Compliance Management Systems audit context
  1. Home
  2. Certification
  3. Standards
  4. Make compliance responsibilities visible and controlled.

Make compliance responsibilities visible and controlled.

ISO 37301:2021 — Compliance Management Systems. Compliance obligations that live in individual heads become gaps when those individuals move. ISO 37301 tests whether obligations are identified, owned, controlled and monitored as a system.

Standards applied
ISO 37301:2021
Who typically applies

Three specific situations.

  • A regulated business with obligations across several authorities.
  • A group after an enforcement action or an internal investigation.
  • An organisation whose board wants assurance beyond a legal opinion.
Compliance Management Systems audit context
What auditors examine

What has to be evidenced.

  • Compliance obligations and how they are identified and updated
  • Governance, roles and the independence of the compliance function
  • Compliance culture and how it is measured
  • Compliance risk assessment
  • Controls and their operation
  • Reporting, investigation and remediation
  • Monitoring, internal audit and improvement
Certification cycle

Not a one-time inspection.

  1. Application and review

    System scope, sites, activities, effective personnel count and outsourced processes.

    Global Energy Up

  2. Stage 1

    System readiness: documentation, internal audit, management review and site arrangements.

    Audit

  3. Stage 2

    Implementation and effectiveness in practice, against evidence.

    Audit

  4. Correction and corrective action

    Nonconformities addressed and their effectiveness examined.

    Client

  5. Independent technical review

    Performed by someone who took no part in the audit.

    Independent reviewer

  6. Certification decision

    Taken by authorised personnel who did not participate in the audit.

    Authorised decision

  7. Surveillance

    Periodic audits confirming continued conformity during the cycle.

    Annual

  8. Recertification

    Full review of continued effectiveness before renewal after three years.

    Every 3 years
What the certificate does not mean

The limit, plainly.

Certification does not mean your product conforms and does not mean your performance is excellent. It means your management system met the requirements of the standard at the assessment date, within the scope and sites shown on the certificate.

Management-system certification services are delivered by Global Energy Up. Energy Up International does not issue management-system certificates.

Act

ApplicationApply for certificationToolCheck a certificateRulesMark rules

Describe the claim — not the service.

Tell us what must be relied on, who will rely on it and by what date. We will confirm the correct programme, evidence requirement and responsible entity — or tell you it is outside our scope.

Start a pre-engagement reviewContact the right entity