Part One
By: Leslie Ortiz Martinez
The International Organization for Standardization (ISO), is composed of several national standards bodies and is responsible for the creation of various international standards that can aim to ensure the quality and safety of products and services, simplify, and optimize processes, among many others. The field of Compliance is no exception, and among the most important international standards on compliance are ISO37301 "Compliance Management Systems" published in 2021 that cancels and replaces ISO19600:2014, ISO 73001:2016 "Anti-Bribery Management System", as well as ISO73000: 2021 "Governance of Organizations - Guidance", which can be used as international reference guides to develop an appropriate corporate compliance program.
ISO37301-2021 is the update of the first International Standard on compliance and one of its main changes is that this new version has certain requirements with additional guidance for use based on those requirements and is certifiable. Among its objectives is to help companies develop and spread a positive culture of compliance, which it defines as "the set of values, ethics, conducts and beliefs that exist throughout an organization and that interact with the structures and control systems of the same to produce behavioral norms that are conducive to compliance", emphasizing that the sustainability of this culture depends heavily on the constant participation of company leaders to achieve their integration, as well as on the behavior and attitude of the people who work for them.
Another outstanding feature is that it can be applicable to any type of company regardless of its size or line of business, since acting as a guideline opens the possibility of adapting the compliance management system to the specific needs of each company, proposing tools to assist the correct implementation of said system. For example, the term "Compliance Function" is mentioned referring to a body either individual or collegiate that could monitor the correct application of the specific compliance policy for each company, as well as the desired parameters of conduct, since compliance is an ongoing process that must be constantly monitored and updated.
Failure to comply with the law implies a risk for companies, however, it is important to mention that this rule makes a distinction between obligations imposed and those assumed voluntarily, referring the former to those that have their origin in legal systems and the latter in internal rules created by the company itself, which may originate from its culture of organizational ethics. The risks that this standard helps to manage in areas such as finances, safety, health and the environment, among others, refer to avoiding sanctions, fines, loss of good reputation, as well as criminal risk, mentioning that they can bring benefits such as:
- Improving business opportunities and sustainability
- Protecting and enhancing an organization's reputation and credibility
- taking into account expectations of interested parties
- Demonstrating the organization's commitment to managing its compliance risks effectively and efficiently compliance effectively and efficiently
- increasing third-party confidence in the organization's ability to achieve sustained success
- Minimizing the risk of a breach involving costs and reputational damage.
This standard makes the important distinction between the terms “Management system" Y "Politics” of compliance, establishing that the management system is the set of elements of an organization that are interrelated or that interact to establish policies, objectives and the processes to achieve them, this includes the structure of the organization, roles and responsibilities, planning and operation, encompassing one or several disciplines. While the Policy refers to the intentions and direction of the organization and is formally expressed by its senior management or by its governing body.
Audits are an ideal means to ensure the correct application of compliance management systems, and according to this standard these can be carried out internally, externally or combined.
As a reference and for more information you can consult the standard in the following links:
https://www.iso.org/standard/75080.html
https://www.iso.org/obp/ui/#iso:std:iso:37301:ed-1:v1:es