What is ISO 37301?
ISO 37301:2021 is the international standard for a Compliance Management System (CMS) — a documented, auditable system that identifies every obligation an organisation is subject to and demonstrates those obligations are actually being met. Obligations in the standard's vocabulary are broad: legislation and regulation, licence conditions, contractual commitments, industry codes, and voluntary undertakings. The standard is published by ISO.
ISO 37301 replaced ISO 19600 in April 2021, and the change matters: ISO 19600 was guidance, while ISO 37301 is a requirements standard that accredited certification bodies can audit and certify against. It uses Annex SL — the same high-level structure as ISO 27001 and ISO 22301 — so if you already run a certified management system, the governance loop is familiar. What changes is the subject matter: the full obligation set rather than security controls or continuity plans.
Two neighbouring standards are worth distinguishing. ISO 31000 is risk management guidance — not certifiable — that ISO 37301 borrows its risk-assessment thinking from. ISO 37001 is the anti-bribery management system standard: narrower in scope, certifiable, and frequently implemented alongside ISO 37301 with a single governance loop covering both.
Who needs ISO 37301 certification in Australia?
ISO 37301 has two audiences in Australia: organisations that need a defensible compliance framework, and the individuals who build careers running them. The roles that carry the credential:
- Compliance officers and heads of compliance — the people who own the obligations register and answer to the board when a breach reaches the regulator. Lead Implementer is the practitioner credential for this seat.
- Risk and GRC managers — remits have widened since the Royal Commission from operational risk to the full regulatory obligation set. ISO 37301 gives that wider remit a recognised structure.
- Internal auditors and second-line assurance — boards increasingly ask audit committees to review the compliance framework itself, not just financial controls. Lead Auditor is the credential for forming that independent opinion.
- Consultants and advisers — readiness reviews, enforceable-undertaking remediation programs, and compliance framework builds are a growing Australian advisory market. Holding both PECB tiers is the usual consultant profile.
- Legal counsel and company secretaries — the natural internal candidates when an organisation formalises a compliance function for the first time and needs someone to translate obligations into controls.
The shorthand: if your organisation reports to ASIC, APRA, AUSTRAC, or an industry ombudsman — or holds licences and contracts with compliance conditions — someone internally should hold this credential.
Industries that need ISO 37301 in Australia
Four sectors generate most Australian ISO 37301 demand: financial services under ASIC and APRA, healthcare and aged care, government suppliers and regulated utilities, and the professions entering AML/CTF regulation in 2026. The pressure shows up differently in each, but the answer is the same management system.
Financial services — the post-Royal-Commission baseline
The Financial Services Royal Commission's final report in 2019 reset expectations for how Australian financial institutions manage compliance, and the regulatory follow-through has been sustained: the reportable situations regime (in force since October 2021) requires AFS and credit licensees to report significant breaches to ASIC within 30 days; RG 271 tightened internal dispute resolution; the Financial Accountability Regime attaches personal accountability to executives; and APRA CPS 220 and CPS 230 require risk management frameworks that expressly cover compliance and operational risk. Every one of those regimes assumes the organisation can detect, escalate, and evidence non-compliance systematically. ISO 37301 is the certifiable structure for exactly that capability.
Healthcare and aged care
Providers operate under dense, overlapping obligation sets — accreditation standards, the strengthened Aged Care Quality Standards, clinical governance, privacy, and funding conditions — each with its own reviewer. A CMS gives the organisation a single obligations register and a single review cycle rather than parallel compliance efforts per regulator, and gives the board evidence that conditions attached to funding are being met rather than assumed.
Government suppliers and regulated utilities
Where contracts carry compliance conditions and audit rights — Commonwealth panels, defence supply chains, energy and water licensees — demonstrating a systematic approach to obligations is increasingly a procurement expectation rather than an internal nicety. Suppliers already holding ISO 9001 or ISO 27001 certificates find ISO 37301 slots into the same integrated management system, sharing the internal audit and management review cycle.
Professions entering AML/CTF regulation — Tranche 2
From 1 July 2026, Australia's AML/CTF regime extends to tranche-two entities — lawyers, accountants, real estate professionals, and trust and company service providers — under AUSTRAC supervision. Thousands of firms that have never run a formal compliance program must now stand up customer due diligence, transaction monitoring, reporting, and a documented AML/CTF program. ISO 37301 is the management-system skeleton that absorbs a new obligation set like this without inventing a framework from scratch, which is why 2026 is driving a visible uptick in Australian CMS interest.
Mapping ISO 37301 to Australian regulatory expectations
ISO 37301 is not Australian law, but it is the management-system structure most often used to satisfy the compliance-framework expectations Australian regulators now hold. The table summarises the regimes Aegentra is most often asked about.
| Regulation or framework | What it requires | How ISO 37301 helps |
|---|---|---|
| ASIC reportable situations regime | AFS and credit licensees must assess reportable situations. Generally the reporting period is 30 calendar days from first knowing, or being reckless as to whether, there are reasonable grounds to believe a reportable situation has arisen; specific relief and exceptions apply. | The CMS obligations register, monitoring controls, and escalation paths make breach detection systematic rather than incidental — the difference between reporting on time and explaining a late report. |
| APRA CPS 220 and CPS 230 | A risk management framework covering compliance risk (CPS 220), plus operational risk and service-provider management obligations (CPS 230, in force July 2025). | A documented CMS is the standing evidence that compliance risk is identified, owned, controlled, and reviewed — the exact questions APRA supervisors ask in prudential reviews. |
| Whistleblower protections (Corporations Act Part 9.4AAA) | Public and large proprietary companies must maintain a whistleblower policy, protect disclosers, and prevent victimisation. | ISO 37301 requires a raising-concerns process with protection from retaliation as a core CMS element — the operational machinery behind the policy the law requires. |
| AML/CTF Act (AUSTRAC) — including Tranche 2 | Regulated entities must run an AML/CTF program: customer due diligence, monitoring, and reporting. Tranche-two professions come under the regime from 1 July 2026. | The CMS provides the governance loop — obligations, controls, training, monitoring, review — that an AML/CTF program needs to operate inside, particularly for firms regulated for the first time. |
| Privacy Act 1988 and the NDB scheme | APP compliance plus assessment and notification of eligible data breaches to the OAIC and affected individuals. | Privacy obligations sit in the same register as every other obligation, with owners, controls, and escalation. The CMS non-compliance handling process drives the NDB assessment clock. |
| Modern Slavery Act 2018 | Entities with revenue over $100M must publish annual modern slavery statements covering supply-chain risk and due diligence. | Supplier due diligence, obligation tracking, and evidence collection are standing CMS processes — the statement becomes an output of the system rather than an annual scramble. |
| Australian Consumer Law (ACCC) | Prohibitions on misleading conduct, unfair contract terms (with substantial penalties since 2023), and product safety obligations. | Court-enforceable undertakings routinely require a compliance program; an ISO 37301-aligned CMS is the recognised template, and holding one before an issue arises is strong mitigation evidence. |
The pattern across all seven items is the same: ISO 37301 is rarely a literal requirement, but it is almost always the most efficient documentary answer to a regulator, a board audit committee, or a procurement team that asks "show me your compliance framework."
How long does ISO 37301 certification take?
For an Australian SMB that already runs an Annex SL management system — ISO 27001 or ISO 9001, say — the realistic plan is 12–16 weeks of readiness followed by a Stage 1 / Stage 2 audit. Most of that time goes into the compliance obligations register: identifying every obligation source, assigning owners, mapping controls, and setting review frequencies. The governance skeleton — internal audit, management review, corrective action — extends from the existing system.
A greenfield build with no existing management system is typically four to six months. The extra time is not the documentation; it is embedding the monitoring and escalation behaviours so that Stage 2 evidence shows a system operating, not a binder written the month before.
As with every ISO scheme, audit bookings need 6–10 weeks lead time with Australian certification bodies. Book Stage 2 at the start of readiness, not the end.
How much does ISO 37301 certification cost in Australia?
Individual PECB training (Aegentra Academy)
- ISO 37301 Lead Implementer — $857 + GST
- ISO 37301 Lead Auditor — $857 + GST
Prices exclude GST (added at checkout). Both include the official PECB exam voucher, one free resit within 12 months, 12 months of myPECB access, and 31 CPD credits. Aegentra currently lists no Foundation tier for ISO 37301 — the range starts at Lead level.
Organisational certification
Ranges are typical for an Australian SMB of 10–50 staff. Organisations extending an existing Annex SL system land at the lower end; greenfield builds at the upper end.
| Component | Typical AUD | Frequency |
|---|---|---|
| Readiness and implementation support | $25,000–$55,000 | Once |
| Stage 1 + Stage 2 certification audit | $8,000–$18,000 | Once (every 3 years) |
| Annual surveillance audit | Starting at $2,500 | Year 1 + Year 2 |
| Three-year re-certification | $8,000–$15,000 | Year 3 |
The certification process, step-by-step
- 01Compliance obligations register
Identify every obligation source — legislation, licences, contracts, codes, voluntary commitments. Record the requirement, the owner, the control that satisfies it, the evidence, and the review frequency. This register is the spine of the whole system.
- 02Context and scope
Define what the CMS covers — entities, business lines, jurisdictions. Analyse interested parties: regulators, licensors, customers, and the board. Declare the scope you will be audited against.
- 03Compliance risk assessment
Assess each obligation for likelihood and consequence of non-compliance. This prioritises where controls and monitoring effort concentrate — the standard expects risk-based proportionality, not uniform coverage.
- 04CMS design
Write the compliance policy, define the compliance function and its independence, set roles and authorities, and establish the raising-concerns (speak-up) process with protection from retaliation.
- 05Control implementation
Operationalise the controls — training and awareness, third-party due diligence, monitoring and indicators, and the non-compliance handling process from detection through escalation to regulatory reporting where required.
- 06Internal audit
An independent reviewer audits the CMS against every applicable ISO 37301 clause. If you run other Annex SL systems, this typically joins the existing internal audit program.
- 07Management review
Leadership reviews CMS performance — obligations changes, non-compliance events, indicator trends, audit results — and records decisions. Auditors read this record closely; it evidences governing-body engagement.
- 08Stage 1 audit
Documentation review by an accredited certification body: the register, the policy, the risk assessment, and readiness for Stage 2. Typically 1–2 days, often remote.
- 09Stage 2 audit and certificate
Effectiveness audit — evidence sampled against operating controls, staff interviewed, escalations traced end-to-end. On a clear result, a three-year certificate issues with annual surveillance in years one and two.
Choosing a PECB ISO 37301 course
The ISO 37301 range runs at two tiers — Aegentra currently lists no Foundation course. The decision is a role decision: implementers build and run the CMS; auditors form an independent opinion on one. Both are five-day-equivalent programs delivered as self-paced study, both end in the same style of three-hour PECB exam, and both are $857 + GST.
| Course | Built for | Price (AUD + GST) | Format and effort |
|---|---|---|---|
| ISO 37301 Lead Implementer | Compliance officers, GRC managers, and consultants building and running a CMS — the internal owner of the obligations register. | $857 + GST | Self-study, 35–45 hours, 500+ pages of material, 31 CPD credits. |
| ISO 37301 Lead Auditor | Internal auditors, second-line assurance, and certification-body careers — auditing a CMS under ISO 19011 and ISO/IEC 17021-1. | $857 + GST | Self-study, 35–45 hours, 450+ pages of material, 31 CPD credits. |
Practitioners who intend to consult independently often take both: holding Lead Implementer and Lead Auditor can form part of the PECB Master pathway; additional examinations, professional experience, activity hours and an approved PECB application are required. Most people start with Lead Implementer, because understanding how a CMS is built makes it easier to judge whether one is working.
Aegentra Academy is an official PECB authorised training partner in Australia (verifiable on the PECB partner directory). Every enrolment includes the official PECB exam voucher and a free resit within 12 months. Online training formats and booking arrangements are listed on each course page.
The exam and credential tiers
ISO 37301 Lead Auditor: This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply. ISO 37301 Lead Implementer: This course publishes 12 months of material access. Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply.
The credential you receive depends on attested professional experience, not on which exam you sat. On the implementer ladder: Provisional Implementer requires no experience; Implementer requires two years (one in compliance management) plus 200 hours of activities; Lead Implementer requires five years (two in compliance management) plus 300 hours; Senior Lead Implementer requires ten years (seven in compliance management) plus 1,000 hours. The auditor ladder mirrors this exactly, with audit hours in place of project hours. All tiers require signing the PECB Code of Ethics, and credentials are maintained through CPD.
A practical note on transferability: the Lead Auditor method is not ISO 37301-specific. It is the general management-system audit discipline of ISO 19011 plus the certification process of ISO/IEC 17021-1 — the same method used to audit ISO 27001 and ISO 42001 systems. Auditors accumulate schemes rather than restart each time, which is why the credential compounds well for a GRC career.
Course-material access, examination and retake deadlines, and any certificate-application deadline are separate. Confirm the material-access start date in your booking confirmation and check the deadlines recorded in myPECB before scheduling your examination. PECB’s partner-course policy sets a 12-month examination and included-retake cycle from purchase for Self-Study and eLearning, or from course completion for instructor-led training. A failed attempt does not restart that cycle. The first retake requires at least 15 days after the unsuccessful examination; booking rules and the recorded myPECB deadline also apply.
FAQs
Is ISO 37301 certification mandatory in Australia?
No. ISO 37301 is voluntary. But ASIC and APRA both expect regulated entities to operate a systematic compliance framework — ASIC through the reportable situations regime and RG 271, APRA through CPS 220 and CPS 230. ISO 37301 is the most rigorous certifiable structure for that framework, and the certificate is the cleanest documentary evidence when a regulator, board, or procurement team asks how compliance is actually managed.
Can an organisation be certified against ISO 37301?
Yes. ISO 37301:2021 is a requirements standard, which means accredited certification bodies can audit and certify against it. This is the key change from its predecessor ISO 19600, which was guidance only. The certificate follows the standard ISO pattern: a Stage 1 and Stage 2 audit, a three-year certificate, and annual surveillance audits.
Did ISO 37301 replace ISO 19600?
Yes. ISO 37301:2021 replaced ISO 19600:2014 in April 2021. The substantive change is certifiability: ISO 19600 was a guidance document, while ISO 37301 contains auditable requirements. Organisations that aligned to ISO 19600 can generally transition without restructuring, because the underlying compliance management principles carried over.
What is the difference between ISO 37301 and ISO 37001?
ISO 37301 is the general compliance management standard — it covers the full obligation set an organisation faces, whether legal, regulatory, contractual, or voluntary. ISO 37001 is a targeted anti-bribery management system standard. They share the Annex SL structure and are frequently implemented together with a single governance loop. If bribery and corruption is the dominant risk, start with ISO 37001; if the problem is the breadth of your obligations, start with ISO 37301.
Is there an ISO 37301 Foundation course?
Not in the Aegentra Academy line-up. PECB training for ISO 37301 through Aegentra runs at two tiers: Lead Implementer for the person building and running the compliance management system, and Lead Auditor for the person independently assessing one. Both are $857 + GST, delivered as self-paced study with the official exam voucher and one free resit included.
How is the PECB ISO 37301 exam structured?
ISO 37301 Lead Auditor: Open-book, multiple-choice — stand-alone and scenario-based questions. Duration: 3 hours. 80 multiple-choice questions worth 100 points in total, across 7 competency domains — fundamental principles and concepts of a CMS (11 questions, 13.75 points), compliance management system requirements (10 questions, 12.5 points), fundamental audit concepts and principles (16 questions, 20 points), preparing an ISO 37301 audit (10 questions, 12.5 points), conducting an ISO 37301 audit (20 questions, 25 points — the heaviest domain), closing an ISO 37301 audit (6 questions, 7.5 points), and managing an ISO 37301 audit programme (7 questions, 8.75 points). Confirmed against PECB Candidate Handbook version 1.5. Passing requirements: 70%. Check the current PECB examination record and assigned examination before booking. ISO 37301 Lead Implementer: Open-book, multiple-choice — stand-alone and scenario-based questions. Duration: 3 hours. 80 multiple-choice questions worth 100 points in total, across 7 competency domains — fundamental principles and concepts of a compliance management system (8 questions, 10 points), initiation of a CMS implementation (12 questions, 15 points), planning of a CMS implementation (20 questions, 25 points — the heaviest domain), implementation of a CMS (15 questions, 18.75 points), monitoring and measurement of a CMS (10 questions, 12.5 points), continual improvement (8 questions, 10 points), and preparation for a CMS certification audit (7 questions, 8.75 points). Confirmed against PECB Candidate Handbook version 1.5. Passing requirements: 70%. Check the current PECB examination record and assigned examination before booking.
What experience do I need to hold the Lead Implementer credential?
ISO 37301 Lead Auditor: PECB expects knowledge of ISO 37301 requirements (or ISO 19600 guidance) for a compliance management system and a thorough understanding of audit principles. ISO 37301 Lead Implementer: Before attending, understand ISO management systems, the basics of ISO 37301 (or ISO 19600) and management-system implementation principles. ISO 37301 Lead Auditor: PECB credential ladder: Provisional Auditor (no experience required) → Auditor (two years of professional experience, one in compliance management, plus 200 hours of audit activity) → Lead Auditor (five years, two in compliance management, plus 300 hours) → Senior Lead Auditor (ten years, seven in compliance management, plus 1,000 hours). All tiers require signing the PECB Code of Ethics. Accreditation is program- and scope-specific; verify the applicable credential before enrolment. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials. ISO 37301 Lead Implementer: PECB credential ladder: Provisional Implementer (no experience required) → Implementer (two years of professional experience, one in compliance management, plus 200 hours of CMS project activity) → Lead Implementer (five years, two in compliance management, plus 300 hours) → Senior Lead Implementer (ten years, seven in compliance management, plus 1,000 hours). All tiers require signing the PECB Code of Ethics. Accreditation is program- and scope-specific; verify the applicable credential before enrolment. Passing the examination and receiving a credential are separate: PECB must approve the application. Maintenance depends on the credential awarded; Provisional credentials and Foundation certificates are exempt from CPD and maintenance fees. Check the current PECB policy for other credentials.
Does the Lead Implementer course certify my company?
No. The course certifies you as a practitioner. Certifying the organisation requires actually building the CMS — the compliance obligations register, controls, monitoring, and internal audit — then passing a Stage 1 and Stage 2 audit by an accredited certification body. The course teaches exactly that work, including preparation for the certification audit.