Document control
Versions, approvals and distribution with read receipts.
Software for ISO 37301
ISO 37301, without folders or surprises
A certifiable compliance management system, the successor to ISO 19600, with risks, controls and a whistleblowing channel in one system.
What it is and which edition applies
ISO 37301 is the certifiable standard for compliance management systems. In 2021 it replaced ISO 19600, which only offered guidelines. It requires identifying compliance obligations and their associated risks, establishing proportionate controls, giving the compliance function genuine independence, providing a channel to raise concerns without retaliation, and demonstrating the governing body's commitment through facts rather than statements.
- Current edition
- ISO 37301:2021 Published April 2021
- Standard replaced
- ISO 19600:2014 That was guidance; ISO 37301 is certifiable
- Key requirement
- Independence of the compliance function With direct access to the governing body
- Whistleblowing channel
- Required by the standard and by law Law 2/2023 in Spain, for companies with 50 or more people
- Related standard
- ISO 37001:2016 Anti-bribery management systems
Connected to your document cloud
Publish and version documents by connecting to OneDrive, Google Drive or SharePoint, without duplicating folders.
Audits
Annual program, checklists per standard, findings linked to actions.
Non-conformities
Root cause, action, owner, deadline and effectiveness check.
KPIs
Process objectives fed with real operating data.
Legal requirements
A register of legal and other requirements, with validity and compliance evaluation per standard.
Corrective actions
Root cause, action, owner, deadline and effectiveness check, all linked to the nonconformity.
Improvement actions
Improvement opportunities with an owner and tracking, beyond just fixing what already failed.
Management review
A pre-built report with indicators, audits and nonconformities, ready for the meeting.
Certifiable system
Risks, controls and a whistleblowing channel in a single system.
Whistleblowing channel
Every case with its traceability through to closure.
Risk map by area
Nonconformity risks identified and prioritized by area.
Management review
Compliance report ready for the periodic system review.
Requirements covered
What it solves for ISO 37301
- Compliance risk map by area
- Compliance policy and procedures
- A whistleblowing channel with case traceability
- Role-based compliance training
- Nonconformities and corrective actions
- Internal audits and management review
Standards covered
Pick your standard and see what it solves
GMP+
Animal feed safety
Food industry · animal feed
IATF 16949
Automotive
Automotive
SQAS2022
Chemical and logistics assessment
Quality · chemical and logistics
ISO 19600
Compliance management systems
Compliance · guidance
ISO 37301
Compliance management systems
Compliance
ISO 22716
Cosmetics manufacturing
Quality · cosmetics
GDPR
Data protection
Legal · data protection
ISO 14001
Environmental management
Environment
SGE 21
Ethical and responsible management
Social responsibility
IFS Food
Food safety
Food industry
FSSC 22000
Food safety management system
Food industry
BRCGS
Global food standard
Food industry
ISO 14064
Greenhouse gases
Environment · carbon footprint
HACCP
Hazard analysis and critical control points
Food industry
ISO 27001
Information security
Cybersecurity
ISO 20000
IT service management
Quality · IT services
ISO 13485
Medical devices
Healthcare
ISO 15189
Medical laboratories
Quality · healthcare
ENS
National Security Framework
Security · public sector
UNE 73401
Nuclear quality assurance
Quality · nuclear
ISO 45001
Occupational health and safety
Health & safety
ISO 9001
Quality management
Quality · every sector
ISO 26000:2010
Social responsibility
Social responsibility · guidance
Sustainability
Sustainability management
ESG
UNE 19602
Tax compliance
Compliance · tax
ISO 17025
Testing and calibration laboratories
Quality · laboratories
Frequently asked questions
What people ask us before getting started
Which edition of the standard is current?
The edition in force is ISO 37301:2021. When the issuing body publishes a new one, a transition period opens; once it closes, certificates issued against the previous edition stop being valid.
Does this work if we are already certified?
Yes. Your existing system — processes, documents, records, audit history — is loaded in and kept alive from day one. Nothing needs redesigning and the certification cycle does not restart.
Will the auditor accept digital records?
Yes, provided they are traceable, controlled and able to show who did what and when. No standard requires paper; every standard requires reliable evidence, and a properly controlled electronic record provides it better than a folder.
Can it be combined with other standards?
Yes, and that is the sensible route. The common Annex SL structure lets a single integrated system share the process map, document control, internal audits, nonconformities and indicators between ISO 37301 and the rest, leaving only the standard-specific parts separate.
How long does it take to be ready for an audit?
It depends on the starting point. An organisation already working with written procedures is usually ready in two or three months; one starting from scratch needs longer. The bottleneck is rarely the tool — it is the availability of the people who know the processes.
What happens to the documentation we already have?
It is migrated. Existing procedures, forms and records are loaded with their version and approver, so the history is not lost and the system starts with the memory the organisation already had.
Can the auditor look directly at the system?
Yes. They are given read-only access with a defined scope and an expiry date. It is more comfortable for both sides than preparing a folder of screenshots and exports.
What is the difference between a major and a minor nonconformity?
A major one compromises the system's ability to meet a requirement — a required process missing altogether, systematic failure, or a failure affecting the product — and usually blocks certification until it is closed. A minor one is a specific lapse resolved with an action plan.
Are the indicators calculated automatically?
Yes, from the data the processes themselves generate. That is the difference between a dashboard that reflects what is happening and a spreadsheet somebody fills in the week before the management review.
Does it work across several sites or legal entities?
Yes. The model is multi-company and multi-site: what makes sense to share is shared, and what belongs to each location stays separate — including the certificate scope where it differs.
Get ready for your ISO 37301
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
ISO 37301 or ISO 19600: which applies today
ISO 19600 was withdrawn in 2021 and replaced by ISO 37301, which is certifiable. What changed, what carries…
ISO 37301 · Compliance management systems
A free learning path on ISO 37301: the compliance management system's seven clauses explained with examples…
Legal requirements, tracked one by one
Register the legal requirements that apply to you, get an alert when the regulation changes, and…
Your management system stops being a folder
Living documentation, planned audits, non-conformities with an owner, and indicators that calculate…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 37301:2021 — Compliance management systems. Requirements with guidance for use ISO · April 2021
- Ley 2/2023 on the protection of persons who report regulatory breaches BOE-A-2023-4513 · 21 February 2023
- ISO 37001:2016 — Anti-bribery management systems ISO · 2016 ed.
Software for ISO 37301 — Compliance management systems
Kimobox is a software for ISO 37301 that digitizes the requirements of the standard: compliance risk map by area, compliance policy and procedures, a whistleblowing channel with case traceability, role-based compliance training, with full traceability and evidence ready for the auditor.
The platform lets you run an integrated management system that combines ISO 37301 with other ISO standards and sector protocols, sharing the process map, document control, internal audits, non-conformities and KPIs.