Templates and records · ISO 37301 · Clause 9.1.4
ISO 37301 compliance report to the governing body
What the compliance function tells the board each period: how the system is working, what has happened and which decisions are needed.
In one sentence
The compliance report to the governing body covers the system’s indicators, how risks have evolved, reports received through the channel, breaches and investigations, the status of actions and proposals for improvement; ISO 37301 requires the compliance function to report regularly to the governing body and top management (9.1.4), and the report is retained as an activity record (9.1.5).
- Where the standard requires it
- ISO 37301 · Clause 9.1.4 Clauses follow ISO 37301:2021, the current edition, which replaced the ISO 19600 guidance standard.
- Type of information
- Mandatory record Report required by 9.1.4; retained as an activity record (9.1.5)
- Who fills it in
- Compliance function Presents it to the board or its audit committee; the minutes record the discussion
- When
- At least once a year And immediately in the event of serious breaches
- How long it is kept
- Set by the organisation ISO 37301 sets no periods. In Spain it is wise to take into account the limitation periods of the offences the system aims to prevent, because the record is your evidence of due diligence.
What the standard requires
What ISO 37301 demands and what it leaves to your judgement
The standard requires the governing body and top management to receive accurate and timely information on the performance of the system, and the compliance function to have direct access to report to them.
It is different from the 9.3 management review: that is top management’s analysis of the system; this report is the voice of the compliance function addressed to the body that oversees it, and it is usually one of the review’s inputs.
In court, the board minutes showing the report was received and discussed are the best evidence that oversight existed.
Structure
Fields the template should include
- Period covered
- System indicators: training, controls performed, reports received and resolved
- Evolution of the risk matrix
- Breaches and investigations, with their status
- Changes in obligations
- Audit results and status of actions
- Resources of the compliance function
- Proposals and decisions requested from the body
Example
Example: annual report to the board
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Period | Financial year 2026 · presented on 22 January 2027 |
| Indicators | Training completed 96 % · 9 reports received, 8 closed on time |
| Risks | Bribery risk in public-sector sales goes up; data protection risk goes down after the audit |
| Investigations | INV-2026-003 closed with measures · 1 ongoing |
| New obligations | Signing up to a new industry code of ethics (fictitious) |
| Resources | One additional part-time person requested for due diligence |
| Board decision | Additional resources and the hospitality register approved · recorded in the minutes |
At the audit
Mistakes auditors commonly flag
- The report only reaches the managing director and never the board.
- The minutes do not show that the board received it or what it decided.
- Activity figures only, with no assessment of how effective the system is.
- Serious breaches reported months later in the annual report.
In Kimobox
How this record is kept in Kimobox
- 1Compliance indicators are calculated from the system’s records.
- 2The compliance report arrives ready for the periodic review, with the data already aggregated.
- 3The compliance officer’s communications to the governing body are recorded.
Frequently asked questions
What people ask us before getting started
Is it the same as the management review?
No. The management review (9.3) is carried out by top management on the system; the report to the governing body is issued by the compliance function to whoever oversees it. One feeds the other.
And under UNE 19602?
The tax compliance body has a similar duty to report on the tax compliance system. If both systems are in place, a single report with two chapters avoids holding the same meeting twice.
Keep your ISO 37301 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
ISO 9001 management review minutes template
The inputs and outputs ISO 9001 (9.3) requires for management review, and how to record them in minutes with…
UNE 19602 tax compliance body report
What the UNE 19602 tax compliance body’s periodic review should cover: risks, controls, incidents…
Performance evaluation
This clause forces a check that the compliance system actually works: internal audits and a periodic review…
ISO 37301 compliance obligations register template
How to document the compliance obligations ISO 37301 asks for: mandatory requirements and voluntary…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 37301:2021 — Compliance management systems. Requirements with guidance for use ISO · April 2021
- Organic Law 10/1995, Spanish Criminal Code, art. 31 bis BOE-A-1995-25444 · Consolidated text