Templates and records · ISO 37301 · Clause 4.6

ISO 37301 compliance risk matrix template

The assessment that matches each obligation with the activity that could breach it and decides which controls are needed, area by area.

In one sentence

The compliance risk matrix identifies each risk by linking an obligation with the activities that could breach it, analyses it by likelihood and consequences, evaluates it against existing controls and decides on actions; ISO 37301 requires that assessment and the actions to address the risks to be retained (4.6), and the assessment to be repeated periodically and when things change.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 37301 · Clause 4.6 Clauses follow ISO 37301:2021, the current edition, which replaced the ISO 19600 guidance standard.
Type of information: Mandatory record Documented information to be retained (4.6)
Who fills it in: Compliance function with each area Area heads contribute how work is really done; compliance contributes the method
When: At least once a year And after regulatory changes, new activities or markets, or significant noncompliance
How long it is kept: Set by the organisation ISO 37301 sets no periods. In Spain it is wise to take into account the limitation periods of the offences the system aims to prevent, because the record is your evidence of due diligence.

What the standard requires

What ISO 37301 demands and what it leaves to your judgement

The standard asks for compliance risks to be identified, analysed and evaluated. The identification method is specific: relate the 4.5 obligations to the organisation’s activities, products, services and operational aspects. A matrix that does not start from the obligations does not answer what is being asked.

The assessment is repeated at planned intervals and whenever circumstances or the organisation change. What is retained is the assessment and the actions decided, so that the evolution of the risks can be seen.

It is not the ISO 9001 risks and opportunities matrix: here the risk is failing to meet an obligation, and the consequences include penalties, criminal liability and reputational damage.

Read it in context: Planning, in the ISO 37301 Academy

Structure

Fields the template should include

Obligation the risk arises from
Activity, process or area where it could be breached
Risk description and causes
Likelihood and consequences (regulatory, criminal, reputational)
Existing controls and their effectiveness
Residual risk level
Actions decided, owner and deadline
Assessment date and next review

Example

Example: bribery risk in the sales area

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Obligation	Framework contract with a public hospital and industry code of ethics (fictitious): ban on gifts to procurement staff
Area	Sales management · sales to public healthcare centres
Risk	Invitations or gifts to staff with decision-making power in tenders
Causes	Sales targets tied to contract awards; no written limits
Rating	Medium likelihood · very high consequences (criminal, and exclusion from public procurement)
Existing controls	Code of ethics signed by staff
Actions	Gifts and hospitality register with prior approval · Targeted training for the sales team · Compliance · 31 December
Date	Annual assessment, 15 September 2026

At the audit

Mistakes auditors commonly flag

Generic risks («regulatory noncompliance») with no specific obligation or activity.
The assessment is not repeated after a breach or an investigation.
The previous assessment is overwritten when updating.
Controls marked as effective that nobody has tested.

In Kimobox

How this record is kept in Kimobox

1The compliance risk matrix is recorded with its owner and associated action.
2Each noncompliance risk is identified and prioritised by area.
3After each significant breach, the risk map is updated straight from the investigation.

Frequently asked questions

What people ask us before getting started

Is it the same as the criminal risk map?

The criminal risk map focuses on the offences that can give rise to corporate liability under article 31 bis of the Spanish Criminal Code. The ISO 37301 matrix is broader: it covers any obligation, even where breaching it is not a criminal offence.

And the UNE 19602 tax risk map?

It is a specialised subset. Organisations running both systems can keep a single matrix, with tax risks developed in more detail and their own responsible body.

Keep your ISO 37301 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO 37301:2021 — Compliance management systems. Requirements with guidance for use ISO · April 2021
Organic Law 10/1995, Spanish Criminal Code, art. 31 bis BOE-A-1995-25444 · Consolidated text