Commitment and compliance culture
Management promotes a visible compliance culture, beyond a signed policy.
Independence of the compliance function
The compliance officer must have direct access to the top governing body and the authority to act without interference.
Compliance policy
A commitment to meet applicable obligations, to continually improve, and to protect anyone who reports in good faith from retaliation.
What an auditor usually asks for
- A compliance officer with documented independence
- A compliance policy that is signed and communicated
- Direct access from the compliance officer to the governing body
- Evidence of a compliance culture across the organization
How to cover leadership in Kimobox
- 1Assign the compliance officer and their authority level directly in the system.
- 2Publish the compliance policy as a controlled document.
- 3Log the compliance officer's communications to the governing body.
The compliance function's independence stays documented, not just stated on the org chart.
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 37301:2021 — Compliance management systems. Requirements with guidance for use ISO · April 2021
- Ley 2/2023 on the protection of persons who report regulatory breaches BOE-A-2023-4513 · 21 February 2023
- ISO 37001:2016 — Anti-bribery management systems ISO · 2016 ed.