ISO 37301 compliance management system and ISO 37000: the G of ESG

What is an ISO 37301 compliance management system?

ISO 37301:2021, “Compliance management systems — Requirements with guidance for use”, sets the requirements for a system that lets an organization know all its compliance obligations and prove that it meets them. It replaced ISO 19600:2014, which was guidance only, and it can be certified.

According to its page on iso.org, checked on 11 November 2026, the standard is in its first edition (April 2021, 40 pages), developed by technical committee ISO/TC 309, Governance of organizations. It was reviewed and confirmed in 2026, so this version remains current. One amendment, ISO 37301:2021/Amd 1:2024 (“Climate action changes”), adds climate change to the context analysis, as for other ISO management system standards.

The ISO/TC 309 committee page adds four useful points:

• the standard was published on 13 April 2021;
• it is meant for any organization, regardless of type, size and nature of activity, in the public, private or not-for-profit sector;
• it rests on four principles: good governance, proportionality, transparency and sustainability;
• it is a “Type A” management system standard that integrates with ISO 9001 (quality), ISO 14001 (environment) and ISO 37001 (anti-bribery).

From ISO 19600:2014 to ISO 37301:2021

During the systematic review of ISO 19600:2014, “Compliance management systems — Guidelines”, the committee agreed in September 2018 to turn it into a requirements standard under a new number. ISO 19600 was withdrawn when ISO 37301 was published. The difference matters: guidelines are applied freely, a requirements standard is audited. If your compliance policy still cites ISO 19600, it refers to a document that no longer exists.

What counts as a compliance obligation

In practice, the register of an ISO 37301 system holds two kinds of obligations: those imposed by law, and those the company has chosen to meet (customer contracts, a buyer’s supplier code of conduct, label criteria, public commitments). This is what separates compliance management from legal monitoring. A Moroccan exporter that signs its European customer’s supplier code of conduct adds an obligation to its register, even though no Moroccan law requires it.

What does ISO 37301 require from a company?

A complete, proportionate system: identified obligations, assessed risks, a policy owned by top management, clear responsibilities, training, a reporting channel, investigations, controls and improvement. The ISO/TC 309 FAQ (May 2022) summarizes these measures; the table links them to the evidence an auditor will ask for.

The same FAQ clears up three common misunderstandings. The standard can cover part of an organization: certain activities, or one or more companies of a group. It does not call for a separate programme: its measures fit into existing processes and controls, thanks to the common structure of ISO management system standards. And its uses go beyond certification: it also serves as a benchmark to assess a business partner, or as a condition for entering a value chain.

For example, an automotive supplier near Tangier, certified to ISO 9001, receives a supplier code of conduct and a questionnaire on bribery, personal data and sanctions from its European customer. It does not need a second system. It adds an obligations register, a compliance risk assessment and a speak-up channel to its existing process map, then runs them through its internal audits and management review.

What does ISO 37000 recommend for the governance of organizations?

ISO 37000:2021, “Governance of organizations — Guidance”, gives the board and senior management principles to direct, oversee and be held accountable, so that the organization fulfils its purpose. It is guidance: it cannot be certified and adds no regulatory requirement.

According to its page on iso.org, the standard (first edition, September 2021, 36 pages, ISO/TC 309) was reviewed and confirmed in 2026. It is written for governing bodies and for stakeholders involved in or affected by governance, and it applies to all organizations regardless of type, size, location, structure or purpose. The ISO/TC 309 committee describes it as a benchmark that adds no new regulation but complements existing rules.

The committee sums up the standard in eleven topics. The table turns them into questions a board can ask itself.

The committee stresses two points: effective oversight, through a clear internal control system and reliable assurance, and accountability at every level, since the governing body is ultimately accountable for the organization’s actions and omissions. ISO 37301 is the tool that makes both principles verifiable for compliance: ISO 37000 says what the board should oversee, ISO 37301 organizes what it oversees.

For social responsibility in the broad sense, the reference remains ISO 26000, which cannot be certified either; our CGEM CSR label and ISO 26000 guide covers it.

Where does ISO 37001:2025 fit, and how do you combine the three standards?

ISO 37001:2025, which replaces ISO 37001:2016, is the certifiable anti-bribery management system standard: it deals with one risk, whereas ISO 37301 covers all compliance obligations. Both share the same structure and fit into a single system, under the governance described by ISO 37000.

According to its page on iso.org, ISO 37001:2025 (second edition, February 2025, ISO/TC 309) helps organizations prevent, detect and respond to bribery, direct or indirect, and comply with the anti-bribery laws and voluntary commitments that apply to their activities, in the public, private and not-for-profit sectors. ISO 37001:2016 and its 2024 amendment are withdrawn. The ISO 37301 page sums up the difference: ISO 37001 focuses on bribery, ISO 37301 covers a broader scope of compliance issues.

The order matters less than the shared foundation: one ethics and compliance policy, one function, one speak-up channel, one internal audit programme. A site certified to ISO 9001:2026 (formerly ISO 9001:2015) or ISO 14001:2026 (formerly ISO 14001:2015) keeps its process map, document control and management review. Our QHSE and ISO systems page explains this integration, including ISO 37001 alongside ISO 50001, ISO/IEC 27001 and ISO 22301.

Why does the G of ESG run through these standards in Morocco?

Because regulators, customers and banks now ask for evidence of governance, not just statements. In Morocco, the 2025 governance code for companies that issue securities to the public expects an ethics and compliance set-up; in Europe, customers’ reporting standards ask their suppliers for governance data.

Morocco’s 2025 corporate governance code

According to its 2026 action priorities, the Moroccan Capital Market Authority (AMMC), as a member of the National Corporate Governance Commission (CNGE), took part in updating Morocco’s 2008 code of good corporate governance practices. The framework adopted in 2025 consists of a general code and five specific codes. The specific code for companies issuing securities to the public, published by the AMMC in French, lists the five profiles covered by specific codes: companies issuing securities to the public, credit institutions, insurers and reinsurers, state-owned companies and public bodies, and SMEs and micro-enterprises, family-owned ones included. An unlisted SME therefore has a reference code too.

That code has applied since 18 December 2025. What it asks for, and what the ISO standards bring:

The code does not cite ISO standards and requires no certification. It sets practices; ISO 37301 and ISO 37001 provide a proven method to implement them and keep the evidence. The public anti-corruption framework rests on Law No. 46-19, promulgated by Dahir No. 1-21-36 of 21 April 2021, which tasks the National Authority for Probity, Prevention and Fight against Corruption (INPPLC) with, among other missions, embedding the principles of good governance (Art. 4).

What European customers ask for

Unlisted suppliers meet governance through another door: their customers’ reporting. The VSME standard, Annex I to Delegated Regulation (EU) 2026/1560, asks in its basic module for the number of convictions and the total amount of fines for breaches of anti-corruption and anti-bribery laws during the period, where there were any (B11, paragraph 43). Its comprehensive module asks for the gender diversity ratio of the governance body, where one exists (C9, paragraph 64). Our VSME standard guide covers these disclosures. Large companies subject to the CSRD apply the ESRS, including the governance standard G1; our article on the simplified ESRS gives the timeline, and our ESRS, VSME, GRI and ISSB comparison helps you choose a framework.

An ISO 37301 system makes these answers easy: the litigation register feeds B11, the board composition record feeds C9, and the code of conduct, the speak-up channel and the training records answer the business conduct questions in questionnaires and in your customers’ supply-chain due diligence.

Can you get ISO 37301 certification, and how do you prepare?

Yes. ISO 37301 is a requirements standard, so an independent certification body can verify that a system conforms to it. Certification is not mandatory, unless a contract or a tender requires it, and it does not guarantee that no breach will occur.

The ISO/TC 309 FAQ adds the useful nuances:

• ISO issues no certificates. ISO publishes standards; external certification bodies audit and certify.
• No absolute protection. Using ISO 37301, certified or not, does not shield an organization from prosecution. The system can serve as evidence that adequate measures were in place, which may reduce or even exclude liability depending on the applicable law; third-party certification strengthens that evidence.
• No guaranteed outcome. The standard helps prevent, detect and respond to compliance risk; it cannot ensure that no breach will ever happen.
• Competent bodies. Certification bodies apply ISO/IEC 17021-1, supplemented for compliance systems by specific competence requirements in a technical specification (ISO/IEC TS 17021-13). Accreditation is not compulsory, but it independently confirms competence. In Morocco, the Moroccan Accreditation Service (SEMAC) publishes the list of bodies it accredits: check the scope.

The steps of an ISO 37301 project

1. Scoping. The board or the CEO sets the scope (entities, sites, activities) and appoints the compliance function.
2. Obligations register. Applicable laws and regulations, customer contracts, signed codes of conduct, public commitments.
3. Compliance risk assessment. Likelihood and consequences per obligation and per process; priorities.
4. Policy and organization. Compliance policy, code of conduct, conflicts of interest, speak-up channel, investigation procedure.
5. Roll-out. Controls built into existing processes, training by level of exposure, communication to business associates.
6. Verification. Indicators, internal audit, management review, then a pre-assessment audit before the certification audit, if you aim for one.

Is your system ready?

• The scope of the system is written and approved by top management.
  
• A compliance function is appointed, with direct access to the governing body.
  
• The obligations register covers both law and voluntary commitments (contracts, customer codes).
  
• Compliance risks are assessed, dated and prioritized.
  
• The compliance policy and code of conduct are signed and shared with staff and business associates.
  
• A confidential speak-up channel exists, with protection against retaliation.
  
• The most exposed staff are trained, with records.
  
• An internal audit and a management review have covered the system.
  
• For an issuer of publicly offered securities: the annual governance review is prepared under the 2025 code.
  
• The intended certification body is accredited for ISO 37301.