Compliance Management Systems
Shows that you identify your compliance obligations and manage the risk of breaching them.
A complete documentation kit written to ISO 37301:2021 with Amendment 1:2024: manual, policies, procedures, SOPs, forms, registers, process maps, indicator and risk frameworks, audit and management review packs, an implementation roadmap, sector guides and commercial templates, with every clause mapped to the document that meets it, and control of obligations, compliance risk, governance and culture, controls, third parties, concerns and investigations built into the system.
- Edition 2021
- 147 Word + 32 Excel files
- One organization
- Downloads open 7 days after payment
You need this if
- You operate under many laws, licences and regulatory requirements.
- Your board wants evidence of a working compliance function.
- You need an obligations register, compliance risk and speak-up in one system.
What you get, in numbers
Counted from the files in the pack. Every file title is listed further down.
What this toolkit is not
Worth knowing before you buy.
Not the certificate
Certification is decided by an independent certification body after it audits a system you have run for some months, with records. No toolkit can guarantee it.
Not the ISO text
The standard is copyrighted and sold by ISO and national standards bodies. Buy your own copy. The toolkit describes requirements in its own words.
Not a consultant
We do not assess your organization. You review, adapt and approve every document before you use it.
What’s inside
15 numbered folders. Open any folder to see the title of every file in it. Titles only: the files themselves are delivered after payment.
00Start Here
Six guides: read-me, how to implement with an initial review checklist, documentation structure, quick start, an ISO 37301:2021 clause mapping guide, and a certification preparation guide.
6 files
- WordSH-001 Read Me Guide
- WordSH-002 How to Implement Guide
- WordSH-003 Documentation Structure Guide
- WordSH-004 Quick Start Guide
- WordSH-005 ISO 37301-2021 Clause Mapping Guide
- WordSH-006 Certification Preparation Guide
01Master Index
One Excel register of every controlled document: number, title, type, owner, department, retention and clause, with review dates and overdue flags.
1 file
- ExcelREG-01 Master Document Register
02Manual
The Compliance Management System Manual, section-numbered to match clauses 4 to 10: context including the climate decision, compliance obligations and compliance risk assessment, leadership with governance, culture and the independence of the compliance function, planning, support, operation including controls, third parties, raising concerns and investigations, performance evaluation including compliance reporting, and improvement.
1 file
- WordCMS-001 Compliance Management System Manual
03Procedures (P-001 to P-024)
Document and record control, context and scope, compliance obligations, regulatory change, compliance risk assessment, governance and culture, policy and roles, objectives and planned change, resources, competence and training, awareness and communication, operational control, controls design, third parties, raising concerns, investigations, monitoring and indicators, evaluation and feedback, reporting and notification, internal audit, management review, corrective action and improvement. Each has a flowchart, responsibility table, controls, risk and indicator matrices.
24 files
- WordP-001 Document Control Procedure
- WordP-002 Record Control Procedure
- WordP-003 Context, Interested Parties and Scope Procedure
- WordP-004 Compliance Obligations Procedure
- WordP-005 Regulatory Change Management Procedure
- WordP-006 Compliance Risk Assessment Procedure
- WordP-007 Governance and Compliance Culture Procedure
- WordP-008 Compliance Policy and Roles Procedure
- WordP-009 Compliance Objectives and Planning of Changes Procedure
- WordP-010 Resources and Compliance Function Procedure
- WordP-011 Competence, Employment and Training Procedure
- WordP-012 Awareness and Communication Procedure
- WordP-013 Operational Planning and Control Procedure
- WordP-014 Controls and Procedures Design Procedure
- WordP-015 Third-Party and Outsourced Process Control Procedure
- WordP-016 Raising Concerns Procedure
- WordP-017 Investigation Procedure
- WordP-018 Compliance Monitoring and Indicators Procedure
- WordP-019 Compliance Evaluation and Feedback Procedure
- WordP-020 Compliance Reporting and Notification Procedure
- WordP-021 Internal Audit Procedure
- WordP-022 Management Review Procedure
- WordP-023 Nonconformity and Corrective Action Procedure
- WordP-024 Continual Improvement Procedure
04Policies (POL-001 to POL-012)
Compliance policy, document control, records and confidentiality, compliance risk management, obligations and regulatory change, governance and culture, third-party compliance, raising concerns and non-retaliation, investigation and discipline, competence and communication, controls and monitoring, and audit, review and improvement.
12 files
- WordPOL-001 Compliance Policy
- WordPOL-002 Document Control Policy
- WordPOL-003 Records and Confidentiality Policy
- WordPOL-004 Compliance Risk Management Policy
- WordPOL-005 Compliance Obligations and Regulatory Change Policy
- WordPOL-006 Governance, Culture and Leadership Policy
- WordPOL-007 Third-Party Compliance Policy
- WordPOL-008 Raising Concerns and Non-Retaliation Policy
- WordPOL-009 Investigation and Discipline Policy
- WordPOL-010 Competence, Training and Communication Policy
- WordPOL-011 Controls and Monitoring Policy
- WordPOL-012 Audit, Review and Improvement Policy
05SOP Library (SOP-001 to SOP-022)
Step-by-step task instructions with flowcharts and acceptance criteria: identifying obligations, regulatory change monitoring, risk workshops, Board reporting, attestation, training, screening, control design and testing, third-party due diligence, handling concerns, protecting reporters, investigations, monitoring, evaluation, regulatory notification, internal audit, corrective action and breach handling.
22 files
- WordSOP-001 Document Issue and Withdrawal
- WordSOP-002 Records Filing and Archiving
- WordSOP-003 Context Review Workshop
- WordSOP-004 Compliance Obligations Identification
- WordSOP-005 Regulatory Change Monitoring
- WordSOP-006 Compliance Risk Workshop
- WordSOP-007 Governing Body Reporting
- WordSOP-008 Policy Attestation
- WordSOP-009 Compliance Training Delivery
- WordSOP-010 Employment Screening and Onboarding
- WordSOP-011 Control Design
- WordSOP-012 Control Testing
- WordSOP-013 Third-Party Due Diligence
- WordSOP-014 Handling a Concern
- WordSOP-015 Protecting Reporters from Retaliation
- WordSOP-016 Investigation Conduct
- WordSOP-017 Compliance Monitoring Round
- WordSOP-018 Obligation Compliance Evaluation
- WordSOP-019 Regulatory Notification
- WordSOP-020 Internal Audit Conduct
- WordSOP-021 Corrective Action Tracking
- WordSOP-022 Breach and Near-Miss Handling
06Forms (FR-001 to FR-051)
Fifty-one forms. Each comes with field descriptions, a blank form that prints on its own, and a completed example record.
51 files
- WordFR-001 Document Change Request
- WordFR-002 Document Review Record
- WordFR-003 Record Disposal Authorization
- WordFR-004 Context and Climate Review
- WordFR-005 Interested Party and Expectations Review
- WordFR-006 CMS Scope Statement
- WordFR-007 Compliance Obligation Assessment
- WordFR-008 Obligation Owner Confirmation
- WordFR-009 Regulatory Change Impact Assessment
- WordFR-010 Compliance Risk Assessment
- WordFR-011 Risk Treatment Plan
- WordFR-012 Governing Body Compliance Report
- WordFR-013 Compliance Culture Assessment
- WordFR-014 Roles, Responsibilities and Authorities Record
- WordFR-015 Policy Communication and Attestation Record
- WordFR-016 Compliance Objectives Plan
- WordFR-017 CMS Change Record
- WordFR-018 Resource Request
- WordFR-019 Competence Assessment
- WordFR-020 Training Record
- WordFR-021 Employment Screening and Onboarding Check
- WordFR-022 Communication Plan
- WordFR-023 Operational Control Plan
- WordFR-024 Control Design Record
- WordFR-025 Control Test Record
- WordFR-026 Third-Party Risk Assessment
- WordFR-027 Third-Party Compliance Review
- WordFR-028 Concern Report
- WordFR-029 Concern Triage Record
- WordFR-030 Investigation Plan
- WordFR-031 Investigation Report
- WordFR-032 Compliance Indicator Definition Sheet
- WordFR-033 Monitoring Plan
- WordFR-034 Obligation Compliance Evaluation
- WordFR-035 Compliance Feedback Log
- WordFR-036 Compliance Report
- WordFR-037 Regulatory Notification Record
- WordFR-038 Annual Audit Programme
- WordFR-039 Audit Plan
- WordFR-040 Internal Audit Checklist
- WordFR-041 Audit Report
- WordFR-042 Auditor Competence Record
- WordFR-043 Management Review Agenda
- WordFR-044 Management Review Minutes
- WordFR-045 Management Review Action Plan
- WordFR-046 NCR Form
- WordFR-047 Corrective Action Request
- WordFR-048 Corrective Action Effectiveness Review
- WordFR-049 Breach and Near-Miss Report
- WordFR-050 Improvement Suggestion Form
- WordFR-051 Improvement Project Charter
07Registers (REG-01 to REG-18)
Eighteen Excel registers with examples, drop-down lists, automatic calculations, due dates and flags: obligations (next evaluation by risk), regulatory change (time to assess and deadlines), third parties (due diligence and clause checks), controls (test and failure checks), concerns (time to acknowledge and triage), investigations (duration), breaches (time to report), notifications (timing), gifts and conflicts (approval checks), attestation, training, indicators, corrective actions, audits and objectives.
18 files
- ExcelREG-01 Document Register
- ExcelREG-02 Record Register
- ExcelREG-03 Compliance Obligations Register
- ExcelREG-04 Compliance Risk Register
- ExcelREG-05 Regulatory Change Register
- ExcelREG-06 Compliance Objectives and Plans Register
- ExcelREG-07 Training and Competence Register
- ExcelREG-08 Policy Attestation Register
- ExcelREG-09 Third-Party Register
- ExcelREG-10 Controls Register
- ExcelREG-11 Concerns Register
- ExcelREG-12 Investigation Register
- ExcelREG-13 Breach and Near-Miss Register
- ExcelREG-14 Regulatory Notification Register
- ExcelREG-15 Compliance Indicators Register
- ExcelREG-16 Nonconformity and Corrective Action Register
- ExcelREG-17 Audit Register
- ExcelREG-18 Conflicts of Interest and Gifts Register
08Process Maps
Eight swimlane maps with inputs, outputs, owners and indicator links: context and obligations, governance and culture, people and training, controls, third parties, concerns and investigations, monitoring and reporting, and audit and improvement.
8 files
- WordPM-01 Context, Obligations and Compliance Risk Process Map
- WordPM-02 Governance, Culture, Policy and Roles Process Map
- WordPM-03 Resources, People, Training and Communication Process Map
- WordPM-04 Operational Control and Controls Testing Process Map
- WordPM-05 Third-Party Control Process Map
- WordPM-06 Raising Concerns and Investigations Process Map
- WordPM-07 Monitoring, Evaluation, Reporting and Notification Process Map
- WordPM-08 Audit, Review, Corrective Action and Improvement Process Map
09Indicators & Risk
83 indicators with formulas and targets in a filterable matrix, corporate and department frameworks, a balanced scorecard, a 5 x 5 risk matrix with 37 example risks, and an improvement opportunity matrix with 25 examples.
6 files
- WordKPI-01 Corporate Indicator Framework
- WordKPI-02 Department Indicator Framework
- ExcelKPI-03 Balanced Scorecard
- ExcelKPI-04 Process Indicator Matrix
- ExcelRSK-01 Risk Management Matrix
- ExcelRSK-02 Opportunity Matrix
10Audit
Annual audit programme covering every clause, location and high-risk obligation, audit plan, notification, auditor competence matrix, a 34-question checklist by clause, a complete audit report and a findings tracker.
7 files
- WordAUD-01 Annual Audit Programme
- WordAUD-02 Audit Plan
- WordAUD-03 Audit Notification
- ExcelAUD-04 Auditor Competence Matrix
- ExcelAUD-05 Audit Checklist by Clause
- WordAUD-06 Audit Report
- ExcelAUD-07 Follow-up Tracker
11Management Review
Agenda, inputs checklist covering every input of clause 9.3 including concerns and investigations, completed sample minutes with the required outputs, action plan and a dashboard.
5 files
- WordMRV-01 Management Review Agenda
- WordMRV-02 Management Review Inputs Checklist
- WordMRV-03 Management Review Minutes Template
- ExcelMRV-04 Management Review Action Plan
- ExcelMRV-05 Management Review Dashboard
12Implementation
An eight-month roadmap with activities, milestones, deliverables and responsibilities, and a task tracker.
2 files
- WordIMP-01 Implementation Roadmap
- ExcelIMP-02 Implementation Tracker
13Customization
Guides with risks, controls and indicators for trading and manufacturing groups, banks and insurers, healthcare and pharmaceuticals, construction, oil, gas and mining, technology businesses, retail and hospitality, public sector bodies, professional services, and non-profits.
10 files
- WordCUS-01 Trading, Distribution and Manufacturing Groups Customization Guide
- WordCUS-02 Banks, Insurers and Financial Services Customization Guide
- WordCUS-03 Healthcare, Pharmaceuticals and Life Sciences Customization Guide
- WordCUS-04 Construction, Engineering and Infrastructure Contractors Customization Guide
- WordCUS-05 Oil, Gas, Mining and Energy Companies Customization Guide
- WordCUS-06 Technology, Telecom and Data-Driven Businesses Customization Guide
- WordCUS-07 Retail, Consumer Goods and Hospitality Customization Guide
- WordCUS-08 Public Sector Bodies and State-Owned Enterprises Customization Guide
- WordCUS-09 Professional Services, Legal and Consulting Firms Customization Guide
- WordCUS-10 Non-Profit Organizations, Education and Charities Customization Guide
14Commercial
Gap assessment checklist, certification readiness checklist, implementation and training proposal templates, consultancy agreement template and audit preparation checklist.
6 files
- ExcelCOM-01 Gap Assessment Checklist
- ExcelCOM-02 Certification Readiness Checklist
- WordCOM-03 Implementation Proposal Template
- WordCOM-04 Training Proposal Template
- WordCOM-05 Consultancy Agreement
- ExcelCOM-06 Audit Preparation Checklist
Sample pages
Pages from the delivered files, before your company details are applied.
After you download
The order most organizations follow.
Before you buy
Is the text of ISO 37301 included?
No. The standard is copyrighted by ISO and sold by ISO and national standards bodies; Amendment 1:2024 (climate action changes) is free from ISO. Buy your own copy of ISO 37301:2021. The toolkit describes requirements in its own words and maps every clause to the document that meets it, so you can check each against the standard.
Which edition does the kit follow?
ISO 37301:2021 (first edition, April 2021) with Amendment 1:2024, which is the current edition; ISO has reviewed and confirmed it. It replaced the guidance standard ISO 19600:2014 and follows the common management system structure.
Does the kit make us compliant or give legal advice?
No. A compliance management system helps an organization manage its obligations but cannot guarantee compliance, and certification does not show that no breach has ever occurred. The kit does not list or interpret laws and gives no legal advice. Take advice on the laws and regulations that apply to you.
Are the examples and figures real data?
No. Names, obligations, risk ratings, thresholds, timescales and cases in example records are fictional and marked as examples. Set your own from your obligations and risk assessment.
Can we edit the documents after purchase?
Yes. Files are delivered as standard, unlocked .docx and .xlsx files. Nothing is watermarked or restricted. Items such as prepared-by names and company profile facts are left for you to complete.
Will this get us certified on its own?
The toolkit gives you a complete, clause-mapped documentation baseline and tools for operating the system. Certification is decided by independent bodies after they audit a working system, including sampling of records, control checks and interviews at all levels, so you must run the system for some months first. Neither a toolkit nor a management system guarantees certification or compliance.
How long can we download the files?
For 7 days from payment. In that time you can enter your company details, correct them and regenerate, and download as often as you need. After 7 days the purchase stays in your account history, but the download closes. Save the ZIP somewhere safe.
What if we need the files again later?
Buying the same toolkit again is a new order with its own 7-day download window. Each purchase is listed separately in your account.
Licence
One purchase licenses one organization to use, edit and adapt the documents for its own management system. You may not resell, share or publish the toolkit or its templates. Each file carries a footer line with the buyer’s email and order number. Full wording is in the Terms & licence.