King IV vs ISO 37301: governance code or compliance system?

Compliance teams in South Africa often meet King IV and ISO 37301 in the same conversation, and the two are easy to confuse. They answer different questions for different audiences, and they work best together.

King IV: a code for governing bodies

The King IV Report on Corporate Governance for South Africa, 2016 was published by the Institute of Directors in Southern Africa (IoDSA) and took effect for financial years starting on or after 1 April 2017. It sets out principles for governing bodies, such as boards, councils and accounting authorities, on an "apply and explain" basis: organisations are expected to apply the principles and explain the practices they use to do so.

King IV is built around four governance outcomes: an ethical culture, good performance, effective control and legitimacy. Among its principles, the governing body should govern compliance with applicable laws and adopted, non-binding rules, codes and standards in a way that supports the organisation being ethical and a good corporate citizen. Sector supplements adapt the code for municipalities, state-owned entities, non-profit organisations, retirement funds and small and medium enterprises.

King IV says what the governing body should ensure. It does not prescribe the management system that delivers it.

ISO 37301: a management system for compliance

ISO 37301:2021, Compliance management systems: Requirements with guidance for use, was published in April 2021 and replaced ISO 19600:2014. The difference matters: ISO 19600 was guidance only, while ISO 37301 contains requirements, so an organisation can be audited and certified against it.

It follows the same harmonised structure as other ISO management system standards, such as ISO 27001 and ISO 9001, which makes integration easier. Its requirements cover:

• the context of the organisation and the scope of the compliance management system;
• identifying compliance obligations and assessing compliance risks;
• leadership, a compliance policy and an independent compliance function;
• resources, competence, training and a culture that supports raising concerns;
• operational controls and procedures;
• monitoring, measurement, internal audit and management review;
• handling non-compliance and continual improvement.

Where COSO fits

COSO, the Committee of Sponsoring Organizations of the Treadway Commission, publishes frameworks used worldwide to structure risk and control work: Internal Control, Integrated Framework (2013) and Enterprise Risk Management, Integrating with Strategy and Performance (2017). In 2020 COSO also published guidance on applying its enterprise risk management framework to compliance risk. Many compliance teams borrow COSO's language and structure for risk assessments and control design inside an ISO 37301 system.

Side by side

How they fit together

1. The governing body sets direction (King IV). It approves the compliance policy, sets the tone at the top and oversees how compliance is governed.
2. Management runs the system (ISO 37301). The compliance function maintains the register of obligations, assesses risk, runs controls, trains people and reports.
3. Risk work uses a shared method (COSO). Risk assessment and control design follow a consistent structure that internal audit can test.
4. Reporting closes the loop. Monitoring results and incidents flow back to the governing body, which can then explain how it applied the King IV principles.

Practical first steps

• Build a register of compliance obligations: laws, regulations, licence conditions, codes and contracts.
• Assess the compliance risk of each obligation, using a consistent method.
• Map existing controls to the highest risks and close the gaps first.
• Agree what the governing body will receive, how often, and in what form.
• Train the people who own controls, not only the compliance team.