ISO 37303:2025

ISO 37303:2025 gives guidance for managing the competence needed to achieve a compliance management system's objectives under ISO 37301, whose clause 7 requires the organization to determine, secure and evidence the competence of persons doing work under its control. Clause 4 covers competence management: identifying and assessing needs and setting competency criteria for the system and for compliance risk areas (4.1), objectives that keep competence management consistent with the compliance objectives and business strategy and sustain a compliance culture (4.2), determining competence needs through an integrated four-dimension model (personal, methodological, technical, social) for each function, the organization as a whole, the governing body and top management, the compliance function, management, risk-exposed personnel and third parties (4.3), and assessing the current state of competence and relating the gaps to the compliance risk assessment (4.4). Clause 5 covers competence development: planning, programme structure, activities including training at the start of employment and at planned intervals, and roles and responsibilities. Clause 6 covers evaluation, maintenance and continual improvement of the competence management programme. Annex A gives an informative competence portfolio: how to determine a competence matrix, design indicators and measure competence, and the competence to determine for each function, including for the compliance function knowledge of the system, of compliance risk management, of organizational governance and of relevant laws, skills for operating the system and behaviour supporting compliance culture. Guidance, not certifiable; the competence companion to ISO 37301 certification and to ISO 37302 effectiveness evaluation.