Templates and records · ISO 37301 · Clause 5.2
ISO 37301 compliance policy template
The governing body’s commitment to compliance, written so that anyone knows what is expected of them, what happens if they fall short and how to raise a concern without fear.
In one sentence
The compliance policy is the document approved by the governing body that commits the organisation to meeting its obligations and improving the system, backs the independence of the compliance function, explains the consequences of noncompliance and encourages people to report suspicions without retaliation; ISO 37301 requires it to be documented, communicated and available (5.2).
- Where the standard requires it
- ISO 37301 · Clause 5.2 Clauses follow ISO 37301:2021, the current edition, which replaced the ISO 19600 guidance standard.
- Type of information
- Mandatory document Documented information to be maintained (5.2)
- Who fills it in
- Governing body Approves it; the compliance function drafts it and proposes reviews
- When
- When the system is introduced And at each management review or significant change in structure or activity
- How long it is kept
- Current and previous versions Superseded versions show since when the commitment existed
What the standard requires
What ISO 37301 demands and what it leaves to your judgement
The standard asks for a policy appropriate to the organisation’s purpose, providing a framework for objectives, including a commitment to meet obligations and improve the system, and built on the principles of compliance governance: direct access of the compliance function to the governing body, independence and adequate authority.
It must also explain the consequences of noncompliance and encourage people to raise concerns, with an explicit commitment not to retaliate. It is documented, communicated within the organisation and made available to interested parties.
It does not replace the code of ethics or the internal reporting system policy required by Law 2/2023: it frames them. They can be separate documents as long as they are consistent.
Structure
Fields the template should include
- Scope and who it applies to
- Commitment to meet obligations and to continual improvement
- Compliance function: independence, authority and access to the governing body
- Consequences of noncompliance
- How to raise concerns and non-retaliation commitment
- Relationship with the code of ethics and other policies
- Approval: body, date and version
- How it is communicated and where it is available
Example
Example: extract from a distributor’s policy
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Scope | Distribuciones Arlanza (fictitious) and its two subsidiaries, staff, managers and sales agents |
| Commitment | To comply with the law, our contracts and the industry code of ethics we have signed up to, and to improve the system every year |
| Compliance function | The compliance officer reports directly to the board and does not answer to sales management |
| Consequences | Disciplinary measures under the collective agreement and termination of agency contracts |
| Reporting suspicions | Channel on the employee portal, anonymous reports accepted · retaliation prohibited |
| Approval | Board of directors, 20 January 2026 · v2 |
| Distribution | Employee portal with read receipt · published on the corporate website |
At the audit
Mistakes auditors commonly flag
- A signed policy with no evidence that it was communicated to staff.
- No mention of the independence of the compliance function.
- The non-retaliation commitment is missing or the policy points to no channel.
- Approved by the managing director when the system gives that role to the board.
In Kimobox
How this record is kept in Kimobox
- 1The compliance policy is published as a controlled document.
- 2It is communicated through the employee portal with read receipt.
- 3The compliance officer is assigned with their level of authority, and their reports to the governing body are recorded.
Frequently asked questions
What people ask us before getting started
Are the compliance policy and the code of ethics the same thing?
No. The code of ethics sets out expected behaviour; the compliance policy establishes the commitment to the system that makes sure it is followed. Many companies have both, consistent with each other.
Does it have to be published outside the company?
The standard asks for it to be available to relevant interested parties. Publishing it on the website is the simplest way, and it also sends a signal to customers and suppliers.
Keep your ISO 37301 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
UNE 19602 tax compliance policy template
What a UNE 19602 tax compliance policy should include: approval by the governing body, tax risk tolerance…
Leadership
ISO 37301 requires management to lead on compliance and the compliance function to have real independence…
ISO 37301 compliance obligations register template
How to document the compliance obligations ISO 37301 asks for: mandatory requirements and voluntary…
ISO 37301 compliance risk matrix template
How to document an ISO 37301 compliance risk assessment: obligation, activity, causes, likelihood…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.