Introduction

Competence is a cornerstone of any effective compliance management system (CMS). ISO 37301:2021, the international standard for compliance management, emphasises the importance of ensuring that individuals within an organisation have the necessary knowledge, skills, and experience to fulfill their compliance responsibilities. This blog explores how ISO 37301 addresses competence needs and how organisations can apply these principles to strengthen their compliance programs.

Why Competence Matters in Compliance

Compliance involves understanding complex laws, interpreting policies, identifying risks, and making ethical decisions. If employees and compliance professionals lack the required competencies, even the best-designed CMS may fail to prevent or detect non-compliance.

Ensuring competence helps organisations to:
– Make informed decisions aligned with legal and ethical standards
– Reduce the risk of violations and misconduct
– Build a culture of accountability and awareness
– Strengthen stakeholder trust and reputation

Clause 7.2 – Competence

Clause 7.2 of ISO 37301 requires organisations to ensure that individuals performing compliance-related tasks are competent, based on appropriate education, training, or experience. The organisation must also take actions to acquire or improve necessary competencies where gaps are identified.

Key actions include:
– Identifying required competencies for each compliance role
– Providing training and development opportunities
– Evaluating the effectiveness of training
– Maintaining records of competence and qualifications

Developing a Compliance Competence Framework

To systematically address competence needs, organisations should:
1. Define core competencies required for compliance-related functions.
2. Conduct skills assessments to identify gaps.
3. Develop role-specific training programs and learning paths.
4. Establish mechanisms for continual professional development.
5. Link competence to performance reviews and career development.

Example: Pharmaceutical Company

A pharmaceutical firm identified that its sales team lacked updated knowledge of advertising regulations. It launched a mandatory compliance certification program covering marketing laws and product disclosure rules. As a result, the team’s understanding improved significantly, and regulatory risks related to promotional practices decreased.

Conclusion

Competence is not static—it must be developed, assessed, and maintained over time. ISO 37301 provides a clear framework for identifying and addressing competence needs, helping organisations embed compliance knowledge at all levels. By investing in people, organisations build stronger compliance systems and a culture of integrity that supports long-term success.

For further information and to book your ISO37301compliance management systems survey please contact: Marcus J Allen at Thamer James Ltd. Email: [email protected]

Marcus has twenty years’ experience in delivering Governance, Risk and Compliance solutions to over two hundred organisations within the UK. Marcus holds the respected Diploma in Governance, Risk and Compliance from the International Compliance Association and holds a master’s degree in Management Learning & Change from the University of Bristol.

Marcus is a member of BSI G01 Governance Committee, this committee contributed to the formulation of the above Standard, in the UK.