# Compliance Management System Manual: [Organisation name]

> Manual for an organisation-wide compliance management system (CMS):
> scope and context, the register of compliance obligations, the
> compliance risk assessment, governance and the compliance function,
> controls and procedures, raising concerns and investigations,
> indicators, reporting, audit, review and improvement. Structure
> aligned with ISO 37301:2021, *Compliance management systems,
> Requirements with guidance for use* (first edition, April 2021, with
> Amendment 1:2024 on climate action changes), a certifiable standard
> that replaced the ISO 19600 guidance. Clause numbers are cited; the
> wording is original and the standard's text is not reproduced.
> Replace every `[bracketed]` value and every row marked *Example*.
> This is a documentation format, not legal advice; check the current
> official texts and consult a qualified professional.

<!--
Guidance: How to use this template
- Use it as the top-level CMS document that links the registers and
  procedures you already have. Each section names the ISO 37301 clause
  it answers, so an auditor or certification body can trace it.
- Fill section 1 (scope and context) and section 2 (obligations)
  before anything else: every risk, control and indicator later in the
  manual should trace back to an obligation ID (section 10).
- Laws named in the example are dated illustrations from the EU, UK
  and US, not a list of what applies to you. Your obligations come
  from your own legal and contractual analysis.
- The worked example is fictional: Orlinde Logistics Group, a road
  freight and warehousing group with 1,900 staff in three EU Member
  States and the UK, and agents in new markets. Delete it before use.
- Related documents: Legal Register (`compliance/legal-register`),
  Anti-Bribery Management System (`compliance/iso-37001-anti-bribery`),
  Whistleblowing Policy (`compliance/whistleblowing-policy`), Conflicts
  of Interest Register (`compliance/conflicts-of-interest-register`),
  Risk Methodology (`compliance/risk-methodology`), Risk Register
  (`compliance/risk-register`), Objectives Register
  (`compliance/objectives-register`), Internal Audit Program
  (`compliance/internal-audit-program`), Management Review
  (`compliance/management-review`), Nonconformity and CAPA
  (`compliance/capa-nonconformity`), Annual Compliance Review
  (`compliance/annual-compliance-review`), Fraud Investigation Report
  (`compliance/fraud-investigation-report`), Code of Business Conduct
  (`compliance/code-of-business-conduct`).
-->

## Document control

<!-- Guidance: The governing body approves the compliance policy and receives CMS reports, so record it as an approver. A change of scope or of the compliance function's reporting line is a new major version. -->

| Field | Value |
|---|---|
| Document ID | [CMS-MAN-001] |
| Version | [0.1] |
| Status | [Draft / Approved / Under revision] |
| Owner | [@chief-compliance-officer] |
| Approvers/reviewers | [Governing body or its committee], [@ceo], [@general-counsel] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Organisation and entities in scope | [Legal entities] |
| Standard edition | ISO 37301:2021 with Amd 1:2024 |
| Certification status | [Not certified / Certification planned YYYY / Certified by [body], certificate [number]] |
| Next review | YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Chief compliance officer | [@cco] | [Prepared] | YYYY-MM-DD |
| Top management | [@ceo] | [Approved] | YYYY-MM-DD |
| Governing body (audit and risk committee) | [Chair] | [Approved compliance policy, section 4.2] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@cco] | First draft from obligations and risk workshops |
| 1.0 | YYYY-MM-DD | [@cco] | Approved by the governing body |

## Contents

<!-- Guidance: Sections 1 to 9 follow ISO 37301 clauses 4 to 10. Section 10 ties them together. -->

1. Context and scope (clause 4.1 to 4.4)
2. Compliance obligations (clause 4.5)
3. Compliance risk assessment (clause 4.6)
4. Leadership, policy and roles (clause 5)
5. Planning (clause 6)
6. Support (clause 7)
7. Operation (clause 8)
8. Performance evaluation (clause 9)
9. Improvement (clause 10)
10. Traceability matrix
11. Glossary and references

## 1. Context and scope (clause 4.1 to 4.4)

<!-- Guidance: Questions to answer: what does the organisation do, where, through whom, and which internal and external issues shape its compliance risk? Who expects what of it? Pitfall: a scope that leaves out agents, joint ventures or subsidiaries where most of the risk sits. Clause 4.1 also asks, since Amendment 1:2024, whether climate change is a relevant issue; record the answer. -->

### 1.1 Issues

| Issue ID | Internal or external | Issue | Effect on compliance |
|---|---|---|---|
| ISS-01 *(Example)* | External | Expansion into markets with high perceived corruption risk through sales agents | Bribery and sanctions exposure |
| ISS-02 *(Example)* | External | Tighter enforcement of road transport working-time rules | Driver hours and tachograph compliance |
| ISS-03 *(Example)* | Internal | Driver telematics project collecting location data | Data protection obligations |
| ISS-04 *(Example)* | External | Climate change: customer emissions reporting requests and low-emission zone rules | New contractual and regulatory obligations |
| [ISS-NN] | [Internal / External] | [issue] | [effect] |

### 1.2 Interested parties

| Party | Relevant needs and expectations | Will the CMS address them? |
|---|---|---|
| Regulators and enforcement bodies *(Example)* | Lawful operation, cooperation, self-reporting where required | Yes |
| Customers *(Example)* | Supplier code of conduct, audit rights, emissions data | Yes, through contracts |
| Employees and drivers *(Example)* | Safe working hours, fair treatment, safe channels to raise concerns | Yes |
| Lenders and insurers *(Example)* | Sanctions and anti-corruption covenants | Yes |
| [Party] | [needs] | [Yes / No, reason] |

### 1.3 Scope statement

[Organisation] applies this CMS to [entities, sites, activities and
business relationships], covering the compliance obligations in
section 2. Excluded: [exclusions and reasons].

*Example*: Orlinde Logistics Group applies this CMS to all group
companies, their road freight, warehousing and freight forwarding
activities, and to sales agents and subcontracted hauliers acting for
the group. No exclusions.

### 1.4 Elements of the CMS

The CMS consists of this manual, the obligations register (section 2),
the compliance risk register (section 3), the compliance policy
(section 4.2), the procedures listed in section 7, and the records
listed in section 6.5. Good governance principles guide it: the
compliance function has direct access to the governing body, works
independently of operational management, and has the authority and
resources to do its job.

## 2. Compliance obligations (clause 4.5)

<!-- Guidance: List every obligation the organisation must or chooses to comply with: laws and regulations (compliance requirements), and contracts, codes and voluntary commitments (compliance commitments). Give each an owner and a way to learn about changes. Pitfall: a list of law names with no link to the activity they govern. -->

| Obligation ID | Source (dated) | Type | Activity concerned | Obligation owner | Change monitoring |
|---|---|---|---|---|---|
| OB-001 *(Example)* | Regulation (EU) 2016/679 (GDPR), applies from 25 May 2018 | Requirement | Processing of employee, driver and customer contact data, telematics | [@dpo] | Supervisory authority and EDPB publications, monthly |
| OB-002 *(Example)* | Regulation (EC) No 561/2006 on driving times, breaks and rest periods, as amended (including by Regulation (EU) 2020/1054) | Requirement | Scheduling and driving in EU operations | [@head-of-fleet] | Commission transport pages, quarterly |
| OB-003 *(Example)* | UK Bribery Act 2010, section 7 (failure of a commercial organisation to prevent bribery) | Requirement | Sales agents, customs brokers, public contracts | [@cco] | Legal counsel bulletin, quarterly |
| OB-004 *(Example)* | Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, as transposed in each Member State | Requirement | Internal reporting channel and protection from retaliation | [@cco] | National transposition tracker, yearly |
| OB-005 *(Example)* | EU, UK and US sanctions lists and the regulations behind them | Requirement | Customer, consignee and agent onboarding, shipments | [@trade-compliance-lead] | Screening tool list updates, daily |
| OB-006 *(Example)* | Customer supplier codes of conduct (key accounts) | Commitment | All services to those customers | [@key-account-director] | Contract review at renewal |
| OB-007 *(Example)* | Group commitment to report scope 1 and 2 emissions to customers | Commitment | Fleet and warehouse energy data | [@sustainability-lead] | Annual |
| [OB-NNN] | [source and date] | [Requirement / Commitment] | [activity] | [@owner] | [how and how often] |

For each obligation, keep the analysis of what it means for the
organisation (the specific duties, deadlines and records) in the legal
register (`compliance/legal-register`) or in the policy that implements
it. When an obligation changes, record the change, assess its effect on
section 3 and update controls in section 7 (clause 6.3, planning of
changes).

## 3. Compliance risk assessment (clause 4.6)

<!-- Guidance: Identify, analyse and evaluate the risk of not meeting each obligation, considering causes, consequences and likelihood. Reassess periodically and when circumstances change. Pitfall: scoring only inherent risk, so nobody can see what the controls achieve. -->

### 3.1 Method

The scale is an example written for this template. Replace it with the
method in `compliance/risk-methodology` where one exists.

| Score | Likelihood (next 12 months) | Consequence |
|---|---|---|
| 1 | Rare | Negligible: no regulatory interest, no harm |
| 2 | Unlikely | Minor: local finding, quick fix |
| 3 | Possible | Moderate: regulator inquiry, customer complaint, limited harm |
| 4 | Likely | Major: penalty, contract loss, harm to people |
| 5 | Almost certain | Severe: prosecution, licence loss, debarment, serious harm |

Risk score = likelihood x consequence. Bands: 1 to 5 low, 6 to 12
medium, 15 to 25 high. High residual risks need a treatment plan
approved by top management; medium residual risks need an owner and
monitoring.

### 3.2 Compliance risk register

| Risk ID | Obligation | Risk (cause and event) | Inherent L x C | Inherent score | Key controls | Residual L x C | Residual score | Owner |
|---|---|---|---|---|---|---|---|---|
| CR-01 *(Example)* | OB-003 | Sales agent pays a customs official to clear goods faster | 3 x 5 | 15 high | CTL-01, CTL-02, CTL-07 | 2 x 5 | 10 medium | [@cco] |
| CR-02 *(Example)* | OB-001 | Telematics data used to monitor drivers beyond the stated purpose | 3 x 4 | 12 medium | CTL-03, CTL-07 | 2 x 3 | 6 medium | [@dpo] |
| CR-03 *(Example)* | OB-002 | Schedules force drivers to exceed daily driving limits | 4 x 4 | 16 high | CTL-04 | 2 x 4 | 8 medium | [@head-of-fleet] |
| CR-04 *(Example)* | OB-005 | Shipment for a consignee linked to a sanctioned person | 2 x 5 | 10 medium | CTL-05 | 1 x 5 | 5 low | [@trade-compliance-lead] |
| CR-05 *(Example)* | OB-006 | Subcontracted haulier breaches customer labour standards | 2 x 4 | 8 medium | CTL-06 | 1 x 4 | 4 low | [@procurement-lead] |
| CR-06 *(Example)* | OB-004 | Reporter suffers retaliation after raising a concern | 2 x 3 | 6 medium | CTL-08 | 1 x 3 | 3 low | [@cco] |
| [CR-NN] | [OB-NNN] | [risk] | [L x C] | [score] | [controls] | [L x C] | [score] | [@owner] |

In the example, two inherent risks are high (CR-01 at 15 and CR-03 at
16). After controls, no residual risk is high; three are medium and
need monitoring (CR-01, CR-02, CR-03) and three are low.

Reassessment triggers: new market or business line, acquisition, new
obligation or significant change to one, a compliance failure, a
substantiated report under section 7.3, and at least once a year.

## 4. Leadership, policy and roles (clause 5)

<!-- Guidance: Clause 5 asks the governing body and top management to show commitment, build a compliance culture, and make sure the compliance function is independent, has authority and has direct access to them. Show how, not that. Pitfall: a compliance officer who reports to a sales director and has no budget. -->

### 4.1 Leadership, culture and governance (clause 5.1)

| Expectation | How it is met | Evidence |
|---|---|---|
| Governing body oversees the CMS | Audit and risk committee receives the compliance report each quarter and approves the policy yearly | Committee minutes |
| Top management shows commitment | CEO sponsors training, signs the compliance policy, includes compliance in leadership objectives | Signed policy, objectives |
| Compliance culture | Annual staff survey questions on speaking up; compliance behaviour in performance reviews | Survey results, review form |
| Independence and access of the compliance function | CCO reports to the CEO with a direct line to the committee chair; private session with the committee yearly | Organisation chart, minutes |

### 4.2 Compliance policy (clause 5.2)

The compliance policy is a short document, approved by the governing
body, that:

- states the organisation's commitment to meet its compliance
  obligations and to continually improve the CMS;
- sets the framework for compliance objectives (section 5);
- describes the authority and independence of the compliance function;
- explains how to raise concerns and the protection against
  retaliation;
- states the consequences of not complying with the policy and
  procedures.

Location: [link to the controlled policy document].

### 4.3 Roles and responsibilities (clause 5.3)

| Activity | Governing body | Top management | Compliance function | Managers | All personnel |
|---|---|---|---|---|---|
| Approve compliance policy | A | R | C | I | I |
| Maintain obligations register | I | A | R | C | I |
| Assess compliance risk | I | A | R | R | C |
| Operate controls in business processes | I | A | C | R | R |
| Raise concerns | I | I | R (receive) | R | R |
| Report CMS performance | I (receives) | A | R | C | I |

R responsible, A accountable, C consulted, I informed.

Compliance function: [name and role], with [n] staff, budget [amount],
access to all records and people needed, and authority to stop or
escalate an activity that would breach an obligation.

## 5. Planning (clause 6)

<!-- Guidance: Turn the risk assessment into actions and measurable objectives. Plan changes to the CMS so they do not break it. Pitfall: objectives like "be compliant", which cannot be measured. -->

### 5.1 Actions on risks and opportunities (clause 6.1)

| Action ID | Risk or opportunity | Action | Owner | Due |
|---|---|---|---|---|
| PA-01 *(Example)* | CR-01 | Re-run due diligence on all agents in new markets with enhanced questionnaire | [@cco] | YYYY-MM-DD |
| PA-02 *(Example)* | CR-03 | Integrate driving-time rules into the route planning tool so plans that breach them cannot be issued | [@head-of-fleet] | YYYY-MM-DD |
| PA-03 *(Example)* | Opportunity: shared screening tool for sanctions and agent checks | Consolidate tools | [@trade-compliance-lead] | YYYY-MM-DD |

### 5.2 Compliance objectives (clause 6.2)

| Objective ID | Objective | Indicator | Target | Owner | Review |
|---|---|---|---|---|---|
| OBJ-01 *(Example)* | All high-risk third parties have current due diligence | Share of agents with due diligence under 24 months old | 100 percent | [@cco] | Quarterly |
| OBJ-02 *(Example)* | Reduce driving-time infringements | Infringements per 1,000 driver days from tachograph analysis | Below [target] | [@head-of-fleet] | Monthly |
| OBJ-03 *(Example)* | People know how to raise concerns | Share of staff survey respondents who know the reporting channel | 90 percent or more | [@cco] | Yearly |

### 5.3 Planning of changes (clause 6.3)

Before changing the CMS (new procedure, new tool, reorganisation of the
compliance function), record the purpose, the consequences, the
resources needed and who is responsible, and confirm that controls stay
in place during the change.

## 6. Support (clause 7)

<!-- Guidance: Show that the CMS has the people, skills, communications and records it needs. Clause 7.2 also covers the employment process: checks before hiring into high-risk roles and disciplinary consequences. Pitfall: one generic e-learning module for everyone. -->

### 6.1 Resources (clause 7.1)

[Budget, headcount, external advisers, tools for screening, case
management and training.]

### 6.2 Competence, employment process and training (clause 7.2)

| Role group | Exposure | Employment controls | Training | Frequency |
|---|---|---|---|---|
| Sales and agent managers *(Example)* | High: bribery, sanctions | Background check before hire; compliance objective in reviews | Anti-bribery and sanctions, face to face with case studies | Yearly |
| Fleet planners and drivers *(Example)* | High: driving time | Licence and infringement history check | Driving-time rules, fatigue | Yearly, and on rule change |
| Data and telematics staff *(Example)* | Medium: data protection | Confidentiality undertaking | Data protection by design | Yearly |
| All staff *(Example)* | General | Acknowledge code of conduct | Code of conduct, speaking up | At hire and yearly |

Disciplinary consequences for breaches of the compliance policy follow
[the disciplinary procedure], applied consistently at every level.

### 6.3 Awareness (clause 7.3)

Personnel should know the compliance policy, how their work affects
compliance obligations, the consequences of not complying, and how to
raise a concern. Measure awareness through OBJ-03 and spot checks.

### 6.4 Communication (clause 7.4)

| What | Who to | How | When | Owner |
|---|---|---|---|---|
| Compliance policy and code | All personnel, agents | Intranet, agent onboarding pack | At hire or appointment, yearly | [@cco] |
| Compliance report | Governing body | Committee paper | Quarterly | [@cco] |
| Supplier expectations | Hauliers and agents | Contract clauses, supplier code | At contract | [@procurement-lead] |
| [What] | [audience] | [channel] | [timing] | [@owner] |

### 6.5 Documented information (clause 7.5)

| Record | System | Retention | Owner |
|---|---|---|---|
| Obligations register | [GRC tool] | Current plus [n] years of versions | [@cco] |
| Risk register and assessments | [GRC tool] | [n] years | [@cco] |
| Due diligence files | [Case system] | [n] years after relationship ends | [@cco] |
| Concerns and investigation files | [Case system, restricted] | [n] years, subject to data protection law | [@cco] |
| Training records | [Learning platform] | [n] years | [@people-lead] |

Control documents through `compliance/controlled-document`.

## 7. Operation (clause 8)

<!-- Guidance: Controls are where obligations meet daily work. Each control needs an owner, a frequency, evidence and the risks it treats. Clauses 8.3 and 8.4 require a way to raise concerns and a process to investigate. Pitfall: a hotline nobody trusts, or investigations run by the manager of the person reported. -->

### 7.1 Operational planning and control (clause 8.1)

Compliance controls are built into the processes that create the risk:
agent appointment, route planning, data projects, onboarding of
customers and consignees, and supplier contracting. Outsourced
processes stay under the organisation's control through contract
clauses and monitoring.

### 7.2 Controls and procedures (clause 8.2)

| Control ID | Control | Type | Frequency | Owner | Evidence | Risks |
|---|---|---|---|---|---|---|
| CTL-01 *(Example)* | Risk-based due diligence and approval before appointing any sales agent or customs broker | Preventive | Per appointment, refreshed every 24 months | [@cco] | Due diligence file, approval record | CR-01 |
| CTL-02 *(Example)* | Anti-bribery clauses with audit and termination rights in agent contracts | Preventive | Per contract | [@general-counsel] | Contract register | CR-01 |
| CTL-03 *(Example)* | DPIA and purpose limitation settings before telematics data use | Preventive | Per project and change | [@dpo] | DPIA, configuration record | CR-02 |
| CTL-04 *(Example)* | Route planning blocks plans that breach driving-time limits; weekly tachograph infringement review | Preventive and detective | Continuous; weekly | [@head-of-fleet] | Tool configuration, review log | CR-03 |
| CTL-05 *(Example)* | Sanctions screening of customers, consignees and agents at onboarding and on list update | Preventive | Per onboarding; daily rescreen | [@trade-compliance-lead] | Screening logs, alert dispositions | CR-04 |
| CTL-06 *(Example)* | Supplier code acceptance and risk-based audits of subcontracted hauliers | Preventive and detective | Per contract; yearly audits | [@procurement-lead] | Signed codes, audit reports | CR-05 |
| CTL-07 *(Example)* | Quarterly compliance monitoring of payments to agents and of telematics access logs | Detective | Quarterly | [@cco] | Monitoring report | CR-01, CR-02 |
| CTL-08 *(Example)* | Confidential reporting channel with anti-retaliation monitoring of reporters for 12 months | Preventive and detective | Continuous | [@cco] | Case system, monitoring notes | CR-06 |
| [CTL-NN] | [control] | [type] | [frequency] | [@owner] | [evidence] | [CR-NN] |

### 7.3 Raising concerns (clause 8.3)

| Element | Design |
|---|---|
| Channels | [Web and phone channel run by an independent provider, email to the compliance function, in person] |
| Who can report | Personnel, agents, suppliers, customers, and others in a work-related relationship |
| Anonymity and confidentiality | [Anonymous reports accepted; identity shared only on a need-to-know basis] |
| Protection | No retaliation; reported retaliation is itself investigated (CTL-08) |
| Acknowledgement and feedback | [Timelines set by the applicable whistleblowing law and the policy in `compliance/whistleblowing-policy`] |

### 7.4 Investigation processes (clause 8.4)

1. Triage each concern within [n] working days: in scope, urgency,
   conflicts of interest of potential investigators.
2. Appoint an investigator who is independent of the area concerned
   and competent for the subject.
3. Plan the investigation: questions, evidence, interviews, legal
   privilege, data protection, preservation of records.
4. Report findings to the decision maker named in the investigation
   procedure, and record the outcome and remediation.
5. Feed root causes into section 9 (corrective action) and section 3
   (risk reassessment).
6. Report numbers and themes, without identifying reporters, to the
   governing body (section 8.2).

Use `compliance/fraud-investigation-report` for the investigation
report format.

## 8. Performance evaluation (clause 9)

<!-- Guidance: Clause 9 asks for monitoring, indicators, compliance reporting, records, internal audit and a management review by both the governing body and top management. Pitfall: reporting activity counts (trainings delivered) without outcome measures (infringements, substantiated cases, repeat findings). -->

### 8.1 Monitoring and indicators (clause 9.1)

| Indicator ID | Indicator | Source of feedback | Type | Threshold | Owner |
|---|---|---|---|---|---|
| KPI-01 *(Example)* | Agents with due diligence under 24 months old | Due diligence system | Leading | Below 100 percent triggers escalation | [@cco] |
| KPI-02 *(Example)* | Driving-time infringements per 1,000 driver days | Tachograph analysis | Lagging | Above [target] for two months | [@head-of-fleet] |
| KPI-03 *(Example)* | Concerns raised per 100 employees, and share substantiated | Case system | Lagging | Sharp fall or rise investigated | [@cco] |
| KPI-04 *(Example)* | Sanctions alerts cleared within service level | Screening tool | Leading | Below 95 percent | [@trade-compliance-lead] |
| KPI-05 *(Example)* | Overdue corrective actions | CAPA log | Leading | Any action more than 30 days overdue | [@cco] |

### 8.2 Compliance reporting (clause 9.1)

The compliance function reports to top management monthly and to the
governing body quarterly. Each report covers: changes to obligations,
risk register movements, indicator results against thresholds,
concerns and investigations (anonymised), noncompliance and corrective
actions, training completion and resource needs. Material
noncompliance is escalated to the committee chair without waiting for
the quarterly report.

### 8.3 Internal audit (clause 9.2)

Audit the CMS against this manual and ISO 37301 on a risk-based
programme so that each clause and each high inherent risk is covered at
least every [n] years. Keep auditors independent of the areas they
audit. Use `compliance/internal-audit-program` for the programme.

### 8.4 Management review (clause 9.3)

Top management reviews the CMS at least yearly and the governing body
reviews the results. Inputs: status of previous actions, changes in
issues and obligations, performance against objectives and indicators,
audit results, concerns and investigations, nonconformities and
corrective actions, adequacy of resources, opportunities for
improvement. Outputs: decisions on improvement, changes to the CMS and
resources. Record it with `compliance/management-review`.

## 9. Improvement (clause 10)

<!-- Guidance: Every noncompliance and nonconformity gets a response: contain, correct, find the root cause, prevent recurrence and check that it worked. Pitfall: closing actions on completion rather than on proof that they worked. -->

### 9.1 Continual improvement (clause 10.1)

Sources of improvement: indicator trends, audit findings, investigation
root causes, regulatory enforcement in the sector, feedback from
interested parties and benchmarking. Improvements are prioritised in
the management review.

### 9.2 Nonconformity, noncompliance and corrective action (clause 10.2)

| NC ID | Source | Description | Immediate correction | Root cause | Corrective action | Owner | Due | Effectiveness check |
|---|---|---|---|---|---|---|---|---|
| NC-01 *(Example)* | Internal audit | Two agents in a new market appointed without completed due diligence | Payments suspended pending due diligence | Regional office unaware of CTL-01 | Block agent set-up in the supplier system until approval is recorded | [@cco] | YYYY-MM-DD | KPI-01 at 100 percent for two quarters |
| [NC-NN] | [source] | [description] | [correction] | [cause] | [action] | [@owner] | YYYY-MM-DD | [check] |

Record details in `compliance/capa-nonconformity`.

## 10. Traceability matrix

<!-- Guidance: Every obligation should reach at least one risk, every risk at least one control, and every control at least one indicator or monitoring activity. Gaps in this table are gaps in the CMS. -->

| Obligation | Risk | Controls | Indicators or monitoring | Objective |
|---|---|---|---|---|
| OB-001 *(Example)* | CR-02 | CTL-03, CTL-07 | CTL-07 quarterly report | [None yet] |
| OB-002 *(Example)* | CR-03 | CTL-04 | KPI-02 | OBJ-02 |
| OB-003 *(Example)* | CR-01 | CTL-01, CTL-02, CTL-07 | KPI-01 | OBJ-01 |
| OB-004 *(Example)* | CR-06 | CTL-08 | KPI-03 | OBJ-03 |
| OB-005 *(Example)* | CR-04 | CTL-05 | KPI-04 | [None yet] |
| OB-006 *(Example)* | CR-05 | CTL-06 | Haulier audit results | [None yet] |
| OB-007 *(Example)* | [Not yet assessed] | [None yet] | [None yet] | [None yet] |

In the example, OB-007 (the emissions reporting commitment) has no risk
assessment yet: add it at the next reassessment.

```mermaid
flowchart LR
  OB["Obligations register (4.5)"] --> RA["Compliance risk assessment (4.6)"]
  RA --> PL["Objectives and actions (6)"]
  PL --> CT["Controls and procedures (8.2)"]
  CT --> MO["Monitoring and indicators (9.1)"]
  RC["Raising concerns and investigations (8.3, 8.4)"] --> MO
  MO --> AU["Internal audit (9.2)"]
  AU --> MR["Management review (9.3)"]
  MO --> MR
  MR --> IM["Improvement and corrective action (10)"]
  IM --> RA
```

## 11. Glossary and references

<!-- Guidance: Keep dates on every legal reference and recheck them at each management review. -->

### 11.1 Glossary

| Term | Meaning in this template |
|---|---|
| Compliance obligation | A requirement the organisation must meet, or a commitment it chooses to meet |
| Compliance requirement | An obligation the organisation has no choice about, such as a law |
| Compliance commitment | An obligation the organisation chooses, such as a contract term or voluntary code |
| Compliance risk | The likelihood and consequences of not meeting compliance obligations |
| Noncompliance | Not meeting a compliance obligation |
| Nonconformity | Not meeting a requirement of the CMS itself |
| Compliance function | The people with responsibility and authority for operating the CMS |
| Governing body | The board or equivalent group with ultimate accountability |

### 11.2 Clause map

| ISO 37301:2021 clause | Topic (short paraphrase) | Section here |
|---|---|---|
| 4.1 to 4.4 | Context, interested parties, scope, the CMS | 1 |
| 4.5 | Compliance obligations | 2 |
| 4.6 | Compliance risk assessment | 3 |
| 5.1 | Leadership and commitment, culture, governance | 4.1 |
| 5.2 | Compliance policy | 4.2 |
| 5.3 | Roles, responsibilities and authorities | 4.3 |
| 6.1 to 6.3 | Risks and opportunities, objectives, planning of changes | 5 |
| 7.1 to 7.5 | Resources, competence, awareness, communication, documented information | 6 |
| 8.1 to 8.4 | Operational control, controls and procedures, raising concerns, investigations | 7 |
| 9.1 to 9.3 | Monitoring and reporting, internal audit, management review | 8 |
| 10.1 to 10.2 | Continual improvement, nonconformity and corrective action | 9 |

### 11.3 References

| Reference | Edition or date | Use |
|---|---|---|
| ISO 37301, Compliance management systems, Requirements with guidance for use | First edition, 2021-04; Amendment 1:2024 (climate action changes); ISO lists it as reviewed and confirmed in 2026 | Structure and clause references |
| ISO 37001, Anti-bribery management systems | 2025 | Anti-bribery detail, see `compliance/iso-37001-anti-bribery` |
| ISO 37002, Whistleblowing management systems | 2021 | Guidance for section 7.3 |
| Regulation (EU) 2016/679 (GDPR) | Applies from 25 May 2018 | Example obligation OB-001 |
| Regulation (EC) No 561/2006, as amended | Check the consolidated text on EUR-Lex | Example obligation OB-002 |
| UK Bribery Act 2010 | Section 7 | Example obligation OB-003 |
| Directive (EU) 2019/1937 | 23 October 2019, transposition deadline 17 December 2021 | Example obligation OB-004 |
| US Department of Justice, Evaluation of Corporate Compliance Programs | Check the current version on justice.gov | Optional benchmark for programme effectiveness questions |

## Standard and licence note

Structure aligned with ISO 37301:2021, *Compliance management systems,
Requirements with guidance for use* (first edition, April 2021, with
Amendment 1:2024, climate action changes). ISO lists the standard as
reviewed and confirmed in 2026. Clause numbers and topics are cited
from public summaries and the ISO catalogue; confirm subclause
numbering in your licensed copy. This template is original text
written for this collection and reproduces no text from the standard.
The laws in the example are dated EU, UK and US illustrations, not a
statement of what applies to any organisation; check the current
official texts. The organisation, people and figures are fictional.
This is a documentation format, not legal advice; consult a qualified
professional.

Official text: ISO, purchase or licensed access:
https://www.iso.org/standard/75080.html (also available from national
standards bodies).

Template licence: MIT.