Templates and records · ISO 37301
ISO 37301 templates and records
Eight records that hold up a compliance management system, each with the clause that calls for it, its fields, a completed example and what auditors tend to flag.
In one sentence
ISO 37301 requires the compliance obligations (4.5) and the policy (5.2) to be kept documented, and the compliance risk assessment (4.6), training records (7.2.3), the documentation of each investigation (8.4) and accurate, up-to-date records of compliance activities (9.1.5) to be retained; in Spain the whistleblowing channel is also governed by Law 2/2023, which imposes its own register.
- Edition
- ISO 37301:2021 Certifiable; replaced the ISO 19600:2014 guidance
- Activity records
- Accurate and up to date Clause 9.1.5
- Raising concerns
- Clause 8.3 Plus Law 2/2023 for companies with 50 or more employees
- Statutory register
- Maximum 10 years Art. 26.2 of Law 2/2023
Contents
ISO 37301 templates and records
Clauses follow ISO 37301:2021, the current edition, which replaced the ISO 19600 guidance standard.
Compliance obligations register
How to document the compliance obligations ISO 37301 asks for: mandatory requirements and voluntary…
Compliance risk matrix
How to document an ISO 37301 compliance risk assessment: obligation, activity, causes, likelihood…
Compliance policy
What an ISO 37301 compliance policy must contain: commitments, independence of the compliance function…
Whistleblowing register
What the register of reports received through the whistleblowing channel must hold under Law 2/2023 and ISO…
Investigation report
What a compliance investigation report must record: facts, inquiries made, rights of the person…
Third-party due diligence
How to document due diligence on partners, agents and suppliers in an ISO 37301 system: third-party risk…
Compliance training plan
How to plan and record ISO 37301 compliance training: by role and risk exposure, with frequency, assessment…
Report to the governing body
What the compliance function’s periodic report to the board should include under ISO 37301: indicators…
Frequently asked questions
What people ask us before getting started
Which records are mandatory under ISO 37301?
The compliance obligations (4.5), the risk assessment and the actions to address risks (4.6), the scope (4.3), the policy (5.2), the objectives (6.2), evidence of competence and training records (7.2), evidence of communication (7.4), the documentation of investigations (8.4), monitoring results (9.1), activity records (9.1.5), audits (9.2), management review (9.3) and nonconformities and noncompliance (10.2).
What about ISO 19600?
It was withdrawn when ISO 37301 was published in 2021. It was a set of recommendations and could not be certified; anyone running a system built on it should take ISO 37301 and its records as the reference.
Can these records serve as evidence in court?
They can help. Article 31 bis of the Spanish Criminal Code weighs whether the legal entity had an effective prevention model in place before the offence, and a system with dated, consistent records is the way to prove it. Certification does not guarantee exemption.
Keep your ISO 37301 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 37301:2021 — Compliance management systems. Requirements with guidance for use ISO · April 2021
- Law 2/2023 on the protection of persons who report regulatory breaches and on the fight against corruption BOE-A-2023-4513 · 21 February 2023
- Organic Law 10/1995, Spanish Criminal Code, art. 31 bis BOE-A-1995-25444 · Consolidated text