ISO 37301 Standard: Compliance Measurement and Reporting
Get certified with SCS Certification: https://scscertification.com/contactus.php
Introduction
A compliance management system needs more than documented policies and procedures. Organizations also need to understand whether their compliance activities are working, whether identified risks are being addressed and whether management receives the information required to make informed decisions.
The ISO 37301 standard provides a framework for establishing, implementing, evaluating, maintaining and continually improving a Compliance Management System (CMS). Measurement and reporting help organizations assess how effectively their arrangements operate and identify areas requiring further attention.
For example, an organization may have a procedure for reviewing regulatory requirements, but the existence of that procedure does not show whether reviews happen on time or whether relevant changes reach the employees responsible for implementation.
Performance measurement helps close this gap between documented arrangements and operational results.
This article explains how organizations can measure compliance performance, choose meaningful indicators, calculate results, prepare management reports and use performance information to improve their Compliance Management System.
What Is the ISO 37301 Standard?
ISO 37301:2021 is an international standard that specifies requirements and provides guidance for establishing, developing, implementing, evaluating, maintaining and improving a Compliance Management System.
It can be applied by organizations across different industries and sizes. The practical approach depends on the organization's activities, operating environment, compliance obligations, risks and governance arrangements.
A CMS provides a structured way to identify applicable obligations, establish responsibilities, support a culture of compliance, monitor relevant activities and respond to identified weaknesses.
Measurement helps management determine whether these arrangements are achieving their intended outcomes.
For instance, a company may require its departments to review applicable compliance obligations every quarter. Management should be able to establish whether those reviews took place, whether significant changes were identified and whether resulting actions were completed.
The ISO 37301 standard supports a systematic approach to compliance management. The indicators used to evaluate performance should be selected according to the organization's own circumstances rather than copied from an unrelated business.
Why Compliance Measurement Matters
Organizations may face legal, regulatory, contractual and internal compliance requirements that change over time. Without reliable monitoring, management may overlook overdue reviews, ineffective controls, recurring weaknesses or delayed corrective actions.
A structured measurement process helps organizations:
- Monitor progress against compliance objectives.
- Identify overdue activities and unresolved issues.
- Evaluate the operation of compliance controls.
- Recognize recurring problems and emerging risks.
- Assess whether employees understand their responsibilities.
- Support management review and resource allocation.
- Maintain evidence of monitoring and improvement.
Measurement should serve a clear purpose. Collecting large amounts of data without analysing its significance can create unnecessary administration without improving compliance performance.
The objective is to produce information that helps management understand what is happening, why it matters and what action may be necessary.
Does ISO 37301 Prescribe Specific Performance Indicators?
Organizations should distinguish between the requirement to evaluate CMS performance and the selection of specific indicators.
ISO 37301 addresses monitoring, measurement, analysis and evaluation. However, organizations should not assume that one universal set of numerical indicators or targets applies to every business.
A suitable measurement framework should reflect the organization's compliance objectives, risks, operational activities and management needs.
For example:
- A financial services organization may monitor regulatory reporting deadlines, compliance reviews and outstanding control weaknesses.
- A construction contractor may track permit renewals, contractual obligations and corrective actions arising from inspections.
- A healthcare provider may monitor mandatory training and the timely review of applicable regulatory requirements.
- A logistics company may measure driver-related compliance training, vehicle documentation and required operational checks.
The key question is not how many indicators an organization can collect. It is whether the information helps management evaluate compliance performance and make appropriate decisions.
Main Areas of Compliance Performance Measurement
An effective framework covers several aspects of compliance management. An organization that relies on a single overall score may overlook weaknesses in critical processes.
1. Compliance Obligation Reviews
Organizations need a reliable process for identifying and reviewing applicable compliance obligations. These may arise from laws, regulations, contracts, permits, industry requirements or internal commitments, depending on the organization's circumstances.
Useful measures include:
- Percentage of scheduled compliance obligation reviews completed on time.
- Number of overdue reviews.
- Time taken to assess newly identified or changed requirements.
- Percentage of relevant updates communicated to responsible personnel.
- Number of outstanding actions arising from obligation reviews.
Example:
A company schedules 80 compliance obligation reviews during a quarter. It completes 72 within the required period.
On-time review rate = Reviews completed on time ÷ Total scheduled reviews × 100
72 ÷ 80 × 100 = 90%
The result shows that 10% of the scheduled reviews were not completed on time.
Management should determine why the reviews were delayed, whether the affected obligations are significant and whether additional action is required.
The percentage alone does not establish the level of risk. A delay involving a critical regulatory obligation may need more urgent attention than a delay involving a lower-risk internal review.
2. Compliance Risk Assessment
Compliance risk assessments help organizations identify and evaluate risks associated with their obligations and activities.
Performance measures can show whether assessments are completed as planned and whether identified risks receive suitable treatment.
Possible measures include:
- Percentage of planned compliance risk assessments completed.
- Number of high-priority risks without approved treatment plans.
- Percentage of risk treatment actions completed by their due dates.
- Number of overdue reviews involving high-risk activities.
- Percentage of significant business changes assessed for compliance implications.
Completion rates should not be considered in isolation.
An organization might complete every planned risk assessment while leaving important risks without effective controls. Management should therefore review completion results alongside risk severity, treatment status and control effectiveness.
3. Compliance Training and Awareness
Employees and relevant external parties need to understand the compliance responsibilities that apply to them.
Training records help demonstrate participation, but additional evidence may be necessary to understand whether employees have understood the requirements and can apply them appropriately.
Relevant measures include:
- Mandatory compliance training completion rate.
- Percentage of new employees completing required induction within the defined period.
- Percentage of relevant personnel receiving role-specific training.
- Assessment pass rate, where knowledge checks are used.
- Number of overdue training assignments.
- Results of follow-up checks on employee understanding.
Example:
An organization assigns mandatory compliance training to 250 employees. By the reporting deadline, 235 employees have completed it.
Training completion rate = Employees completing training ÷ Employees assigned training × 100
235 ÷ 250 × 100 = 94%
The organization should identify the 15 employees who have not completed the training and follow up according to its established process.
However, a 94% completion rate does not automatically prove that employees understand the requirements. Assessment results, feedback, observed practices and relevant compliance incidents may provide additional information.
4. Compliance Monitoring and Control Performance
Organizations may establish controls to help meet their compliance obligations and manage identified risks. Monitoring helps management understand whether those controls operate as intended.
Possible measures include:
- Percentage of scheduled control checks completed.
- Number of failed control tests.
- Number of overdue control reviews.
- Percentage of sampled transactions meeting defined compliance criteria.
- Number of control weaknesses awaiting remediation.
- Time taken to address significant control failures.
These measures should be connected to specific risks and processes.
For example, completing 98% of planned checks may appear positive. However, if the missed checks involve a critical compliance control, management may need to take immediate action.
An overall percentage should not conceal significant exceptions. Where appropriate, report high-risk controls separately from routine operational checks.
5. Compliance Incidents and Reported Concerns
Compliance concerns may be identified through employee reporting channels, customer complaints, audit findings, monitoring activities, disclosures or other sources.
Organizations can measure how concerns are received, assessed and addressed.
Useful measures include:
- Number of compliance concerns received during the reporting period.
- Percentage of concerns acknowledged within the defined timeframe.
- Average time taken to conduct an initial assessment.
- Percentage of cases resolved within the established target.
- Number of open cases beyond their target completion dates.
- Number of recurring concerns involving similar underlying issues.
These measures require careful interpretation.
An increase in reported concerns does not necessarily mean that compliance performance has deteriorated. It may indicate improved awareness, greater confidence in reporting channels or more effective identification of potential problems.
Management should consider the nature and seriousness of concerns, response quality, recurring patterns and the effectiveness of corrective actions.
A lower number of reports should not automatically be treated as evidence of better compliance.
6. Corrective Actions and Nonconformities
Corrective action processes help organizations respond to identified weaknesses and reduce the likelihood of recurrence.
Useful measures include:
- Percentage of corrective actions completed by their due dates.
- Number of overdue corrective actions.
- Average time required to close an action.
- Percentage of actions verified as effective.
- Number of repeat findings.
- Percentage of recurring issues with completed root-cause analysis.
Closing an action in a tracking system does not automatically mean that the underlying problem has been resolved.
The organization should establish whether the action addressed the cause, whether the required changes were implemented and whether the weakness has reappeared.
For example, a department may close several overdue actions by updating procedures. If employees continue to follow the previous process, the action may not have achieved its intended result.
Performance reporting should distinguish between administrative closure and verified effectiveness.
7. Internal Audit and Management Review
Internal audits and management review provide information about whether the Compliance Management System operates as planned and where improvements may be required.
Possible measures include:
- Percentage of the approved internal audit programme completed.
- Number of overdue audit actions.
- Percentage of findings closed within the agreed timeframe.
- Number of repeat findings across audit cycles.
- Percentage of planned management reviews completed.
- Percentage of management review actions completed by their due dates.
The number of audit findings should not be interpreted in isolation.
An increase may result from a more thorough audit or better identification of weaknesses. Severity, recurrence, underlying causes and corrective action effectiveness provide more meaningful context.
Management review should consider whether the CMS is achieving its intended results and whether changes, resources or additional actions are required.
Leading and Lagging Compliance Indicators
A balanced measurement framework should include both leading and lagging indicators.
Leading Indicators
Leading indicators measure activities or conditions that may help prevent a compliance failure.
Examples include:
- Completion of scheduled compliance risk assessments.
- Timely review of changed compliance obligations.
- Completion of role-specific training.
- Planned control checks completed on time.
- High-priority risks with approved treatment plans.
These measures can help management identify weaknesses before they result in a significant incident.
Lagging Indicators
Lagging indicators record events or outcomes that have already occurred.
Examples include:
- Confirmed compliance breaches.
- Repeat audit findings.
- Missed regulatory or contractual deadlines.
- Substantiated cases of noncompliance.
- Recurring control failures.
Both types of indicators are useful. Leading indicators help monitor preventive activities, while lagging indicators provide information about actual outcomes.
Organizations should not rely exclusively on either category. Completing planned activities does not guarantee that risks are adequately controlled, while waiting for an incident may mean that an opportunity for early intervention has been missed.
How to Calculate Compliance Performance Measures
Each measure should have a clear definition and a repeatable calculation method. The organization should identify the data source, reporting period, responsible owner, target and escalation criteria.
The following formulas are practical examples, not universal formulas prescribed by ISO 37301.
Training Completion Rate
Formula:
Training completion rate = Employees who completed assigned training ÷ Employees assigned training × 100
Use a clearly defined employee population and reporting deadline. Explain how approved exemptions, extended leave and newly assigned training are handled.
On-Time Review Rate
Formula:
On-time review rate = Reviews completed by their due dates ÷ Reviews due during the period × 100
The denominator should include reviews due during the reporting period according to a consistent rule.
Corrective Action Closure Rate
Formula:
On-time corrective action closure rate = Corrective actions closed by their due dates ÷ Corrective actions due during the period × 100
Define how extensions, reopened actions and actions awaiting effectiveness verification are treated.
Control Testing Pass Rate
Formula:
Control testing pass rate = Control tests meeting defined acceptance criteria ÷ Total valid control tests completed × 100
Acceptance criteria should be established before testing. Where tests differ significantly in risk or complexity, management may need to review results by control category rather than rely on one combined figure.
Average Response Time
Formula:
Average response time = Total elapsed response time across included cases ÷ Number of included cases
The organization should define when the clock starts and stops. It should also consider whether an average conceals a small number of exceptionally delayed cases.
For some processes, the percentage of cases handled within an agreed timeframe may be more useful than the average alone.
Repeat Finding Rate
Formula:
Repeat finding rate = Findings classified as recurring ÷ Total findings reviewed for recurrence × 100
The organization should establish a consistent definition of a repeat finding. Recurrence may be assessed by reference to the same process, control, requirement or underlying cause, depending on the documented method.
How to Set Meaningful Performance Targets
Targets should reflect the organization's compliance objectives, risks, available resources and operating context. A target copied from another business may not be suitable.
For example, an organization may require all high-priority compliance obligation reviews to be completed by their due dates. It may establish a different target for routine reviews.
Before approving a target, management should consider:
- The seriousness of the compliance risk.
- Applicable legal, regulatory, contractual and internal requirements.
- Historical performance and known weaknesses.
- The organization's capacity to meet the target.
- The response required when performance falls short.
- Whether the target encourages appropriate behaviour.
Some targets may reasonably be set at 100%, particularly where a critical activity must be completed within a specific timeframe. Other measures may require different thresholds or qualitative evaluation.
Targets should not encourage employees to conceal concerns, rush reviews or close actions without adequate evidence.
A sound measurement framework evaluates whether compliance activities and controls are effective rather than simply rewarding favourable numbers.
Building a Compliance Performance Dashboard
A dashboard should help management identify important trends, exceptions and actions without requiring readers to interpret dozens of unrelated figures.
A practical dashboard can include the following fields:
- Indicator name.
- Compliance objective.
- Calculation method.
- Current result.
- Approved target.
- Previous result.
- Performance trend.
- Risk significance.
- Responsible owner.
- Required action.
- Due date.
- Supporting evidence source.
The dashboard should distinguish between meeting a numerical target and adequately controlling a compliance risk.
A green status may indicate that a target has been achieved, but management may still need to consider incidents, changes in compliance obligations or other information that the indicator does not capture.
Example Compliance Performance Dashboard
The following figures are illustrative only. They are not targets prescribed by ISO 37301.
| Measure | Illustrative target | Current result | Example management response |
|---|---|---|---|
| Mandatory training completion | 98% | 94% | Follow up on outstanding assignments |
| High-priority obligation reviews completed on time | 100% | 90% overall | Review overdue items and their significance |
| Corrective actions closed by due date | 95% | 88% | Examine delays and resource constraints |
| Planned control checks completed | 98% | 97% | Review missed checks and their importance |
| High-priority risks without approved treatment plans | 0 | 3 | Assign owners and establish treatment plans |
| Repeat findings | Downward trend | Increased this quarter | Review underlying causes and corrective action effectiveness |
The dashboard is useful only when the results lead to appropriate action. An unfavourable result should be assessed according to its significance, not simply its colour or percentage.
Ensuring Data Quality and Reliable Reporting
Management decisions are only as reliable as the information used to support them.
Before reporting a result, the responsible team should confirm that the data is complete, accurate, current and consistent with the approved definition.
The process should also explain how missing records, duplicate entries, exclusions and late updates are handled.
For example, if one department counts all completed training assignments while another counts only assignments completed before the deadline, their results cannot be compared fairly without clarifying the difference.
Organizations can strengthen reporting reliability by:
- Maintaining documented calculation rules.
- Identifying authoritative data sources.
- Assigning responsibility for data collection and validation.
- Applying consistent reporting periods.
- Retaining supporting evidence.
- Recording material changes to definitions.
- Reviewing unusual results before publication.
- Restricting access to sensitive case information.
Automated reports can reduce manual effort, but they still require appropriate checks. Incorrect system settings, incomplete data feeds or inconsistent classification rules can produce misleading results.
Reporting Compliance Performance to Top Management
A compliance report should do more than list percentages. It should explain what the results mean, which risks require attention and what decisions may be needed.
A useful report typically covers the following areas.
Overall performance: Summarize significant changes during the reporting period.
Important exceptions: Identify overdue activities, missed targets, significant incidents and unresolved control weaknesses.
Risk implications: Explain whether the results may affect the organization's ability to meet its compliance obligations.
Underlying causes: Describe recurring issues, resource constraints, unclear responsibilities or control weaknesses where the available evidence supports those conclusions.
Corrective action: Identify the required response, accountable owner and target completion date.
Management decisions: Highlight matters requiring approval, additional resources, changes to priorities or escalation.
Reporting frequency should reflect the nature and urgency of the information. Operational measures may be reviewed monthly, while significant incidents may require immediate escalation under the organization's established process.
A quarterly summary may be useful for reviewing trends and overall performance, provided urgent matters are not left until the next scheduled meeting.
Using Performance Results for Continual Improvement
Measurement creates value when it leads to a better understanding of compliance performance and appropriate follow-up.
Suppose an organization repeatedly misses its target for reviewing compliance obligations. The immediate response might be to remind employees of deadlines. However, the underlying cause could be unclear ownership, an incomplete register, insufficient resources or a process that does not alert responsible staff when requirements change.
A useful improvement process should:
- Confirm the reliability of the reported result.
- Determine the significance of the performance gap.
- Identify the underlying cause where appropriate.
- Decide on proportionate corrective action.
- Assign an owner and completion date.
- Verify whether the action has been implemented.
- Evaluate whether performance or control effectiveness has improved.
- Update the risk assessment, process or measurement method when justified.
Repeated underperformance should prompt a review of the system behind the result, not simply a request to improve the number.
Common Mistakes in Compliance Measurement
Measuring Activity Instead of Effectiveness
Counting policies issued, training sessions delivered or audits completed may show that work took place. It does not necessarily establish whether the work improved compliance performance.
Combine activity measures with relevant outcome or effectiveness indicators.
Choosing Too Many Measures
A long list can make reporting difficult and obscure significant risks. Select measures that support clear objectives and management decisions.
Using Inconsistent Definitions
Different departments may calculate the same measure differently. Document definitions, reporting periods and exclusions before comparing results.
Treating Every Compliance Concern as a Failure
The number of reported concerns must be interpreted in context. A functioning reporting culture may increase visibility of problems that previously went unreported.
Closing Actions Without Checking Effectiveness
An action marked complete may not address the underlying cause. Where appropriate, verify the result and check whether the problem has recurred.
Ignoring the Importance of Individual Risks
An overall average can conceal a serious failure involving a critical obligation. Report significant exceptions separately when necessary.
Setting Targets Without Considering Risk
A target that looks good on a dashboard may not be suitable for the organization's compliance obligations. Targets should be justified by risk, requirements and business context.
ISO 37301 and Other Management Systems
Organizations that maintain more than one management system may be able to coordinate certain measurement and reporting activities.
For example, document control, internal audit, corrective action, management review and continual improvement may share compatible processes across ISO 37301 and standards such as ISO 9001, ISO 14001 or ISO 37001.
However, integration should not remove the specific information needed to evaluate compliance risks and obligations. Quality, environmental, anti-bribery and broader compliance measures may have different definitions and escalation requirements.
A shared dashboard can be useful when it preserves the detail required by each management system and clearly identifies accountability.
Preparing for an ISO 37301 Assessment
Organizations preparing for an independent assessment should be able to explain how they monitor and evaluate the performance of their Compliance Management System.
Depending on the organization's scope and arrangements, relevant evidence may include:
- Approved compliance objectives and measurement criteria.
- Indicator definitions and calculation methods.
- Compliance risk assessments and treatment records.
- Training records and relevant assessment results.
- Records of monitoring and control checks.
- Compliance concern and incident records, handled with appropriate confidentiality.
- Internal audit findings and corrective action records.
- Management reports and review decisions.
- Evidence that actions were followed up and their results evaluated.
The evidence should reflect the organization's actual processes. Creating a dashboard shortly before an assessment will not, by itself, demonstrate that performance monitoring is established and operating effectively.
Organizations seeking certification should understand their CMS requirements and determine what evidence is appropriate to their risks, objectives and scope.
For information about certification scope and the assessment process, visit the SCS Certification ISO 37301 service page or consult the existing practical guide to ISO 37301 certification in the UAE.
Conclusion
The ISO 37301 standard provides a framework for establishing and improving a Compliance Management System. Effective measurement and reporting help organizations understand whether their arrangements are operating as intended and where further attention may be required.
Organizations should select measures based on their compliance obligations and risk profile, document how each measure is calculated, validate the underlying data and report results in a way that supports timely decisions.
Numerical targets should encourage effective compliance management rather than the pursuit of favourable dashboard results. When performance information is reviewed consistently and translated into appropriate action, it can support stronger oversight, more reliable controls and continual improvement.
Need guidance on ISO 37301 certification? Contact SCS Certification to discuss your organization's certification scope and assessment requirements.
Need ISO Certification for Your Business?
Speak with our certification specialists to understand certification requirements, audit process, implementation timelines and accredited certification services.
