ISO 37301 Checklist

Use the ISO 37301 Checklist for assessing compliance with ISO 37301 standards to ensure the effective implementation of a compliance management system.

Download as free PDF

Library
ISO Standards
ISO 37301 Checklist

ISO 37301 Checklist

4.1 Resources

4.2.1 Competence - General

4.2.2 Employment Process

1. To all its personnel, has the organization developed, established, implemented, and maintained processes such that : conditions of employment require personnel to comply with the organization's compliance obligations, policies, processes, and procedures

Photo Comment

2. To all its personnel, has the organization developed, established, implemented, and maintained processes such that :within a reasonable period of their employment commencing, personnel receive a copy of, or are provided with access to, the compliance policy and training about that policy

Photo Comment

3. To all its personnel, has the organization developed, established, implemented, and maintained processes such that : appropriate disciplinary action taken against personnel who violate the organization's compliance obligations, policies, processes, and procedures

Photo Comment

4.2.3 Training

4.3 Awareness

4.4 Communication

14. Has the organization externally communicated information relevant to the compliance management system, as established by the organization's communication process(es), and included communication on its compliance culture, objectives, and obligations?

Photo Comment

4.5.1 Documented Information - General

3. Is the organization aware that the documented information for a compliance management system can differ from one organization to another due to the following: the size of the organization and its type of activities, processes, products, and services;

Photo Comment

4.5.2 Creating And Updating Documented Information

4.5.3 Control Of Documented Information

5.1 Operational Planning And Control

5.2 Establishing Controls And Procedures

5.3 Raising Concerns

1. Has the organization established, implemented, and maintained a process to encourage and enable the reporting of (in cases of reasonable grounds to believe that the information is accurate) attempted, suspected, or actual violations of the compliance policy or compliance obligations?

Photo Comment

5.4 Investigation Processes

6.1.1 Monitoring, Measurement, Analysis, And Evaluation - General

6.1.2 Sources Of Feedback On Compliance Performance

6.1.3 Development Of Indicators

6.1.4 Compliance Reporting

5. Does the organization establish, implement, and maintain processes for compliance reporting to ensure that : accurate and complete information is provided to the correct functions or areas of the organization to enable preventive, corrective, and remedial action to be taken on time

Photo Comment

6.1.5 Record-Keeping

6.2.1 Internal Audit - General

6.2.2 Internal Audit Program

6.3.1 Management Review - General

6.3.2 Management Review Inputs

6.3.3 Management Review Results

7.1 Continual Improvement

7.2 Nonconformity And Corrective Action

3. When a nonconformity or noncompliance occurs, does the organization evaluate the need for action to eliminate the cause(s) of the nonconformity or noncompliance or both so that it does not recur or occur elsewhere by: reviewing the nonconformity and or noncompliance, or both

Photo Comment

4. When a nonconformity or noncompliance occurs, does the organization evaluate the need for action to eliminate the cause(s) of the nonconformity or noncompliance or both so that it does not recur or occur elsewhere by: determining the causes of the nonconformity or noncompliance, or both

Photo Comment

5. When a nonconformity or noncompliance occurs, does the organization evaluate the need for action to eliminate the cause(s) of the nonconformity or noncompliance or both so that it does not recur or occur elsewhere by: determining if similar nonconformities or noncompliances, or both, exist or can potentially occur

Photo Comment

1.1 Understanding The Organization And Its Context

1.2 Understanding The Needs And Expectations Of Interested Parties

1.3 Determining The Scope Of The Compliance Management System

1.4 Compliance Management System

1.5 Compliance Obligations

1.6 Compliance Risk Assessment

2.1.1 Governing Body And Top Management

1. Has the governing body and top management demonstrated leadership and commitment concerning the compliance management system by ensuring that the compliance policy and compliance objectives are established and are compatible with the strategic direction of the organization?

Photo Comment

4. Has the governing body and top management demonstrated leadership and commitment concerning the compliance management system by communicating the importance of effective compliance management and conforming to the compliance management system requirements?

Photo Comment

2.1.2 Compliance Culture

2.1.3 Compliance Governance

2.2 Compliance Policy

2.3.1 Governing Body And Top Management

2.3.2 Compliance Function

2.3.3 Management

2.3.4 Personnel

3.1 Actions To Address Risks And Opportunities

1. When planning for the compliance management system, does the organization consider the issues referred to in 1.1 and the requirements referred to in 1.2 and determine the risks and opportunities that need to be addressed: give assurance that the compliance management system can achieve its intended result(s)

Photo Comment

2. When planning for the compliance management system, does the organization consider the issues referred to in 1.1 and the requirements referred to in 1.2 and determine the risks and opportunities that need to be addressed: prevent or reduce undesired effects

Photo Comment

3. When planning for the compliance management system, does the organization consider the issues referred to in 1.1 and the requirements referred to in 1.2 and determine the risks and opportunities that need to be addressed:achieve continual improvement

Photo Comment

3.2 Compliance Objectives And Planning To Achieve Them

3.3 Planning Of Changes

Is this sample what you are looking for?
Sign up to use & customise this template, or create your own custom checklist:

Checklist by GoAudits.com – Please note that this checklist is intended as an example. We do not guarantee compliance with the laws applicable to your territory or industry. You should seek professional advice to determine how this checklist should be adapted to your workplace or jurisdiction.

Easy inspection app for your digital checklists

Conduct inspections anytime, anywhere - even offline
Capture photos as proof of compliance or areas needing attention
Instantly generate and share detailed reports after the inspections
Assign & track follow-up tasks, view historical trends on a centralized dashboard

ISO 37301 Checklist

Use the ISO 37301 Checklist for assessing compliance with ISO 37301 standards to ensure the effective implementation of a compliance management system.

1. Has the organization determined and provided the resources needed to establish, implement, maintain, and continually improve the compliance management system?

1. Has the organization determined the necessary competence of the person(s) doing work under its control that affects its compliance performance?

2. Has the organization ensured that these persons are competent based on appropriate education, training, or experience?

3. Has the organization where applicable, taken actions to acquire the necessary competence and evaluate the actions' effectiveness?

4. Is appropriate documented information available as evidence of competence?

1. To all its personnel, has the organization developed, established, implemented, and maintained processes such that : conditions of employment require personnel to comply with the organization's compliance obligations, policies, processes, and procedures

2. To all its personnel, has the organization developed, established, implemented, and maintained processes such that :within a reasonable period of their employment commencing, personnel receive a copy of, or are provided with access to, the compliance policy and training about that policy

3. To all its personnel, has the organization developed, established, implemented, and maintained processes such that : appropriate disciplinary action taken against personnel who violate the organization's compliance obligations, policies, processes, and procedures

4. As part of the employment process, has the organization considered the compliance risks posed by roles and personnel and applied due diligence procedures as required before hiring, transferring, and promotion?

5. Has the organization implemented a process that provides for a periodic review of performance targets, performance bonuses, and other incentives to verify that appropriate measures are in place to prevent encouraging noncompliance?

1. Has the organization provided relevant personnel with training regularly from the commencement of employment and at planned intervals determined by the organization?

2. Is training: appropriate to the roles of personnel and the compliance risks to which personnel are exposed

3. Is training :assessed for effectiveness

4. Is training:reviewed regularly

5. Considering the compliance risks identified, has the organization ensured procedures are implemented to address compliance awareness and training for third parties acting on its behalf?

6. Are training records retained as documented information?

1. Are persons doing work under the organization's control aware of the compliance policy?

2. Are persons doing work under the organization's control aware of their contribution to the effectiveness of the compliance management system, including the benefits of improved compliance performance?

3. Are persons doing work under the organization's control aware of the implications of not conforming with the compliance management system requirements?

4. Are persons doing work under the organization's control aware of the means and procedures for raising compliance concerns (see 5.3)?

5. Are persons doing work under the organization's control aware of the relation of the compliance policy and the compliance obligations relevant to their role?

6. Are persons doing work under the organization's control aware of the importance of supporting compliance culture?

1. Has the organization determined the internal and external communications relevant to the compliance management system, including: on what it will communicate

2. Has the organization determined the internal and external communications relevant to the compliance management system, including:when to communicate

3. Has the organization determined the internal and external communications relevant to the compliance management system, including:with whom to communicate

4. Has the organization determined the internal and external communications relevant to the compliance management system, including:how to communicate

5. Has the organization considered aspects of diversity and potential barriers when considering its communication needs?

6. Has the organization ensured that the views of interested parties are considered in establishing its communication process(es)?

7. Has the organization included communication on its compliance culture, compliance objectives, and obligations?

8. Has the organization ensured that compliance information to be communicated is consistent with information generated within the compliance management system and is reliable?

9. Has the organization responded to relevant communications on its compliance management system?

10. Has the organization retained documented information as evidence of its communications, as appropriate?

11. Has the organization internally communicated information relevant to the compliance management system among the various levels and functions of the organization, including changes to the compliance management system, as appropriate?

12. Has the organization ensured its communication process(es) enables personnel to contribute to continual improvement of the compliance management system?

13. Has the organization ensured its communication process(es) enables personnel to raise concerns (see 5.3)?

14. Has the organization externally communicated information relevant to the compliance management system, as established by the organization's communication process(es), and included communication on its compliance culture, objectives, and obligations?

1. Does the organization's compliance management system include the following: documented information required by this document

2. Does the organization's compliance management system include the following: documented information determined by the organization as being necessary for the effectiveness of the compliance management system.

3. Is the organization aware that the documented information for a compliance management system can differ from one organization to another due to the following: the size of the organization and its type of activities, processes, products, and services;

4. Is the organization aware that the documented information for a compliance management system can differ from one organization to another due to the following: the complexity of processes and their interactions;

5. Is the organization aware that the documented information for a compliance management system can differ from one organization to another due to the following: the competence of persons.

1. When creating and updating documented information, does the organization ensure appropriate:identification and description (e.g., a title, date, author, or reference number)

2. When creating and updating documented information, does the organization ensure appropriate:format (e.g., language, software version, graphics) and media (e.g., paper, electronic)

3. When creating and updating documented information, does the organization ensure appropriate:review and approval for suitability and adequacy

1. Is documented information required by the compliance management system and is this document controlled to ensure: it is available and suitable for use where and when it is needed;

2. Is documented information required by the compliance management system and is this document controlled to ensure:it is adequately protected (e.g., from loss of confidentiality, improper use, or loss of integrity).

3. For the control of documented information, has the organization addressed the following activities, as applicable: distribution, access, retrieval, and use

4. For the control of documented information, has the organization addressed the following activities, as applicable:storage and preservation, including preservation of legibility

5. For the control of documented information, has the organization addressed the following activities, as applicable:control of changes (e.g., version control)

6. For the control of documented information, has the organization addressed the following activities, as applicable:retention and disposition

7. Is documented information of external origin determined by the organization to be necessary for the planning and operation of the compliance management system identified as appropriate and controlled?

1. Has the organization planned, implemented, and controlled the processes needed to meet requirements and to implement the actions determined in Clause 3 by:establishing criteria for the processes

2. Has the organization planned, implemented, and controlled the processes needed to meet requirements and to implement the actions determined in Clause 3 by:implementing control of the processes by the criteria

3. Is documented information available to the extent necessary to have confidence that the processes have been carried out as planned?

4. Does the organization control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects as necessary?

5. Does the organization control externally provided processes, products, or services relevant to the compliance management system?

6. Does the organization ensure that third-party processes are controlled and monitored?

1. Does the organization implement controls to manage its compliance obligations and associated compliance risks?

2. Are these controls maintained, periodically reviewed, and tested to ensure their continuing effectiveness?

1. Has the organization established, implemented, and maintained a process to encourage and enable the reporting of (in cases of reasonable grounds to believe that the information is accurate) attempted, suspected, or actual violations of the compliance policy or compliance obligations?

2. Is this process: be visible and accessible throughout the organization

3. Is this process:treat reports confidentially

4. Is this process: accept anonymous reports

5. Is this process: protect those making reports from retaliation

6. Is this process: enable personnel to receive advice

7. Does the organization ensure that all personnel know the reporting procedures, their rights, and protections and can use them?

1. Does the organization develop, establish, implement, and maintain processes to assess, evaluate, investigate, and close reports on suspected or actual instances of noncompliance? Do these processes ensure fair and impartial decision-making?

2. Do competent personnel carry out the investigation processes independently and without conflict of interest?

3. Does the organization use the outcome of investigations to improve the compliance management system as appropriate (see Clause 7)?

4. Does the organization regularly report on the numbers and outcomes of investigations to the governing body or top management?

5. Does the organization retain documented information on the investigation?

1. Does the organization monitor the compliance management system to ensure compliance objectives are achieved?

2. Does the organization determine the following:what needs to be monitored and measured

3. Does the organization determine the following: the methods for monitoring, measurement, analysis, and evaluation, as applicable, to ensure valid results

4. Does the organization determine the following:when the monitoring and measuring shall be performed

5. Does the organization determine the following: when the results from monitoring and measurement shall be analyzed and evaluated

6. Is documented information available as evidence of the results?

7. Does the organization evaluate the compliance performance and the effectiveness of the compliance management system?

1. Are accurate, uptodate records of the organization's compliance activities retained to assist in the monitoring and review process and demonstrate conformity with the compliance management system?