ISO 37304:2026
(Main)Compliance management systems — Requirements for bodies providing audit and certification of compliance management systems
- Abstract
This document specifies requirements and provides guidance for bodies providing audit and certification of compliance management systems (CMS), in addition to the requirements contained within ISO/IEC 17021-1 [3]. Observance of these requirements is intended to ensure that certification bodies provide audit and certification in a competent, consistent and impartial manner.
- Status
- Published
- Publication Date
- 15-Oct-2026
- Technical Committee
- ISO/TC 309 - Governance of organizations
- Drafting Committee
- ISO/TC 309 - Governance of organizations
- Current Stage
- 6060 - International Standard published
- Start Date
- 16-Oct-2026
- Completion Date
- 16-Oct-2026
ISO 37304:2026 is an ISO standard for bodies that audit and certify compliance management systems (CMS). It adds CMS-specific requirements and guidance to ISO/IEC 17021-1 so certification bodies can assess CMS in a competent, consistent and impartial way for organizations seeking certification against ISO 37301.
What does ISO 37304:2026 specify?
ISO 37304:2026 specifies requirements and guidance for certification bodies that provide audit and certification of CMS. The standard follows the structure of ISO/IEC 17021-1 and focuses on the extra competence, process and audit-time rules needed for CMS certification.
It is organized into principles, general requirements, structural requirements, resource requirements, information requirements, process requirements and management system requirements for certification bodies. Annex A adds informative competence considerations, and Annex B gives normative rules for CMS audit time.
| Annex | What it covers |
|---|---|
| Annex A | Further competence considerations for CMS auditing and certification |
| Annex B | CMS audit time |
What are the key requirements of ISO 37304:2026?
ISO 37304:2026 requires a certification body to apply ISO/IEC 17021-1 and then add CMS-specific controls for competence, audit scope, certification documents, confidentiality, sampling and audit time. In practice, that means the body must show that its auditors and decision-makers understand both conformity assessment and the compliance risks inside the client's CMS.
Competence of personnel
Clause 7.1 requires the certification body to define competence requirements for each certification function, taking ISO/IEC 17021-1 and Clause 7.2 into account. Clause 7.2 then sets the CMS knowledge needed by audit teams and other personnel.
For CMS audit teams, Clause 7.2.1 requires understanding of ISO 37301, the organization’s context, laws and regulations, compliance risk assessment and controls, and how a CMS is established and implemented. The team also needs knowledge of compliance culture, leadership, the compliance function, training, monitoring and reporting, systems for raising concerns, and investigation of non-compliance. In practice, the body must form teams whose combined knowledge matches the CMS scope being audited.
For other personnel, Clause 7.2.2 requires similar generic competence plus knowledge of the organization’s context. This matters for staff who review applications, select audit teams, determine audit time, review reports and make certification decisions.
Scope, planning and audit method
Clause 9.1.3.2 requires the certification body to verify that the client has defined the organizational boundaries of the CMS and the compliance obligations related to it. That means the audit is not just about whether a policy exists - it is about whether the client has set a clear CMS scope and identified the obligations it covers.
Clause 9.1.4 sends the reader to Annex B for audit-time determination, and Clause 9.1.5 allows a sample-based approach for multiple sites only when the sites operate under the same centrally managed CMS and are included in the internal audit programme and management review. Clause 9.1.5.3 requires the sample to reflect differences in site size, business purpose, legal context, geography, risk, CMS complexity, working practices, controls, internal audits, management review and site non-conformity. In practice, a certification body cannot choose sites casually - it has to justify a representative sample.
Clause 9.1.6 allows combined audits with other management systems if the CMS remains clearly identifiable and the audit quality is not affected. It also allows combined documentation when the CMS and other management systems can still be clearly separated. That is useful where a client runs CMS together with systems for quality, health and safety, environment or information security.
Initial certification and audit execution
Clause 9.3.2.1 requires Stage 1 to collect documentation on the CMS design and to understand the CMS in the context of the organization, compliance obligations, risk assessment and treatment, policy, objectives and readiness for Stage 2. The certification body must also verify that the compliance risk assessment covers all compliance obligations in scope and record the Stage 1 results.
Clause 9.3.2.2 then sends Stage 2 to ISO/IEC 17021-1. In practice, Stage 1 checks whether the CMS is sufficiently designed and prepared, while Stage 2 examines whether it is operating effectively enough for certification.
Certification documents, claims and confidentiality
Clause 8.2.2 requires CMS certification documents to identify the relevant compliance risk areas covered by the certification scope. The note gives examples such as anti-bribery, anti-trust and money laundering. This helps users of the certificate understand exactly what the certification covers.
Clause 8.3.2 requires legally enforceable arrangements to stop misleading claims, such as claims that the client meets all compliance obligations or that all business activities comply with law and regulation. Clause 8.4.2 requires the certification body to ask in advance whether any CMS information is too confidential or sensitive for review, and to stop the audit if the objectives cannot be met without it. In practice, the body must balance confidentiality with enough access to audit the CMS properly.
Audit time
Annex B makes audit time depend on the number of CMS effective personnel and allows adjustment for factors such as the number of compliance obligations, statutory context, non-compliance impact, CMS maturity, number of sites, outsourced activities, ICT use, centralized control, language needs and CMS complexity. It also sets minimum time expectations for surveillance and recertification relative to initial audit time. This means audit planning must be risk-based and sized to the CMS being certified.
What terms does ISO 37304:2026 define?
- Certification audit - An audit carried out by an independent auditing organization to certify a client’s management system.
- CMS - Compliance management system, the management system this standard is written for.
- CMS effective personnel - People who materially contribute to CMS effectiveness or affect compliance performance; Annex B uses this to determine audit time.
- Audit time - The time needed to plan and perform a complete and effective audit of a management system.
- Compliance risk area - A compliance-related area within the certification scope, such as anti-bribery, anti-trust or money laundering.
- Stage 1 audit - The first part of initial certification, focused on CMS design, documentation and readiness.
- Stage 2 audit - The main audit stage that follows Stage 1 and assesses the CMS in operation.
Who uses ISO 37304:2026?
ISO 37304:2026 is used by certification bodies that audit and certify CMS, and by the auditors, technical experts and decision-makers working inside those bodies. It is also relevant to organizations seeking CMS certification, because it shows what the certification body will look for in scope, evidence, competence and audit planning.
Accreditation and oversight personnel can also use it to judge whether a certification body is applying CMS certification consistently and impartially. For clients, it clarifies how the audit will be structured and what evidence may be needed.
What changed in ISO 37304:2026 from the previous edition?
ISO 37304:2026 is the first edition and cancels and replaces ISO/IEC TS 17021-13:2021. The foreword states that the content of ISO/IEC TS 17021-13:2021 has been incorporated verbatim as Clause 7.2 on competence requirements, with one modification: the text from 5.1.2, Note 1 was incorporated into 7.2.1.2 as a requirement in the final paragraph.
Which standards are used with ISO 37304:2026?
- ISO/IEC 17000 - Supplies the general vocabulary and principles for conformity assessment used by this document.
- ISO/IEC 17021-1 - Provides the base requirements for bodies that audit and certify management systems; ISO 37304 adds CMS-specific requirements to it.
- ISO 37301 - Defines the CMS requirements that the certification body audits against.
- ISO 19011 - Gives auditing principles and guidance, noted in Clause 7.1 and Annex A as useful background for CMS auditors.
What does the ISO 37304:2026 document contain?
ISO 37304:2026 contains the full set of clauses for principles, general requirements, resource requirements, information requirements, process requirements and management system requirements for certification bodies. It also includes CMS-specific clauses on competence, certification documents, misleading claims, confidentiality, audit scope, multi-site sampling and combined audits.
Annex A provides an overview table linking knowledge areas to certification functions, and it expands on auditor and other-personnel competence. Annex B provides the audit-time method, including the effective-personnel approach, adjustment factors and the audit-time table for initial certification. The document also includes the usual appeal, complaint and client-record requirements carried over from ISO/IEC 17021-1, so it can be used as a working standard for planning, performing and controlling CMS certification audits.
Relations
- Effective Date
- 23-May-2026
Get Certified
Connect with accredited certification bodies for this standard
BSI Group
BSI (British Standards Institution) is the business standards company that helps organizations make excellence a habit.
Bureau Veritas
Bureau Veritas is a world leader in laboratory testing, inspection and certification services.
DNV
DNV is an independent assurance and risk management provider.
Sponsored listings
Frequently Asked Questions
ISO 37304:2026 is a standard published by the International Organization for Standardization (ISO). Its full title is "Compliance management systems — Requirements for bodies providing audit and certification of compliance management systems". This standard covers: This document specifies requirements and provides guidance for bodies providing audit and certification of compliance management systems (CMS), in addition to the requirements contained within ISO/IEC 17021-1 [3]. Observance of these requirements is intended to ensure that certification bodies provide audit and certification in a competent, consistent and impartial manner.
This document specifies requirements and provides guidance for bodies providing audit and certification of compliance management systems (CMS), in addition to the requirements contained within ISO/IEC 17021-1 [3]. Observance of these requirements is intended to ensure that certification bodies provide audit and certification in a competent, consistent and impartial manner.
ISO 37304:2026 is classified under the following ICS (International Classification for Standards) categories: 03.100.02 - Governance and ethics; 03.100.70 - Management systems; 03.120.20 - Product and company certification. Conformity assessment. The ICS classification helps identify the subject area and facilitates finding related standards.
ISO 37304:2026 has the following relationships with other standards: It is inter standard links to ISO/IEC TS 17021-13:2021. Understanding these relationships helps ensure you are using the most current and applicable version of the standard.
ISO 37304:2026 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
International
Standard
ISO 37304
First edition
Compliance management
2026-10
systems — Requirements for bodies
providing audit and certification of
compliance management systems
Systèmes de management de la conformité — Exigences
pour les organismes d’audit et de certification des système de
management de la conformité
Reference number
© ISO 2026
All rights reserved.
This ISO publication is protected by copyright and is owned by ISO and/or its licensors.
The content of this ISO publication is provided under licence, not sold. Use is subject to the applicable licence terms issued by ISO,
an ISO member body, or an authorized third-party distributor.
Except as required for implementation or expressly permitted by a separate licence, no part of this ISO publication may be
reproduced, distributed, modified, used, or made available in any form or by any means – electronic or mechanical, including
photocopying, scanning, recording, or posting on internal or external digital platforms.
Any use beyond the scope of the granted rights is prohibited and may result in legal action.
ISO copyright office
CP 401 • CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Principles . 2
5 General requirements . 2
5.1 Legal and contractual matters .2
5.2 Management of impartiality .2
5.3 Liability and financing .2
6 Structural requirements . 2
7 Resource requirements . 2
7.1 Competence of personnel .2
7.2 Personnel involved in certification activities .3
7.2.1 Competence requirements for CMS audit teams.3
7.2.2 Competence requirements for other personnel .4
7.3 Use of external auditors and external technical experts .4
7.4 Personnel records .4
7.5 Outsourcing .4
8 Information requirements . 4
8.1 Public information . .4
8.2 Certification documents .5
8.2.1 General .5
8.2.2 CMS certification documents .5
8.3 Reference to certification and use of marks .5
8.3.1 General .5
8.3.2 Reference to CMS certification .5
8.4 Confidentiality .5
8.4.1 General .5
8.4.2 Access to organizational records.5
8.5 Information exchange between a certification body and its clients .5
9 Process requirements . 6
9.1 Pre-certification activities .6
9.1.1 Application .6
9.1.2 Application review . .6
9.1.3 Audit programme .6
9.1.4 Determining audit time .6
9.1.5 Multi-site sampling . .6
9.1.6 Multiple management systems .7
9.2 Planning audits .7
9.2.1 Determining audit objectives, scope and criteria .7
9.2.2 Audit team selection and assignments .7
9.2.3 Audit plan .8
9.3 Initial certification .8
9.3.1 General .8
9.3.2 Initial certification audit .8
9.4 Conducting audit .8
9.5 Certification decision . . .8
9.6 Maintaining certification .8
9.6.1 General .8
9.6.2 Surveillance activities .8
iii
9.6.3 Re-certification .8
9.6.4 Special audits .8
9.6.5 Suspending, withdrawing or reducing the scope of certification .9
9.7 Appeals .9
9.8 Complaints.9
9.9 Client records .9
10 Management system requirements for certification bodies . 9
Annex A (informative) Further competence considerations for CMS auditing and certification .10
Annex B (normative) CMS audit time . 14
Bibliography . 17
iv
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 309, Governance of organizations, in
collaboration with ISO/CASCO, Committee on conformity assessment.
This first edition cancels and replaces ISO/IEC TS 17021-13:2021, which has been technically revised.
The main changes are as follows:
— The content of ISO/IEC TS 17021-13:2021 has been incorporated verbatim as 7.2 on competence
requirements, with one modification to 5.1.2, NOTE 1: the text has been incorporated into 7.2.1.2 as a
requirement in the final paragraph.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
v
Introduction
Certification of the compliance management systems (CMS) of an organization is one means of providing
assurance that the organization has implemented a CMS in accordance with its compliance policy and
internationally accepted principles for measures to ensure that business activities are conducted in
accordance with applicable laws and regulations.
[1]
ISO/IEC 17021-1 sets out requirements for bodies which are referred to as “certification bodies providing
audit and certification of management systems". This document sets out requirements in addition to those
[1]
in ISO/IEC 17021-1 intended to promote international recognition of those certification bodies, and to
provide confidence in the effectiveness of CMS of certified organizations. The text in this document follows
[1]
the structure of ISO/IEC 17021-1 .
[1]
The CMS certification in accordance with ISO/IEC 17021-1 and this document is not a forensic audit nor
a legal review or financial audit. The certification confirms that a client’s CMS meets the requirements
[2]
specified in ISO 37301 .
vi
International Standard ISO 37304:2026(en)
Compliance management systems — Requirements for bodies
providing audit and certification of compliance management
systems
1 Scope
This document specifies requirements and provides guidance for bodies providing audit and certification of
compliance management systems (CMS), in addition to the requirements contained within ISO/IEC 17021-1
[1]
. Observance of these requirements is intended to ensure that certification bodies provide audit and
certification in a competent, consistent and impartial manner.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 17000, Conformity assessment — Vocabulary and general principles
ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of
management systems — Part 1: Requirements
ISO/IEC 17021-1, Conformity assessment — Requirements for bodies providing audit and certification of
management systems — Part 1: Requirements
ISO 37301:2021, Compliance management systems — Requirements with guidance for use
ISO 37301, Compliance management systems — Requirements with guidance for use
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 17000, ISO 37301 and
ISO/IEC 17021-1 apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1
certification audit
audit carried out by an auditing organization independent of the client and the parties that rely on
certification, for the purpose of certifying the client's management system
Note 1 to entry: In the definitions which follow, the term “audit” has been used for simplicity to refer to third-party
certification audit.
Note 2 to entry: Certification audits include initial, surveillance, re-certification audits, and can also include special
audits.
Note 3 to entry: Certification audits are typically conducted by audit teams of those bodies providing certification of
conformity to the requirements of management system standards.
Note 4 to entry: A joint audit is when two or more auditing organizations cooperate to audit a single client.
Note 5 to entry: A combined audit is when a client is being audited against the requirements of two or more management
systems standards together.
Note 6 to entry: An integrated audit is when a client has integrated the application of requirements of two or more
management systems standards into a single management system and is being audited against more than one
standard.
[3]
[SOURCE: ISO/IEC 17021-1:2015 , 3.4]
3.2
CMS effective personnel
personnel who materially contribute to the effectiveness of the compliance management system (CMS) or
impact compliance performance
Note 1 to entry: CMS effective personnel is not necessarily the total number of employees (headcount).
Note 2 to entry: The CMS effective personnel number is a factor used to determine the audit time (3.3).
[4]
[SOURCE: ISO 50003:2021 , 3.5 modified — The term “EnMS” has been replaced by “CMS” throughout the
entry; "or impact energy performance” has been replaced with “or impact compliance performance”.]
3.3
audit time
time needed to plan and accomplish a complete and effective audit of the client organization’s management
system
[3]
[SOURCE: ISO/IEC 17021-1:2015 , 3.16]
4 Principles
The principles of ISO/IEC 17021-1:2015, Clause 4 apply.
5 General requirements
5.1 Legal and contractual matters
The requirements of ISO/IEC 17021-1:2015, 5.1 apply.
5.2 Management of impartiality
The requirements of ISO/IEC 17021-1:2015, 5.2 apply.
5.3 Liability and financing
The requirements of ISO/IEC 17021-1:2015, 5.3 apply.
6 Structural requirements
The requirements of ISO/IEC 17021-1:2015, Clause 6 apply.
7 Resource requirements
7.1 Competence of personnel
The certification body shall define the competence requirements for each certification function as referenced
in ISO/IEC 17021-1:2015, Table A.1. When defining these competence requirements, the certification body
shall take into account all the requirements specified in ISO/IEC 17021-1, as well as those specified in 7.2 of
this document.
NOTE 1 Annex A provides further considerations for competencies for personnel involved in specific certification
functions.
[5]
NOTE 2 Information on the principles of auditing is provided in ISO 19011 .
7.2 Personnel involved in certification activities
7.2.1 Competence requirements for CMS audit teams
7.2.1.1 General
All members of the CMS audit team shall have a level of competence that includes the generic competence
described in ISO/IEC 17021-1 and understand the requirements of ISO 37301 and the relationship between
those requirements, as well as the knowledge described in 7.2.1.2 to 7.2.1.5.
The competence requirements specified in 7.2.1.2 to 7.2.1.5 shall apply within the scope of the CMS to be
audited.
It is not necessary for each member of the audit team to have the same competence; however, the collective
competence of the audit team shall be sufficient to achieve the audit objectives.
7.2.1.2 Context of the organization
The audit team shall have knowledge of the context in which the organization operates. The audit team shall
be able to understand the business activities and processes of the organization in so far as they relate to the
compliance obligations and compliance risks arising from those activities and processes.
The audit team shall have the knowledge and skills necessary to conduct research related to the organization
to identify and understand applicable compliance obligations and risks.
7.2.1.3 Laws, regulations and other requirements
The audit team shall have knowledge and understanding concerning different legal systems, laws and
regulations. The audit team shall have the knowledge and skills to understand different types of legal texts
and to understand their relevance for the compliance obligations of the organization.
The audit team shall have knowledge about the legal framework in which the organization operates and
shall be able to understand the applicable compliance obligations and compliance risks within the scope of
the CMS to be audited.
The audit team shall have knowledge about other applicable requirements to be able to understand their
relevance for the compliance obligations and compliance risks which arise from these other requirements
within the scope of the CMS to be audited.
NOTE Other applicable requirements can be, for example, directives, licence agreements, voluntary codes,
organizational and industry standards, contractual relationships, codes of practice and agreements with community
groups or non-governmental organizations.
7.2.1.4 Compliance risk assessment and controls
The audit team shall have knowl
...