ISO 37301 is articulated in directive language, such as ‘shall’ meaning that it is certifiable and that independent experts, regulators or courts may use the standard when assessing an organisation’s CMS.

The standard emphasises the importance of a common standard of behaviour and conduct that is required throughout the organisation to create and support compliance. Top management is required to prevent and not tolerate behaviour that compromises compliance.

There is a requirement for consideration of aspects of diversity, potential barriers and the views of interested parties when establishing an organisation’s communication needs and processes.

There is an emphasis on the inter-related elements to managing compliance risk and there is recognition that compliance management is a cycle of continuous improvement.

The importance of organisational structure and the broader social and economic impact is recognised as fundamental when building a CMS.

The role and importance of levels of management below top management, in managing their compliance duties and creating appropriate internal rules, processes and structures to ensure compliance is emphasised. There is also increased focus on transparency and clear communication of the roles of top management.

Whistleblowing tools and processes are encouraged as part of effective compliance management.  Organisations must ‘establish, implement and maintain’ a process to enable and encourage whistleblowing. The standard stipulates that such a process should be accessible, protect reporters from retaliation and reports should be treated with confidentiality.