder, says training has to happen.

Clause 7.3 Awareness sits alongside, and clause 5.3.4 Personnel places explicit roles and responsibilities on all personnel rather than only on the compliance function — which is the structural answer to the organisation where compliance is assumed to be somebody else’s job.

Speak-up and investigations are inside the standard

Clause 8.3 Raising concerns and clause 8.4 Investigation processes bring whistleblowing and internal investigation inside the management system. Both are commonly delivered through training, and both now sit in a clause an auditor will test. If you are building that provision, our guide to speak up and whistleblowing essentials covers the practical duties, which in the UK and Ireland exist in statute independently of any standard.

How it relates to ISO 37001

ISO 37001 is the anti-bribery management systems standard. Its current edition is ISO 37001:2025, the second edition, published in February 2025, which replaces ISO 37001:2016 and that edition’s 2024 amendment, both now withdrawn. Anyone citing ISO 37001:2016 as current is working from stale information.

Both standards sit under the same ISO technical committee on governance of organizations, alongside the whistleblowing management systems standard, and all three share the harmonised structure, which is what makes them integrable with each other and with the quality and safety standards.

The functional relationship, in plain terms: ISO 37301 is the umbrella compliance management system covering an organisation’s full range of compliance obligations, while ISO 37001 addresses a single risk — bribery — in depth. That framing follows ISO’s own product positioning and committee structure rather than a normative statement in either standard; ISO does not publish a formal statement of the relationship between the two on its public pages, so treat it as a sensible reading rather than a quotation.

Adoption: the number that gives the game away

As reported for the 2025 ISO Survey, with a reference date of 31 December 2025, ISO 37301 stood at 1,018 certificates — the first year the standard appeared in the survey at all. For comparison on the same reference date, ISO 37001 stood at 18,449, ISO 45001 at 599,532, and ISO 9001 at 1,611,729.

So ISO 37301 holds roughly one certificate for every 1,600 ISO 9001 certificates. It is an early-stage standard. That cuts two ways: it is unlikely to be demanded by customers in a procurement exercise yet, and it is a credible differentiator for an organisation that does hold it.

One methodological caution. ISO has moved the survey onto a certificate database with mandatory notification, replacing voluntary submissions, and earlier surveys were acknowledged to be incomplete. Reported year-on-year growth spanning that change — including the very large increase in ISO 37001 certificates — may partly reflect improved reporting coverage rather than real growth.

Frequently asked questions

Can you be certified to ISO 37301?

Yes. Unlike ISO 19600, which was guidelines only, ISO 37301 specifies requirements and is classed by ISO as a Type A management systems standard.

Which clause covers training?

Clause 7.2.3 Training, inside clause 7.2 Competence, alongside 7.2.1 General and 7.2.2 Employment process. Clause 7.3 covers awareness.

Is ISO 37301 being revised?

No. It was systematically reviewed and confirmed in 2026, with ISO recording stage 90.93 as at 3 August 2026, and no revision is under development.

Do we need ISO 37301 as well as ISO 37001?

They answer different questions. ISO 37301 covers the full range of compliance obligations; ISO 37001 covers bribery specifically. Organisations with a single dominant risk often start with 37001.

Does it replace sector regulation?

No. Statutory obligations continue to apply underneath it — for example the AML training requirements that flow from the Money Laundering Regulations, and data protection duties covered in our GDPR compliance checklist.

Where training fits

ISO 37301 is the one standard where a compliance training programme is not an inference from a competence clause but a direct requirement. If you are implementing it, the deliverable an auditor will want is a training programme tied to the compliance obligations register at clause 4.5 and the risk assessment at clause 4.6, with evidence of delivery and effect. Learnsignal builds that kind of programme for regulated teams — ESG reporting obligations often sit in the same register. To see what is available, explore our CPD courses or see pricing for teams.