ISO Compliance Insights & Best Practices

ISO 37301 vs ISO 19600: The Clear Guide to What Changed (2026)

ISO 37301 vs ISO 19600 is a comparison between a standard you can certify to and one you never could. ISO 19600:2014 was guidance — “Compliance management systems — Guidelines” — written entirely in “should”, auditable by nobody, and useful as a description of good practice. ISO 37301:2021 replaced it in April 2021 as “Compliance management systems — Requirements with guidance for use”, and its foreword names exactly two main changes: it “now contains requirements with additional guidance for use based on those requirements”, and it “follows ISO’s requirements for a harmonized structure for management system standards”.

Those two sentences change everything downstream — the compliance function, the obligations register, the risk assessment, the culture requirement and the raising-concerns route became things an accredited certification body tests rather than things a consultant recommends. ISO 19600 is withdrawn; ISO 37301 has a free 2024 climate amendment and was confirmed unchanged by ISO in 2026. This guide sets out what changed clause by clause, what the shift from “should” to “shall” means for a system built on the old guidance, the five requirements that catch ISO 19600 users out, and how to migrate documentation that still cites the withdrawn text.

ISO 37301 vs ISO 19600: from guidelines to certifiable requirements — ISO 19600:2014 — guidelines, ‘should’, not certifiable, withdrawn · ISO 37301:2021 — requirements with guidance, ‘shall’, harmonized structure, certifiable, Amd 1:2024, confirmed 2026.

ISO 37301 vs ISO 19600 at a glance

Dimension	ISO 19600:2014	ISO 37301:2021
Title	Compliance management systems — Guidelines	Compliance management systems — Requirements with guidance for use
Status	Withdrawn; replaced by ISO 37301	Published April 2021; Amd 1:2024 (climate change); reviewed and confirmed 2026 (stage 90.93)
Type	Type B guidance standard — recommendations only	Type A requirements standard — “shall” clauses with Annex A guidance
Certifiable	No	Yes, by accredited certification bodies
Structure	Broadly aligned with the high-level structure of the time	ISO harmonized structure: clauses 4–10, identical core text, common terms
Committee	ISO/PC 271 (project committee)	ISO/TC 309, Governance of organizations
Compliance obligations and risk	Recommended identification and assessment	4.5 Compliance obligations and 4.6 Compliance risk assessment as requirements
Compliance function	Recommended role	3.23 defined; responsibility and authority for the CMS required; access to the governing body
Culture	Discussed as a success factor	3.28 defined; the introduction states organisations “need to establish and maintain a culture of compliance”; requirements follow
Raising concerns and investigation	Recommended	8.3 and 8.4 as requirements

ISO 37301 vs ISO 19600 clause by clause

ISO 37301:2021 clause	What it requires	How ISO 19600 treated it
4.1–4.4 Context and CMS	Determine external and internal issues, interested parties and their requirements, the scope, and establish the CMS; Amd 1:2024 adds climate change as a context consideration	Recommended context analysis
4.5 Compliance obligations	Systematically identify and maintain the obligations — mandatory and voluntarily chosen (3.25) — and their implications	Recommended; the register was good practice, not a requirement
4.6 Compliance risk assessment	Identify, analyse and evaluate compliance risks — the likelihood and consequences of noncompliance (3.24) — and review on change	Recommended assessment
5 Leadership	Governing body and top management commitment; compliance policy; roles — the compliance function, management and personnel	Recommended commitment
6 Planning	Actions to address risks and opportunities to the CMS; compliance objectives; planning of changes	Recommended objectives
7 Support	Resources, competence, awareness, communication, documented information	Recommended
8.1 Operational planning and control	Processes planned, implemented and controlled	Recommended
8.2 Establishing controls and procedures	Controls proportionate to the assessed compliance risks	Recommended controls
8.3 Raising concerns	A mechanism for reporting suspected noncompliance with protection for the person raising it	Recommended
8.4 Investigation processes	Documented investigation of noncompliance	Recommended
9 Performance evaluation	Monitoring and measurement; internal audit; management review	Recommended
10 Improvement	Nonconformity and corrective action; continual improvement	Recommended

Every row on the right is a “shall” — that is the whole of ISO 37301 vs ISO 19600 in one column. The content is recognisably ISO 19600’s — the drafters kept the model — but an organisation that “aligned with ISO 19600” can now be non-conformant in ways it could never be before. Our guide to ISO 37301 covers what the certifiable standard contains.

ISO 37301 vs ISO 19600: five requirements that catch users out

The obligations register is auditable. Under ISO 19600 a list of laws passed as alignment. Under ISO 37301 clause 4.5 the register must state what each obligation requires of the organisation in its operations, who owns it and how it is kept current — and 4.6 must trace each to a risk. Our guide to the compliance obligations register covers the build.
The compliance function needs authority and access. ISO 37301 defines it as “person or group of persons with responsibility and authority for the operation of the compliance management system” and adds that “preferably one individual will be assigned to the oversight”; the governing body — defined at 3.21 as the body “to which top management reports and by which top management is held accountable” — must be reachable. A compliance role reporting to the commercial director it must challenge fails in substance. Our guide to the compliance function covers independence.
Culture is a requirement with evidence. Compliance culture is defined (3.28) as “values, ethics, beliefs and conduct that exist throughout an organization and interact with the organization’s structures and control systems to produce behavioural norms that are conducive to compliance”. A values poster is not evidence; decisions, consequences and behaviour are. Our guide to compliance culture covers the signals auditors look for.
Raising concerns and investigation are clauses, not options. 8.3 and 8.4 require a protected route and a documented process; ISO 37002 provides whistleblowing guidance.
The harmonized structure moved the clause numbers. Documentation cross-referenced to ISO 19600 clauses no longer maps; an auditor reading old numbers treats the system as unmaintained.

ISO 37301 vs ISO 19600 in practice: migrating

Step	What to do	Output
1 Retire the citation	Replace every reference to ISO 19600:2014 with ISO 37301:2021 (and Amd 1:2024); the old standard is withdrawn	Updated policy, manual and procedures
2 Re-map the structure	Cross-reference existing documents to clauses 4–10 of ISO 37301; identify gaps where a ‘should’ you skipped is now a ‘shall’	Gap register
3 Rebuild the obligations register	By operation, with owners, requirements and review dates; link to the risk assessment (4.6)	Register and risk assessment
4 Fix the function	Define responsibility, authority, competence, independence and access to the governing body	Roles and reporting lines
5 Evidence culture	Governing-body decisions, consequences for noncompliance, communication, training records, survey data	Culture evidence file
6 Run the cycle	Internal audit and management review against ISO 37301; corrective actions; then certification if wanted	Audit-ready CMS

Frequently asked questions

Is ISO 19600 still valid?
No. ISO 19600:2014 was withdrawn when ISO 37301:2021 replaced it in April 2021. Documents, tenders and policies that cite ISO 19600 should be updated.

What are the main differences between ISO 37301 and ISO 19600?
ISO 37301’s foreword names two: it contains requirements (with guidance) rather than guidelines, and it follows ISO’s harmonized structure. The consequence is that a compliance management system can now be certified, and its obligations register, risk assessment, compliance function, culture, raising-concerns route and investigation process are tested against ‘shall’ clauses.

Can we be certified to ISO 19600?
No, and you never could — it was a guidance standard. Certification is available only against ISO 37301:2021.

Does ISO 37301 have an amendment?
Yes, Amd 1:2024 on climate change, added to the context clause; ISO confirmed the standard unchanged in its 2026 systematic review, so it is stable ground.

How does ISO 37301 relate to ISO 37001?
ISO 37301 covers all compliance obligations at a generic level; ISO 37001:2025 covers bribery in depth. Many organisations nest ISO 37001 inside an ISO 37301 system; our guide to ISO 37001 vs ISO 37301 covers the combination.

Where this leaves you

Treat ISO 37301 vs ISO 19600 as a change of kind, not degree: the model is the same, the verb changed, and with it the consequences. Retire the old citation, re-map to clauses 4–10, rebuild the obligations register with owners and risk links, give the compliance function authority and access, evidence the culture, and run the audit-and-review cycle — because a system that aligned with ISO 19600 is not yet one that conforms to ISO 37301.

References

ISO 37301:2021 — Compliance management systems — Requirements with guidance for use — First edition, April 2021; Amd 1:2024; confirmed 2026. The foreword’s two main changes and clause 3 definitions are readable on the ISO Online Browsing Platform.
ISO 19600:2014 — Compliance management systems — Guidelines — Withdrawn; replaced by ISO 37301:2021.

More on ISO 37301

ISO 37301 vs ISO 19600 — you are here
ISO 37301 explained
The compliance obligations register
Compliance risk assessment: clause 4.6
The compliance function
ISO 37301 certification cost

The compliance policy and manual, the obligations register, the compliance risk assessment, the compliance function charter, the raising-concerns and investigation procedures and the audit set — written to ISO 37301:2021 — are in the ISO 37301 Compliance Management Toolkit, or start with the free templates.

Governance Docs

Governance Docs LLC