Practical implications of the new ISO 37301 on compliance management systems Implicaciones prácticas de la nueva ISO 37301 sobre los sistemas de gestión del cumplimiento

1. Practical implications of the
new ISO 37301
on Compliance
Prof. Hernan Huwyler, MBA CPA

2. IE, top global MBAs

3. IE, top worldwide MBAs
New IE Tower
Sep 2021

4. An international
certificable standard
for compliance
programs
Use

5. It will replace the
ISO 19600 on anti-
corruption without
major changes
Use

6. It is starting…

7. Strong corporate
defense to meet
accountability
principles
Use

8. Studies show
modest results in
reducing regulatory
violations
Coglianese, Cary and Nash, Jennifer, "Compliance Management Systems: Do They Make a Difference?" (2020)
Use

9. New ISOs for 2021
37000
Governance
37301
Compliance
ISO 37002
Whistleblowing

10. The ISO 37301 should
harmonize the
compliance controls in
policies and procedures
Implication

11. The final standard
will be published in
May 2021
Use

12. Defines compliance as
meeting obligations >
needs and expectations
of interested parties
Scope

13. Regulations
Laws
Contracts
Scope
Compliance
obligations
Mandatory
Voluntary
Commitments
Values

14. Implement and update
a central compliance
register to compile
obligations
Implication

15. Embed responsibilities
for compliance
obligations into policies
and job definitions
Implication

16. Ensure that performance
appraisals and
incentives cover embed
responsibilities in roles
Implication

17. Implement a compliance
control matrix linking
objectives, obligations,
risks and policies
Implication

18. Then, not meeting
obligations creates
compliance risks
Scope

19. Context

20. Expand the scope for
objective-centric and
data-driven compliance
risk assessments
Implication

21. Periodically
Material changes
Risk process
Compliance
obligations
Activities
Objectives
Products
Services
Scope
Risk
assessment
Corrective
actions

22. Ensure managers
communicate
compliance risks to
affected and interested
parties
Implication

23. Collect data on
materialized compliance
risks in fraud losses,
complains and claims
bases
Implication

24. Implement a root-
cause analysis of
compliance
violations
Implication

25. Validate quality and
availability of compliance
documentation and its
security controls to prevent
changes and destruction
Implication

26. Adjust the compliance
management systems
to address the risk
management plans and
evaluate their effectiveness
Implication

27. Compliance Mgmt System

28. Compliance Mgmt System
Purposes
Policies and
Procedures
Processes

29. Compliance Mgmt System
Purposes
Policies and
Procedures
Processes

30. Compliance Mgmt System
Board and
senior mgmt
Internal and 3P
documentation
External experts

31. Compliance Mgmt System
Values
Leadership
Culture

32. Update principles in the
compliance policy to
externally and internally
communicate changes
Implication

33. Update compliance KPIs
and targets in monitoring
trends and reporting to
upper management
Implication

34. Assess the effectiveness
of compliance training
and awareness for
employees and 3Ps
acting on their behalf
Implication

35. Due diligence required
for hiring and
promotion > no
transfers or continuous
Changes

36. Disciplinary actions
required for non-
compliance > no
grievances and appeals
Changes

37. Assess competences to
meet compliance
obligations in employee
due diligence
Implication

38. Implication

39. Add the consequences
of non-compliances the
compliance policy and
train employees and
new hires
Implication

40. Validate the data
consistency and accuracy
for compliance
communication in the non-
financial reporting
Implication

41. Protection for
whistleblowing > no
incentives
Changes

42. Include anti-retaliation
controls in the
whistleblowing policy
Implication

43. Implement a leniency program
Have an independent investigative team
Prevent risks in the complaint ramifications
Monitor peer pressure, bullying and exclusion
Approve changes in work conditions
Include the impact on family members
Provide financial and emotional support
Protect whistleblowers from 3 to 5 years
Anti-retaliation controls

44. Whistleblowing
Accessible to all
employees
Anonymous
or not
ISO 37002
Whistleblowing

45. Environmental
obligations for strategic
planning
Changes

46. Audit compliance
controls and third-parties
Extra bonus

47. Separate
accountabilities and
responsibilities in the
performance of
compliance controls
Extra bonus

48. Include high risk
scenarios of compliance
breaches in the crisis
protocols
Extra bonus

49. Expand due diligence
to partnerships,
mergers and
aquisitions
Extra bonus

50. Adjust the approvals and
escalation procedures for
decisions and processes
posing high risks
Extra bonus

51. Balance roles for the
compliance mgmt
system with the 3 lines
model
Extra bonus

52. Our modular program
Compliance Culture
Compliance
risks
Program
operations
Privacy
compliance
Control
assurance
Blended

53. Our

54. Case method