ISO 37302:2025

ISO 37302:2025 gives guidance for evaluating the effectiveness of a compliance management system established in line with ISO 37301, whether by self-evaluation or by a third party, external service provider or certification body. Three principles govern the evaluation (objectivity; completeness and scalability; traceability to evidence). Every indicator is scored on a five-level scale along three dimensions (policy and procedures; conduct and culture; results and impacts), from level 1 (few or no processes, no recognisable results) to level 5 (processes embedded, continually improved and adapted to context, results feeding a continual-improvement loop). The evaluation indicator framework aligns 23 indicators to ISO 37301: nine for planning and establishment (context and interested parties, compliance obligations, scope and compliance risk assessment, leadership and commitment, compliance governance principles, compliance culture, roles and responsibilities, compliance policy and objectives, planning of actions and resources), nine for implementation (operational controls, resources, competence and awareness, employment, rewards and discipline, training, communication, raising concerns, investigation, documented information) and five for performance evaluation and improvement (monitoring and measurement, internal audit, management review, nonconformity and noncompliance, continual improvement), each with a five-level table for procedures and conduct and a five-level table for results and impacts. Clause 7 sets the evaluation process: objectives, a structured approach, evaluator competence and independence, and design, implementation and reporting with follow-up and re-evaluation. Guidance, not certifiable; the companion to ISO 37301 certification audits and to compliance-programme effectiveness reviews expected by prosecutors' and regulators' guidance. It comprises 33 controls organised across 5 domains, and applies in International.