Compliance Function: The Complete ISO 37301 Guide to Independence

The compliance function is the part of ISO 37301:2021 that organisations most often meet on paper and fail in substance. The standard defines it as the “person or group of persons with responsibility and authority for the operation of the compliance management system” (3.23), adds that “preferably one individual will be assigned to the oversight of the compliance management system”, and places it in a governance triangle with top management and the governing body — the body “to which top management reports and by which top management is held accountable” (3.21). The requirement that trips implementations is independence: a compliance function that reports to the commercial leadership whose decisions it must question has responsibility without authority, and an auditor reading the org chart will say so. This guide sets out what ISO 37301 requires of the function, the four tests of independence, how to size and staff it proportionately, what it owns and what it must never own, how it reports to the governing body, and the five findings auditors raise.

What ISO 37301 requires of the compliance function

The last row is the one that keeps the function honest. ISO 37301 makes compliance everyone’s job — top management demonstrates commitment, managers ensure compliance in their areas, personnel comply — and gives the function the system, not the compliance. A function that owns compliance itself becomes the place accountability goes to die. Our guide to ISO 37301 covers the wider standard.

Four tests of compliance function independence

1. Reporting line. To whom does the head of the function report administratively, and to whom functionally? Functional reporting to the CEO or the governing body with a direct line to the board or its audit or risk committee passes; reporting to a sales, operations or finance leader whose decisions the function assesses fails.
2. Remuneration and appraisal. Who sets the function’s objectives and bonus? If the answer is the leadership it oversees, independence is compromised however the org chart reads.
3. Appointment and removal. Can the head of compliance be removed by a manager it has reported on? The governing body should approve appointment and removal.
4. Operational roles. Does anyone in the function also run an activity it assesses — a compliance manager who is also the sales director, or a DPO who runs the marketing database? Dual roles need documented conflict handling or separation.

Sizing and staffing it proportionately

The standard says implementation “can differ depending on the size and level of maturity of an organization’s compliance management system and on the context, nature and complexity of the organization’s activities and objectives”. A one-person team is compliant if it has the authority, the access and the competence; a twenty-person function is not if it reports to the wrong place.

What the function owns

Our guides to the compliance obligations register and compliance risk assessment cover the two artefacts the function owns outright.

The compliance function and the governing body

1. A standing agenda item, at least quarterly, with the compliance function presenting in its own name.
2. Content: the residual risk profile from 4.6, changes to obligations, monitoring results and trends, concerns raised and investigations, noncompliance and corrective action, resourcing, and the function’s own independence.
3. A private session without executive management at least annually, so the function can speak about the executives.
4. Minutes that record decisions and actions — the 9.3 and 5.1 evidence.
5. An escalation route outside the normal cycle for serious matters.

Five findings auditors raise

• Reports to the function it oversees. The most common and the most serious; the org chart is the evidence.
• Named but not resourced. A title with no time, budget or competence behind it (7.1, 7.2).
• Owns compliance instead of the system. Managers point to the team when asked who is responsible.
• Never reached the board. No minutes show the function reporting to the governing body.
• Dual roles without conflict handling. The compliance lead also runs a regulated activity and no one wrote down how that conflict is managed.

Frequently asked questions

What is the compliance function under ISO 37301?
The person or group with responsibility and authority for the operation of the compliance management system (3.23), preferably with one individual assigned to oversight, resourced and competent, independent of the activities it oversees, and with direct access to the governing body.

Does the function have to be independent?
In substance, yes. It must be able to challenge and report on the activities it oversees, which it cannot do if it reports to, is appraised by or can be removed by the management of those activities.

Can a small company have a one-person compliance function?
Yes. The standard is explicitly adaptable to size and complexity. One named person with authority, access to the board and adequate competence — supported by external advice where needed — meets the requirement.

Is the compliance function the same as internal audit?
No. Internal audit (9.2) must be independent of the team as well as of the business, because it audits the CMS the function operates.

Who is accountable for compliance?
The governing body and top management are accountable; managers are responsible in their areas; personnel comply; the compliance function operates the system that makes all of that visible and evidenced.

Where this leaves you

Give the compliance function a charter the governing body approves, a reporting line that does not run through the activities it oversees, an appraisal and removal route that management cannot control, the resources and competence the standard requires, and a standing place on the board’s agenda. Then keep it in its lane — it owns the system, the register, the assessment and the reporting; the business owns compliance — because that division is what ISO 37301 means by responsibility and authority.

References

• ISO 37301:2021 — Compliance management systems — Requirements with guidance for use — First edition, April 2021; the definitions of compliance function (3.23), governing body (3.21) and personnel (3.22) and the introduction’s adaptability statement are readable on the ISO Online Browsing Platform.
• ISO 37000:2021 — Governance of organizations — Guidance — The governance frame the compliance function reports into.

More on ISO 37301

• The compliance function — you are here
• ISO 37301 explained
• Compliance culture
• Compliance risk assessment: clause 4.6
• Compliance monitoring
• ISO 37301 vs ISO 19600

The Compliance Function Charter, the roles and responsibilities matrix, the governing-body reporting template, the conflict-of-interest procedure and the competence framework are in the ISO 37301 Compliance Management Toolkit, or start with the free templates.