Comparison · compliance
ISO 37301 or ISO 19600: which applies today
This is the easiest comparison of the lot to settle, because one of the two no longer exists. It still turns up in tenders, internal manuals and consultancy offers, so it is worth being clear about what happened and what to do if your documentation still mentions it.
The short answer
There is no choice to make: ISO 19600:2014 is withdrawn, superseded in April 2021 by ISO 37301, and no body certifies against it any more. The underlying difference is that 19600 was guidance — it recommended — while 37301 states the same content as requirements, which is what makes it auditable by a third party. If your manual still cites it, the job is not to rebuild the system: it is to update the references and check the few points where a recommendation became an obligation.
- ISO 37301:2021
- Current and certifiablePublished April 2021
- ISO 19600:2014
- WithdrawnRetired after ISO 37301 was published
Side by side
What actually changes between the two
| Criterion | ISO 37301:2021 | ISO 19600:2014 |
|---|---|---|
| Status | Current | Withdrawn and removed from the catalogue |
| Nature | Requirements: it says what "shall" be done | Guidelines: it said what "should" be done |
| Certifiable | Yes, by an accredited body | No, it never was |
| Published | April 2021 | December 2014 |
| Structure | Annex SL, integrable with ISO 9001 and 27001 | Aligned with Annex SL without requiring it |
| Compliance function | Independence and direct access to the governing body, as a requirement | Recommended independence without requiring it |
| Whistleblowing channel | Required, and mandatory in Spain from 50 people under Law 2/2023 | Mentioned as good practice |
| Sibling standard | ISO 37001 anti-bribery; in Spain, UNE 19601 and UNE 19602 | No certifiable equivalent |
How to decide
When to look at each
ISO 37301:2021
It applies to any new case
- You want the system certified by an accredited third party
- A customer or a tender requires evidence of your compliance system
- You need the model to serve as evidence of diligence before a court
- You are starting from scratch with no legacy documentation
ISO 19600:2014
Only useful now as reading
- Your manual cites it and you need to know what carries over
- You want to understand where the compliance risk approach came from
- You are reviewing old documentation and the reference appears
- No body issues certificates against it any more
Frequently asked questions
What people ask us before getting started
Can I still certify against ISO 19600?
No. The standard is withdrawn and no accredited body issues certificates against it. If someone offers to, it is worth asking exactly which document they are auditing against.
Our manual cites ISO 19600. Do we have to redo it?
No, updating it is enough. The structure and the compliance risk approach carry over almost unchanged; what shifts is that several recommendations become requirements, particularly around the independence of the compliance function and evidence that the governing body is involved.
How does this relate to criminal compliance?
ISO 37301 is a management standard, not a criminal one. What it contributes is an ordered, audited system that can support the effectiveness of the organisation and management model under art. 31 bis of the Spanish Criminal Code. In Spain, UNE 19601 is the specific reference for criminal compliance and UNE 19602 for tax compliance.
And ISO 37001?
That is the anti-bribery standard, narrower in scope: it focuses on one specific risk. ISO 37301 covers the whole compliance system, and both can be certified separately or together.
Does it work for the public sector?
Yes. ISO 37301 does not distinguish by sector or size, and its approach of compliance obligations fits an administration as well as a company.
How long does migrating take?
If the system genuinely ran on 19600, a few weeks: review references, formalise the independence of the compliance body and leave evidence of the reviews. What usually stretches the project is discovering the system existed more on paper than in practice.
We put your compliance system on the current standard
We'll show you the module running with data similar to yours.
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 37301:2021 — Compliance management systems. Requirements with guidance for use ISO · April 2021
- ISO 19600:2014 — Compliance management systems. Guidelines (withdrawn) ISO · Withdrawn
- Organic Law 10/1995, Spanish Criminal Code, art. 31 bis BOE-A-1995-25444 · Consolidated text
- Law 2/2023 on the protection of persons who report regulatory breaches BOE-A-2023-4513 · 21 February 2023
Keep exploring
Related pages
ISO 37301, without folders or surprises
A certifiable compliance management system, the successor to ISO 19600, with risks, controls and a…
ISO 19600, without folders or surprises
Guidance for a compliance management system, the predecessor of ISO 37301, with a documented risk map and…
IFS Food or BRCGS: whichever your customer asks for
Both are GFSI-recognised and cover the same ground. What really separates them: scoring system, KO and…
ISO 17025 or ISO 15189: it depends on the sample
Which accredits a testing laboratory and which a medical one, what they share since the 2022 edition, and…
Differences between ISO 37301 and ISO 19600
ISO 19600:2014 was the first international guidance on compliance management systems, but it is withdrawn: in April 2021 it was replaced by ISO 37301, which turned those guidelines into requirements and thereby made the system certifiable by an accredited body.
Migration rarely means rebuilding the system. It usually means updating the manual references, formalising the independence of the compliance function and evidencing the involvement of the governing body, which are the points where a recommendation became an obligation.