Reviewed by the Aegentra Security Team — NV1-cleared ISO 27001 practitioners · Updated May 2026
A practical guide to ISO 37301 — the international standard for compliance management systems. Built for Australian compliance officers, GRC managers, and the organisations they work for, in a regulatory climate shaped by the Financial Services Royal Commission, ASIC's reportable situations regime, APRA CPS 230, and expanding whistleblower and AML/CTF obligations. Covers the typical timeline, real AUD costs, the two PECB course tiers, the exam, and the credential ladder.
ISO 37301 is the certifiable international standard for compliance management systems. Through Aegentra, PECB training runs at two tiers — Lead Implementer and Lead Auditor, each $849 + GST — with a 3-hour open-book exam, the official voucher and one free resit included, and 31 CPD credits.
ISO 37301:2021 defines a Compliance Management System (CMS): a documented, auditable system that identifies every obligation an organisation is subject to — legislation, licences, contracts, industry codes, voluntary commitments — and demonstrates those obligations are actually being met. It replaced the guidance-only ISO 19600 in 2021 and, critically, it is a requirements standard, so accredited certification bodies can certify organisations against it. It uses the same Annex SL structure as ISO 27001, so it slots into an existing integrated management system rather than demanding a new one.
Compliance officers and heads of compliance, risk and GRC managers, internal auditors and second-line assurance, consultants running readiness or remediation programs, and legal counsel or company secretaries formalising a compliance function. Organisationally: any entity reporting to ASIC, APRA, or AUSTRAC, holding licences with compliance conditions, or supplying government under contracts that carry audit rights.
Post-Royal-Commission regulation assumes systematic compliance capability. ASIC's reportable situations regime requires AFS and credit licensees to report significant breaches within 30 days; APRA CPS 220 and CPS 230 require frameworks that expressly cover compliance and operational risk; the Corporations Act whistleblower regime requires protected speak-up channels; and from 1 July 2026 Australia's AML/CTF regime extends to tranche-two professions — lawyers, accountants, real estate — under AUSTRAC supervision. ISO 37301 is the certifiable structure behind all of these expectations. Its anti-bribery sibling ISO 37001 is frequently implemented alongside it, sharing one governance loop.
There is no Foundation tier for ISO 37301. ISO 37301 Lead Implementer ($849 + GST) trains the person building and running the CMS — the compliance obligations register, compliance policy, controls, monitoring, and preparation for the certification audit — across 500+ pages of material, 35–45 hours self-paced, 31 CPD credits. ISO 37301 Lead Auditor ($849 + GST) trains the person independently assessing a CMS under ISO 19011 and ISO/IEC 17021-1 — Stage 1 and Stage 2 audits, evidence-based and risk-based auditing, and nonconformity reporting — across 450+ pages, 35–45 hours, 31 CPD credits. Both include 12 months of myPECB access.
Both ISO 37301 exams are three hours, open-book, and remotely proctored, mixing multiple-choice and scenario-based questions across seven competency domains with a 70% pass mark. Certification and examination fees are included in the course price, with one free retake within 12 months of the initial exam date.
Passing the exam with no experience earns the Provisional credential immediately. Implementer or Auditor requires two years of experience (one in compliance management) plus 200 hours of activity; Lead requires five years (two in compliance management) plus 300 hours; Senior Lead requires ten years (seven in compliance management) plus 1,000 hours. All tiers require signing the PECB Code of Ethics. Holding both Lead Implementer and Lead Auditor in the scheme qualifies you for the PECB Master credential, subject to four additional Foundation exams.
Training certifies the practitioner; certifying the organisation requires building the CMS and passing a Stage 1 / Stage 2 audit by an accredited certification body. Typical Australian SMB costs: $25,000–$55,000 for readiness, $8,000–$18,000 for the certification audit, surveillance from $2,500 annually, on a three-year certificate cycle. Readiness runs 12–16 weeks where an Annex SL management system already exists, four to six months greenfield. Browse all Aegentra Academy courses.