Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

ISO draws attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.

This document was prepared by Technical Committee ISO/TC 309, Governance of organizations.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

An effective compliance management system supports an organization. It enables the organization to demonstrate its commitment to complying with:

relevant laws;
regulatory requirements;
industry codes;
organizational standards;
standards of good governance;
generally accepted best practices;
ethics;
the expectations of the interested parties.

Compliance becomes sustainable when it is embedded in the culture of the organization and in the behaviour and attitude of personnel under the control of the organization. Embedded compliance positively influences the compliance performance of the organization.

ISO 37301 sets out the requirements and provides guidance for establishing, developing, implementing, evaluating and improving an effective and responsive compliance management system within an organization. This document provides guidance to support the implementation of the requirements in ISO 37301 related to evaluating the performance of a compliance management system (including monitoring, measurement, analysis, evaluation and management reviews) and thus ensuring continual improvement in any type of organization.

The framework can also be used to evaluate the effectiveness of other types of compliance management systems.

1 Scope

This document establishes principles and an evaluation indicator framework for assessing the effectiveness of a compliance management system. This includes evaluation criteria for specified indicators. This document also provides guidance as well as suggestions on the evaluation model.

The guidance provided in this document aims to support the monitoring, measurement, analysis and evaluation of a compliance management system. It aims to support management review of the compliance management system to foster continual improvement. It does not add to, change or otherwise modify requirements for compliance management systems or any other standards.

This document is applicable to the activities for evaluating the effectiveness of the compliance management system in all organizations, regardless of the type, size and nature, including organizations from the public, private or non-profit sector.

2 Normative references

3 Terms and definitions

4 General principles

5 Evaluation methodology

5.1 General

5.2 Evaluation scales

5.3 Evaluation indicator framework

6 Evaluation criteria

6.1 Planning and establishment of the compliance management system

6.2 Implementation of the planned compliance management system

6.3 Evaluating performance and improvement of the compliance management system

7 Evaluation process

7.1 Objectives

7.2 Structured approach

7.3 Evaluators

7.4 Evaluation method