Compliance obligations and risk
Identify which legal and voluntary obligations apply, assess the risk of breaching them and decide how to treat it.
ISO 37301:2021 · UNE 19601:2017
Compliance and criminal compliance in one management system.
Audexa brings the requirements of ISO 37301 and those of UNE 19601 for crime prevention models into one guided self-assessment: obligations, risks, compliance body, whistleblowing channel, third parties, training and improvement. Every gap becomes a task with an owner and the evidence you need.
- 68 controls in 10 sections
- Art. 31 bis of the Spanish Criminal Code
- Linked to the SII reporting channel (Law 2/2023)
ISO 37301 / UNE 19601 self-assessmentIn progress
58%
Implementation levelSample data
- Compliance obligations and risks71%
- Compliance function and criminal compliance body64%
- Criminal risk map49%
- Channel, investigations and disciplinary regime55%
- Training and model verification42%
68 controls with how to assess them and how to meet them
10 sections: 6 for ISO 37301 and 4 specific to UNE 19601
48 mappings to the internal reporting system (SII, Law 2/2023)
52 mappings to ISO 9001:2015 to reuse your management system
What the standards ask for
A compliance model only counts if it works and you can prove it.
ISO 37301 is the international standard for compliance management systems. UNE 19601 is the Spanish standard for criminal compliance management systems, built around the organisation and management models in article 31 bis of the Spanish Criminal Code. Many organisations work on both at once.
Criminal compliance body
The Spanish Criminal Code requires model oversight to sit with a body that has autonomous powers of initiative and control, resources and access to information.
Criminal risk map
Work out in which activities the offences attributable to a legal person could be committed, and which controls prevent them.
Whistleblowing channel
Spain's Law 2/2023 requires, among others, companies with 50 or more employees to run an internal reporting system that protects whistleblowers.
Third parties and financial controls
Due diligence on business partners and financial resource management models designed to prevent offences.
Verification and improvement
Disciplinary regime, training, periodic review of the model and changes after serious breaches or organisational change.
Sources: Spanish Criminal Code, art. 31 bis (BOE) · Law 2/2023 on whistleblower protection (BOE) · ISO 37301:2021 (ISO)
How Audexa helps
From self-assessment to a compliance plan with owners.
The same workflow as every other Audexa audit, with controls built for the compliance function and the crime prevention model.
Assess
Know what you have and what is missing.
Guided questionnaire
68 controls answered one by one with Yes, Partial, No or Not applicable, plus guidance on how to assess each one.
Applicability with a reason
Mark which controls apply, which do not and which are out of scope, and record why.
What you already have
When you create the audit you see how much your SII or ISO 9001 audits already cover.
Act
Turn every finding into work.
How to meet each control
Concrete steps, expected evidence, suggested owner, closure criterion and when to review it.
Task plan
Findings turned into tasks with subtasks, owners and dates.
Risk matrix
Record compliance and criminal risks with likelihood, impact and treatment.
Prove
Keep your evidence in order.
Evidence vault
Compliance body minutes, training records or verification reports, with review and expiry dates.
Policies
A library of 67 editable templates. 8 are linked to ISO 37301: “Compliance and Crime Prevention Policy”, “Code of Ethics and Conduct”, “Anti-Bribery, Gifts and Conflicts of Interest Policy”, “Internal Reporting System Policy (Whistleblowing Channel)”, “Internal Investigations and Disciplinary Procedure”, “Risk Management Policy”, “Third-Party Management Policy” and “Security Awareness and Training Policy”. They are a starting point to adapt and approve.
Reports and re-audits
Score, findings and a PDF and Excel report. Assess again and compare progress.
Some features depend on your plan and active modules.
UNE 19601
The crime prevention model, control by control.
Four sections cover what UNE 19601 and article 31 bis ask for: applicability and criminal risk map, model governance and the criminal compliance body, protocols and financial controls, and training, channel, disciplinary regime and verification.
- Map of the activities where offences could be committed
- Autonomy, resources and independence of the criminal compliance body
- Decision-making protocols and financial resource management
- Periodic verification and review after breaches or changes
Criminal complianceArt. 31 bis
- Criminal risk mapPartial
- Criminal compliance body appointedYes
- Financial controlsPartial
- Disciplinary regimeNo
Whistleblowing channel
What you already answered for SII carries over.
The whistleblowing channel in ISO 37301 and UNE 19601 is linked to the SII framework for Law 2/2023 through 48 mappings, and the management system shares 52 with ISO 9001. Answers with high coverage arrive as proposals marked “Review it” and a person decides whether to confirm them.
- 48 pairs with SII (Law 2/2023) and 52 with ISO 9001:2015
- Only high coverage proposes a “Yes”
- Each mapping has its relationship, coverage and rationale
- They are not legal equivalences: a person always confirms
Proposed answersReview it
- Internal reporting channelFrom SII · high coverage
- Protection against retaliationFrom SII · high coverage
- Control of documented informationFrom ISO 9001 · partial
- Investigation of reportsNo proposal
How it works
Three steps to organise your compliance.
Create the audit
Choose ISO 37301 / UNE 19601 and see how much your existing work covers. Decide which controls apply and why.
Answer with guidance
Assess the 68 controls and review the answers proposed from SII or ISO 9001.
Execute and re-audit
Work through the task plan, gather evidence and assess again to see progress.
Plans
Available from the Premium plan.
ISO 37301 / UNE 19601 is included in Premium and Diamond. It is not part of Free or Core. We give you a fixed proposal during the demo.
Premium
RecommendedFor compliance teams that want the full cycle.
- ISO 37301 / UNE 19601 and the other new frameworks
- 10 audits a month and 3 users
- Policies, evidence, risks and tasks
- Aude assistant
Diamond
For groups with several companies or large teams.
- Unlimited audits and users
- Everything in Premium
Frequently asked questions
What people usually ask us about ISO 37301 / UNE 19601.
What is the difference between ISO 37301 and UNE 19601?
ISO 37301 is an international standard for managing compliance in general. UNE 19601 is Spanish and focuses on criminal compliance, that is, preventing the offences that can be attributed to a legal person under article 31 bis of the Spanish Criminal Code. In Audexa you work on both in one questionnaire: 6 sections for ISO 37301 and 4 for UNE 19601.
Does Audexa certify me against ISO 37301 or UNE 19601?
No. Certification is issued by a certification body. Audexa helps you run the self-assessment, organise the action plan and have your evidence ready for that audit.
Is it legal advice on article 31 bis?
No. The result is for guidance only. It does not replace a lawyer's judgement and does not guarantee exemption from criminal liability. It shows you where your model stands and what is left to do.
We already have a Law 2/2023 whistleblowing channel. Can we reuse it?
Yes. If you already have an audit of the SII framework, its high-coverage answers are proposed for the channel controls in ISO 37301 / UNE 19601 so a person can review and confirm them.
Do I need to fill in a profile before starting?
No. This framework has no profile question: all controls appear from the start and you mark which ones apply and why.
Which languages is it available in?
Spanish, English, French, Italian and German, like every other Audexa framework.
Request a demo
See your compliance model in Audexa.
In 30 minutes we walk through the ISO 37301 / UNE 19601 self-assessment, the task plan and the evidence.
- We look at which parts of your model are already documented.
- We show you the questionnaire, the findings and the tasks.
- We explain which plan fits your team.