Compliance Management System Manual Template (ISO 37301)

Compliance Management System Manual: [Organisation name]

Manual for an organisation-wide compliance management system (CMS): scope and context, the register of compliance obligations, the compliance risk assessment, governance and the compliance function, controls and procedures, raising concerns and investigations, indicators, reporting, audit, review and improvement. Structure aligned with ISO 37301:2021, Compliance management systems, Requirements with guidance for use (first edition, April 2021, with Amendment 1:2024 on climate action changes), a certifiable standard that replaced the ISO 19600 guidance. Clause numbers are cited; the wording is original and the standard's text is not reproduced. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice; check the current official texts and consult a qualified professional.

Document control

Approvals

Revision history

Contents

1. Context and scope (clause 4.1 to 4.4)
2. Compliance obligations (clause 4.5)
3. Compliance risk assessment (clause 4.6)
4. Leadership, policy and roles (clause 5)
5. Planning (clause 6)
6. Support (clause 7)
7. Operation (clause 8)
8. Performance evaluation (clause 9)
9. Improvement (clause 10)
10. Traceability matrix
11. Glossary and references

1. Context and scope (clause 4.1 to 4.4)

1.1 Issues

1.2 Interested parties

1.3 Scope statement

[Organisation] applies this CMS to [entities, sites, activities and business relationships], covering the compliance obligations in section 2. Excluded: [exclusions and reasons].

Example: Orlinde Logistics Group applies this CMS to all group companies, their road freight, warehousing and freight forwarding activities, and to sales agents and subcontracted hauliers acting for the group. No exclusions.

1.4 Elements of the CMS

The CMS consists of this manual, the obligations register (section 2), the compliance risk register (section 3), the compliance policy (section 4.2), the procedures listed in section 7, and the records listed in section 6.5. Good governance principles guide it: the compliance function has direct access to the governing body, works independently of operational management, and has the authority and resources to do its job.

2. Compliance obligations (clause 4.5)

For each obligation, keep the analysis of what it means for the organisation (the specific duties, deadlines and records) in the legal register (compliance/legal-register) or in the policy that implements it. When an obligation changes, record the change, assess its effect on section 3 and update controls in section 7 (clause 6.3, planning of changes).

3. Compliance risk assessment (clause 4.6)

3.1 Method

The scale is an example written for this template. Replace it with the method in compliance/risk-methodology where one exists.

Risk score = likelihood x consequence. Bands: 1 to 5 low, 6 to 12 medium, 15 to 25 high. High residual risks need a treatment plan approved by top management; medium residual risks need an owner and monitoring.

3.2 Compliance risk register

In the example, two inherent risks are high (CR-01 at 15 and CR-03 at 16). After controls, no residual risk is high; three are medium and need monitoring (CR-01, CR-02, CR-03) and three are low.

Reassessment triggers: new market or business line, acquisition, new obligation or significant change to one, a compliance failure, a substantiated report under section 7.3, and at least once a year.

4. Leadership, policy and roles (clause 5)

4.1 Leadership, culture and governance (clause 5.1)

4.2 Compliance policy (clause 5.2)

The compliance policy is a short document, approved by the governing body, that:

• states the organisation's commitment to meet its compliance obligations and to continually improve the CMS;
• sets the framework for compliance objectives (section 5);
• describes the authority and independence of the compliance function;
• explains how to raise concerns and the protection against retaliation;
• states the consequences of not complying with the policy and procedures.

Location: [link to the controlled policy document].

4.3 Roles and responsibilities (clause 5.3)

R responsible, A accountable, C consulted, I informed.

Compliance function: [name and role], with [n] staff, budget [amount], access to all records and people needed, and authority to stop or escalate an activity that would breach an obligation.

5. Planning (clause 6)

5.1 Actions on risks and opportunities (clause 6.1)

5.2 Compliance objectives (clause 6.2)

5.3 Planning of changes (clause 6.3)

Before changing the CMS (new procedure, new tool, reorganisation of the compliance function), record the purpose, the consequences, the resources needed and who is responsible, and confirm that controls stay in place during the change.

6. Support (clause 7)

6.1 Resources (clause 7.1)

[Budget, headcount, external advisers, tools for screening, case management and training.]

6.2 Competence, employment process and training (clause 7.2)

Disciplinary consequences for breaches of the compliance policy follow [the disciplinary procedure], applied consistently at every level.

6.3 Awareness (clause 7.3)

Personnel should know the compliance policy, how their work affects compliance obligations, the consequences of not complying, and how to raise a concern. Measure awareness through OBJ-03 and spot checks.

6.4 Communication (clause 7.4)

6.5 Documented information (clause 7.5)

Control documents through compliance/controlled-document.

7. Operation (clause 8)

7.1 Operational planning and control (clause 8.1)

Compliance controls are built into the processes that create the risk: agent appointment, route planning, data projects, onboarding of customers and consignees, and supplier contracting. Outsourced processes stay under the organisation's control through contract clauses and monitoring.

7.2 Controls and procedures (clause 8.2)

7.3 Raising concerns (clause 8.3)

7.4 Investigation processes (clause 8.4)

1. Triage each concern within [n] working days: in scope, urgency, conflicts of interest of potential investigators.
2. Appoint an investigator who is independent of the area concerned and competent for the subject.
3. Plan the investigation: questions, evidence, interviews, legal privilege, data protection, preservation of records.
4. Report findings to the decision maker named in the investigation procedure, and record the outcome and remediation.
5. Feed root causes into section 9 (corrective action) and section 3 (risk reassessment).
6. Report numbers and themes, without identifying reporters, to the governing body (section 8.2).

Use compliance/fraud-investigation-report for the investigation report format.

8. Performance evaluation (clause 9)

8.1 Monitoring and indicators (clause 9.1)

8.2 Compliance reporting (clause 9.1)

The compliance function reports to top management monthly and to the governing body quarterly. Each report covers: changes to obligations, risk register movements, indicator results against thresholds, concerns and investigations (anonymised), noncompliance and corrective actions, training completion and resource needs. Material noncompliance is escalated to the committee chair without waiting for the quarterly report.

8.3 Internal audit (clause 9.2)

Audit the CMS against this manual and ISO 37301 on a risk-based programme so that each clause and each high inherent risk is covered at least every [n] years. Keep auditors independent of the areas they audit. Use compliance/internal-audit-program for the programme.

8.4 Management review (clause 9.3)

Top management reviews the CMS at least yearly and the governing body reviews the results. Inputs: status of previous actions, changes in issues and obligations, performance against objectives and indicators, audit results, concerns and investigations, nonconformities and corrective actions, adequacy of resources, opportunities for improvement. Outputs: decisions on improvement, changes to the CMS and resources. Record it with compliance/management-review.

9. Improvement (clause 10)

9.1 Continual improvement (clause 10.1)

Sources of improvement: indicator trends, audit findings, investigation root causes, regulatory enforcement in the sector, feedback from interested parties and benchmarking. Improvements are prioritised in the management review.

9.2 Nonconformity, noncompliance and corrective action (clause 10.2)

Record details in compliance/capa-nonconformity.

10. Traceability matrix

In the example, OB-007 (the emissions reporting commitment) has no risk assessment yet: add it at the next reassessment.

11. Glossary and references

11.1 Glossary

11.2 Clause map

11.3 References

Standard and licence note

Structure aligned with ISO 37301:2021, Compliance management systems, Requirements with guidance for use (first edition, April 2021, with Amendment 1:2024, climate action changes). ISO lists the standard as reviewed and confirmed in 2026. Clause numbers and topics are cited from public summaries and the ISO catalogue; confirm subclause numbering in your licensed copy. This template is original text written for this collection and reproduces no text from the standard. The laws in the example are dated EU, UK and US illustrations, not a statement of what applies to any organisation; check the current official texts. The organisation, people and figures are fictional. This is a documentation format, not legal advice; consult a qualified professional.

Official text: ISO, purchase or licensed access: https://www.iso.org/standard/75080.html (also available from national standards bodies).

Template licence: MIT.