Update: The new ISO 37301: 2021 - Compliance management systems

For a long time, ISO 19600 was the internationally recognized guideline for compliance management systems—but it was merely a recommendation and could not be certified. With ISO 37301:2021, this has fundamentally changed: The new standard is a so-called Type A standard, which sets binding requirements and enables external certification of the CMS. It follows the Harmonized Structure, which ensures structural compatibility with other management system standards such as ISO 9001 or ISO 14001. This special session provides a concise and practical overview of what this change specifically means for your existing CMS, what adjustments are necessary, and how you can professionally implement the new requirements—without having to rebuild your CMS from scratch.

Many compliance officers have built their CMS based on ISO 19600 or IDW PS 980 and are now wondering if—and where—specific adjustments are needed. This special session will show you how to systematically align your existing CMS with the requirements of ISO 37301—from reviewing the scope of application and conducting a compliance risk analysis, to evaluating management and organizational structures, and finally to effectiveness monitoring and the internal audit process. Using sample documents and checklists provided during the special session, you can carry out this alignment in a structured and efficient manner—and will then know exactly where your CMS already complies with the standard and where action is needed.

ISO 37301 certification is not a legal requirement in most industries—but it is increasingly becoming a de facto competitive advantage and, in some contexts, even a prerequisite for business relationships. This special session will examine the key scenarios in which certification becomes particularly relevant:

Lending partners are increasingly requiring proof of a certified CMS as a prerequisite for granting loans or making investments.

Under the Supply Chain Due Diligence Act (LkSG), customers and supply chain managers require their suppliers to provide appropriate documentation.

Competition registries and self-cleaning procedures require a functioning, verifiable CMS.

Criminal and administrative penalty proceedings can be significantly influenced by the demonstration of a certified CMS.

Those who understand these connections can make an informed decision about whether and when certification makes sense for their company—and how to prepare for it strategically.

Defining the scope is one of the most fundamental and far-reaching decisions when establishing or further developing a CMS in accordance with ISO 37301. It determines which parts of the organization, which processes, and which compliance issues are covered by the CMS—and thus also which risks must be addressed and which resources must be allocated. This special session demonstrates how to systematically analyze the organization’s context, how to derive the scope from that analysis, and what requirements the standard imposes on this definition. Those who carry out this step carefully lay the foundation for a CMS that truly fits their own company—one that is neither too broad nor too narrow, as both extremes can lead to significant problems.

The Harmonized Structure is a uniform framework that underlies all modern ISO management system standards and ensures their structural compatibility. For compliance officers, this means that if your organization has already implemented other ISO standards such as ISO 9001 or ISO 14001, you can integrate the requirements of ISO 37301 more efficiently, leverage synergies, and avoid duplication of effort. This special session explains exactly what the Harmonized Structure entails, how the PDCA cycle—Plan, Do, Check, Act—is embedded in ISO 37301, and how you can use this structure to strategically develop your CMS. Those who understand this connection can position their CMS not as an isolated silo, but as an integral part of their company’s overall management system.