한
ENISO 37301 Compliance Management Systems
Confirms that an organisation has identified every law, regulation, contract term and internal rule it must observe, and manages compliance with them.
This standard is not covered by our IAS or UAF accreditation scopes. ITS certifies it under its own scheme. See our accreditations →
What this certification proves
ISO 37301 does not certify that you have never broken a law. Nobody can certify that. It certifies that the laws, regulations, contract terms and internal rules you must observe are listed exhaustively, each has an owner, and there is a mechanism that notices when one is not being met.
The key concept is the compliance obligation, which is broader than legislation — it includes licence conditions, contractual undertakings, industry codes and your own code of ethics.
An audit does not measure the thickness of the rulebook. It asks whether the obligations register is current — whether recent amendments to the law are reflected — and whether the reporting channel actually works.
Who this is for
- Financial, healthcare, construction and public-sector organisations facing heavy regulation
- Organisations exposed to serious-accident or fair-trade liability
- Holding companies and groups needing compliance oversight across subsidiaries
- Organisations that must demonstrate adequate procedures to regulators
🌱 How this relates to ESG
G GovernanceMaps squarely onto the G (Governance) pillar. «Ethics and compliance framework», the most frequently asked governance question, is exactly this standard's content.
- Korea's K-ESG guideline, G domain «ethical management» and «risk management» — code of conduct, reporting channel, action on violations
- GRI 2-23 to 2-27 — policy commitments, mechanisms for seeking advice and raising concerns, and compliance with laws and regulations, including fines
- Korea's Serious Accidents Punishment Act — where a chief officer must show that safety and health obligations were discharged, systematic obligation management is defence evidence
- Fair-trade compliance programmes (CP) and statutory compliance officer regimes share the same structure, so they can be run together
- Pairs with ISO 37001 — 37001 goes deep on bribery, 37301 goes wide across every obligation
What certification gives you
- A register of laws and regulations removes the «we did not know» category of failureSee the 8-step process →
- Evidence that due care was exercised, if an incident ever has to be defendedRequest audit duration and fees →
- Run alongside ISO 37001, the audits can be combined and cost lessSee ISO 37001 →
- A reporting channel means you learn about internal problems before the press or prosecutors doCheck a certified organisation →
- Can be submitted directly against the ethics section of tenders and group supplier evaluationsCertification mark rules →
How the requirements are structured
This is the overall shape of what the standard asks for. Working through it in this order is a sensible way to prepare.
| Clause | Title | In plain terms |
|---|---|---|
| 4 | Context | Identify applicable laws, regulations, contracts and internal rules to build the compliance obligations register, and set the scope. |
| 5 | Leadership | Top management sets the compliance policy and establishes a compliance function — independence is essential. |
| 6 | Planning | Assess «how serious would it be if this obligation were breached» and set priorities and objectives. |
| 7 | Support | People, budget, training, the reporting channel and documented information. |
| 8 | Operation | Run the controls, receive reports, investigate and act. |
| 9 | Performance evaluation | Measure compliance indicators; audit internally and review. |
| 10 | Improvement | After a violation, remove the cause and revise the register and controls. |
※ This is a summary written to help you, not the text of the standard. Please refer to the published standard for the exact requirements.
Before you apply, please check
Having these in place makes the audit considerably smoother. If you are not ready yet, you are still welcome to get in touch — we will set out what to do first, with a timeline.
- Is there a documented register of applicable laws and regulations, and is it current? Reflecting recent amendments is the crucial part
- Does each obligation have a named owning department and person?
- Is a compliance function or officer appointed, and is it independent of the business units?
- Is there a reporting channel with protection for the person reporting? Can reports be anonymous?
- Has compliance training been delivered, with attendance records?
- Are there records of investigation and action where a violation occurred?
- Have you carried out at least one internal audit yourselves? (required before the audit)
- Does management review cover compliance status, with minutes?
You can apply for ISO 37301 certification here
Tell us your organisation’s size and the standards you need, and we will send you the audit duration and a fee proposal. You are free to decide after seeing it.
Tel 02-786-9242Email info@itscert.or.krFax 02-6940-9317
※ ITS Certification Body does not provide management system consultancy. Auditing and consultancy must remain separate. What we can do is explain the certification process and what you need to have in place.
Which audit division handles this
Audits against this standard are carried out by our 반부패심사본부. See the organisation chart →