Standards & frameworks
Governance, risk and resilience: standards and frameworks
Governance and risk management standards set how an organisation is directed, manages uncertainty, meets its obligations and keeps operating through disruption. This family joins certifiable systems such as ISO 22301, ISO 37001, ISO 37301 and ISO 28000 with guidance such as ISO 31000 and the COSO frameworks.
About this family
What do governance and risk management standards cover, and how do they fit together?
This family covers the way an organisation is directed and controlled: how its governing body sets direction, how risk is weighed in decisions, how obligations and integrity are managed, and how operations survive disruption. ISO 31000 is the common thread. It is guidance, not requirements, and it supplies the risk method the certifiable standards build on. Four of those standards lead to certification: ISO 22301 for business continuity, ISO 37001 for anti-bribery, ISO 37301 for compliance and ISO 28000 for security, including across the supply chain. Around them sits guidance with no certificate of its own: ISO 37000 on the governing body’s role, ISO 37002 on whistleblowing, ISO 37008 on internal investigations, ISO 22316 on organisational resilience, ISO 22320 on incident management, and ISO 22313, ISO/TS 22317 and ISO/TS 22318 on applying ISO 22301, the business impact analysis and supply chain continuity. The COSO frameworks for enterprise risk management and internal control are the usual reference for internal audit and for SOX readiness, while the FCPA and the UK Bribery Act are laws that reach well beyond their home countries. Requests come from boards and audit committees, regulators, lenders, public buyers in tenders, and clients who depend on a provider staying up and staying clean.
Sterling builds one governance and risk architecture rather than a stack of separate policies: one obligations register, one risk method based on ISO 31000, and one speak-up channel and investigation process that serve both anti-bribery and compliance. The certifiable systems are then added on that base, so ISO 37001 sits inside an ISO 37301 compliance system as the deeper treatment of one risk, and ISO 22301 draws on the same risk assessment for its business impact analysis. You choose the support level: Design™, where Sterling develops the system and your team implements it under our expert advice and supervision, or Drive™, where Sterling designs and builds it under your approval, fully managed. Either way, Effivity is included at no additional cost to hold the registers, risk assessments, exercises, cases and actions, with internal auditor training for your audit team, as applicable to your standard. Sterling does not certify; for the certifiable standards an accredited certification body audits and decides.
Standards in this family
23 standards, frameworks and schemes in this family
Management system standards, guidance, control frameworks and anti-bribery law, the most requested first.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
- ISO 31000ISO 31000 risk management consulting: a risk framework and process that fit how your organisation decides. ISO 31000 is guidance and is not certifiable.
- ISO 37001ISO 37001 certification consulting: proportionate anti-bribery controls to prevent, detect and respond, built with your teams and ready for an accredited audit.
- ISO 37301ISO 37301 certification consulting: one compliance management system for your obligations and commitments, with evidence ready for an accredited audit.
- ISO 28000ISO 28000 certification consulting: security risks assessed and treated from suppliers to customers, with plans and controls ready for an accredited audit.
- ISO 37002ISO 37002 whistleblowing management and requirements: the 2021 guidance, its four-step case process, why there is no certificate and how Sterling builds it.
- COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
- COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
- ISO 22316ISO 22316 implementation for organisational resilience: gap analysis against the principles and attributes, board evaluation, Effivity. Guidance, no certificate
- ISO 22313 / 22317 / 22318ISO 22313 and ISO 22317 / 22318 guidance explained: applying ISO 22301, business impact analysis and supplier continuity. Not certifiable; how Sterling helps.
- ISO 31010IEC 31010 implementation explained: the 2019 edition, how to select and apply risk assessment techniques, why no certificate exists, and how Sterling helps.
- ISO 37000ISO 37000 governance guidance and requirements explained: the 11 principles for boards, no certificate, and how Sterling helps you apply it and prove alignment.
- ISO 37008ISO/TS 37008 implementation and requirements: guidance for fair, confidential internal investigations, built with your team. Not certifiable. All-inclusive proposal.
- ISO 37003ISO 37003 implementation and requirements: build a fraud control system that prevents, detects and responds to fraud, with Effivity and training included.
- ISO 22320ISO 22320 implementation for incident management: gap analysis against the 2018 guidelines, response structure, exercises and Effivity. Guidance, no certificate
- ISO 30414ISO 30414 compliance and requirements: Sterling helps you define metrics, fix people data and publish a credible ISO 30414:2025 human capital report.
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- ISO 37500ISO 37500 outsourcing governance, assessed against the 2014 guidance: life cycle, joint governance, risk and value. No certificate exists; we help you prove it.
- ISO 30301ISO 30301 certification and requirements explained: build a management system for records, prepare for the audit and choose a credible certification body.
- SOX / ICFR readinessSOX compliance and requirements: section 302 certifications, 404 management assessment, auditor attestation under AS 2201, ICFR readiness and timeline.
- FCPA / UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
- ISO/IEC 27031ISO 27031 implementation explained: the 2025 guidance on ICT readiness for business continuity, its structure, and how it supports ISO 22301 and ISO/IEC 27001.
- ISO 18788ISO 18788 certification support for private security companies: SOMS implementation, legal and human rights controls, training and audit readiness.
Each card leads to the page for that entry. Some entries also appear in a second family: ISO 28000 under Supply chain, logistics & customs, COSO Internal Control and SOX / ICFR readiness under Financial services, payments & AML, and ISO 18788 under Services, education & public sector.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions buyers ask about governance and risk management standards
Which standard to start with, how two combine and who checks the result.
Which governance or risk standard should we start with?
Start with the one your stakeholders will ask you to prove. If clients or regulators want evidence that you can keep operating through disruption, that is ISO 22301; if tenders, lenders or public buyers ask about bribery, ISO 37001; if you carry many regulatory and contractual obligations, ISO 37301. Where no certificate is asked for, ISO 31000 gives the risk method each of them later builds on, and the COSO frameworks are the usual reference where internal audit or financial reporting controls are the concern.
Can ISO 37001, ISO 37301 and ISO 22301 be combined in one system?
Yes. All three follow the harmonised structure of ISO management system standards, so one integrated system can share the policy framework, risk assessment, document control, internal audit and management review. ISO 37001 fits inside an ISO 37301 compliance system as the deeper treatment of bribery risk, with one speak-up channel and one investigation process. A certification body can audit them together when each standard is within its accredited scope; confirm the audit plan and the accreditation with the body itself.
Who checks, and what do you receive at the end?
It depends on the route. ISO 22301, ISO 37001, ISO 37301 and ISO 28000 lead to certification: an accredited certification body audits in two stages, then at yearly surveillance, and decides. ISO 31000, ISO 37000, ISO 37002, ISO 37008, ISO 22316, ISO 22320 and the business continuity guidance carry no accredited certificate; your internal audit or an independent reviewer evaluates how you apply them, and the same is true of the COSO frameworks. SOX applies to public companies reporting to the US Securities and Exchange Commission: management assesses internal control over financial reporting and, where required, the external auditor reports on it. The FCPA and the UK Bribery Act are laws; no certificate proves compliance, though a documented, working anti-bribery programme is what an enforcement authority will examine.
Talk to a consultant
Talk to us about governance, risk and resilience
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice