Building or refreshing a compliance management system

Short answer: Under the German auditing standard IDW PS 980, a compliance management system (CMS) consists of seven basic elements: compliance culture, objectives, organisation, risks, programme, communication, and monitoring and improvement. To build a compliance management system, you start with a compliance risk assessment and derive rules, responsibilities and controls from it. Most companies in Germany and Switzerland are not explicitly required to have a CMS, but organisational and supervisory duties such as section 130 of the German Administrative Offences Act (OWiG) or Art. 716a of the Swiss Code of Obligations (OR) make an effective system necessary in practice.

This guide is for heads of compliance, general counsel and executive boards in Switzerland and Germany who are building a CMS from scratch or refreshing one after audit findings, growth or new regulation. It explains the building blocks, the role of IDW PS 980 and ISO 37301 and the resources required.

The seven basic elements of a CMS

The seven elements of IDW PS 980 are the most widely used structure for building a CMS in practice, in Switzerland as well. Each element should be evidenced by a concrete output document.

Culture, objectives and risks: the foundation

The foundation of a CMS is a clear stance from leadership, defined objectives and a robust risk assessment. Without these three elements, policies and training remain arbitrary.

Culture: the executive board must visibly support the CMS, provide resources and deal with misconduct consistently. A code of conduct only helps if managers live by it.

Objectives: decide which areas of law are material for your company, for example bribery, competition law, anti-money laundering, data protection, sanctions or product safety. The board should approve this scope.

Risks: the compliance risk assessment is the most important step in the build. A proven approach:

1. Map the business model, countries, sales channels and business partners.
2. Identify relevant areas of law and risk scenarios for each business area.
3. Score likelihood and impact using a fixed method.
4. Map existing measures and controls.
5. Prioritise residual risks and actions and have them confirmed by management.

Programme, organisation, communication and monitoring

The compliance programme, organisation, communication and monitoring all follow from the risk assessment. These four elements make the CMS work day to day.

• Programme: policies on the material risks, processes such as business partner due diligence or approval of gifts and hospitality, plus controls and a training plan by target group.
• Organisation: compliance officers with a clear reporting line to management, sufficient authority and access to information. For German credit institutions, the BaFin minimum requirements for risk management (MaRisk, AT 4.4.2) require a compliance function that in principle reports directly to management.
• Communication: regular information for staff, a reporting channel for concerns and a report to management at least once a year.
• Monitoring and improvement: a monitoring plan with sample testing, a register of identified deficiencies and an annual review of the risk assessment. Our guide on compliance remediation after audit findings shows how to work through findings in a structured way.

Is a compliance management system a legal requirement?

For most companies a CMS as such is not explicitly required, but an organisation that prevents breaches is. The key legal bases:

• Germany: under section 130 OWiG, the owner of a business commits an administrative offence if they fail to take the supervisory measures needed to prevent breaches; where the breach is a criminal offence, the fine can reach EUR 1 million. Section 91(2) of the German Stock Corporation Act (AktG) requires the management board to set up a monitoring system for early detection of developments that threaten the company's existence; listed companies additionally need an appropriate and effective internal control and risk management system under section 91(3) AktG. For credit institutions, section 25a(1) of the German Banking Act (KWG) requires proper business organisation including a compliance function as part of the internal control system.
• Switzerland: under Art. 716a(1) no. 5 OR, the board of directors has the non-transferable duty of overall supervision of management, in particular with regard to compliance with the law, articles of association, regulations and instructions. Banks and insurers in FINMA supervisory categories 1 to 3 must have their own compliance function; they may outsource operational compliance tasks but not overall direction or strategic decisions (FINMA Circular 2018/3 "Outsourcing", section IV.A; for banks also FINMA Circular 2017/1 "Corporate governance – banks").

Sectors with their own supervisory law, such as banks, insurers or financial service providers, face additional requirements. These need to be clarified case by case with the legal department or external advisers.

Standards: IDW PS 980 and ISO 37301

IDW PS 980 and ISO 37301 describe how a CMS can be built and assessed; neither replaces statutory duties. The two standards serve different purposes.

The 2021 revision of IDW PS 980 dropped the former engagement type of a design audit (Konzeptionsprüfung). In 2021, ISO 37301 replaced the withdrawn guideline ISO 19600. A standard is a reference point, not an end in itself: choose it according to whether you need an audit, a certification or simply a sound structure.

Resource plan: who builds the CMS?

Building a CMS requires capacity beyond the head of compliance for the risk assessment, policies and training. The plan below is an example for a mid-sized company without an existing CMS; all workload and duration figures are assumptions.

Alpinum Solutions provides compliance and legal professionals for such projects through staff leasing or freelancing, part-time or full-time, as an individual or a team. Professionals can also take on formal roles such as compliance officer where Swiss or German requirements allow it. Under staff leasing, the company gives the professional instructions; under freelancing, the professional works independently within the agreed mandate.

Limits and risks

• Responsibility for the CMS stays with the board. External professionals help build it but do not decide on risk appetite, sanctions or resources.
• A CMS on paper offers no protection. What counts is that controls are actually performed and deficiencies remedied.
• An IDW PS 980 audit report or ISO certification does not confirm that no breaches occur.
• Alpinum is not a law firm and does not provide legal advice. Individual legal questions are for the legal department or external advisers.

Frequently asked questions about compliance management systems

Is a CMS required by law?

For most companies a CMS is not explicitly required. In Germany, however, organisational and supervisory duties arise from section 130 OWiG and section 91 AktG, among others; in Switzerland from the board's overall supervisory duty under Art. 716a OR. Banks and other supervised institutions also face explicit requirements for a compliance function, in Germany for example under section 25a KWG.

How long does it take to build a CMS?

Duration depends on size, sector, number of countries and the starting point. A company with existing individual policies needs less time than one starting from scratch. Plan baseline, risk assessment, programme and roll-out as separate phases. A CMS is never finished after that; it develops further with every annual risk assessment.

What is the difference between IDW PS 980 and ISO 37301?

IDW PS 980 is a German auditing standard that auditors use to assess a CMS; it structures the CMS into seven basic elements. ISO 37301 is an international management system standard from 2021 that sets requirements for a CMS and can be combined with other ISO standards. Both provide a structure but neither replaces statutory duties.

Who should carry out the compliance risk assessment?

The compliance function owns the method and the result. The content comes from business functions such as sales, procurement, finance and HR through interviews and workshops. An experienced compliance professional, internal or interim, facilitates the exercise and ensures consistent scoring. Management should confirm the result.

Can an interim professional build a CMS?

Yes, provided the mandate, deliverables and handover are clearly agreed and management visibly backs the project. Interim compliance officers often take on the risk assessment, policies and training while the permanent compliance function is being built or filled. Responsibility for the CMS remains with the company.

Next step

Describe your starting point, sector and the result you need. Selected profiles are usually available within 48 hours; the company and Alpinum agree the start date together.

• Interim compliance and compliance management
• Regulatory change management
• Building and testing an internal control system
• Discuss your needs

Last updated: 30 October 2026.