ISO 26000 · Guidance on social responsibility
ISO 26000 implementation consulting for social responsibility that shows in your decisions, not only in your report.
Use ISO 26000:2010 to decide what social responsibility means for your organisation, act on it and describe it accurately to customers, investors and rating platforms. Sterling's expert and experienced consultants map your impacts and stakeholders with your leadership, set priorities across the seven core subjects, build them into operations and the supply chain, and stay with you through the first report, in 60+ countries. ISO 26000 gives guidance, not requirements, and ISO states that it is not for certification: no ISO 26000 certificate exists, and an offer of one is a reason to walk away. We ensure our clients put the standard in place successfully.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced social responsibility and ESG consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling works with you to put the framework in place; there is no certificate to issue
8,100+ client engagements in 60+ countries.
ISO 26000 client experience
What it is
What is ISO 26000 and what is it used for?
ISO 26000 is the international standard that gives guidance on social responsibility: an organisation's responsibility for the impacts of its decisions and activities on society and the environment, through transparent and ethical behaviour that contributes to sustainable development, takes account of stakeholders' expectations, respects the law and international norms of behaviour, and is integrated throughout the organisation. It states seven principles, groups the issues to consider into seven core subjects and explains how to build responsible behaviour into everyday decisions. ISO's stated aim is to help organisations contribute to sustainable development and go beyond legal compliance, which it treats as a fundamental duty.
Two things set it apart from the management system standards most organisations know. It contains no requirements and cannot be certified, as ISO states on the standard's own page. And it was negotiated among stakeholder groups: experts from more than 90 countries and 40 international or regional organisations, from industry, government, labour, consumer groups and NGOs, spent five years reaching consensus. That is why it serves as common ground: EcoVadis describes its rating methodology as aligned with ISO 26000, GRI and ISO have published guidance on using their documents together, and ISO reported in 2017 that 80 countries had adopted it nationally. The practical test: could you show a neighbour of your site what you changed because of it?
Current edition. ISO 26000:2010, published in November 2010, is the first and only edition. ISO most recently reviewed and confirmed it on 19 March 2025, so it remains current, and iso.org lists no revision under way. IWA 26:2017, an ISO workshop agreement on using ISO 26000 in management systems, was withdrawn in 2023. Being guidance, a future edition would change the advice you follow, not the status of anything you hold. ISO 26000 explained: principles, core subjects and integration
Who it is for
Who should use ISO 26000?
ISO 26000 is written for all types of organisation, whatever their activity, size or location. Nobody is obliged to adopt it and nobody can certify you against it, so the reason to use it is what it does for your decisions and for the questions stakeholders already ask. Organisations come to Sterling for ISO 26000 from four starting points:
- Customers and rating platforms want evidence, not intentions. Supplier codes, sustainability questionnaires and EcoVadis assessments ask for policies, actions and results on labour, human rights, ethics, the environment and procurement. ISO 26000 gives the answers one structure, so every questionnaire draws on the same evidence.
- A report is coming and nobody has decided what matters. A GRI report, an ESRS statement or a customer's request for value-chain data needs a view of your impacts and stakeholders first; ISO 26000's two fundamental practices provide it.
- Your social responsibility is a collection of projects. Donations, a safety programme, a supplier code and an HR policy each have an owner, and none adds up to a strategy the board can explain. The seven core subjects show what is covered, what is missing and where effort is misplaced.
- Leadership wants a recognised basis for its commitments. Investors, lenders, employees and public buyers ask what your commitments rest on. An internationally negotiated standard, applied with evidence and described as ISO recommends, survives scrutiny.
The intended benefit is responsible behaviour that stakeholders can see and you can evidence; it depends on leadership acting on its priorities, not on adopting a document.
Business benefits
How ISO 26000 builds trust with the people your business depends on
ISO's own introduction to the standard notes that performance on social responsibility can influence competitive advantage, reputation, the ability to attract and retain workers and customers, employee morale and productivity, the view of investors, and relationships with stakeholders. We build the programme around the relationships that matter most to you.
- Stronger answers to customers and ratingsPolicies, actions and results organised by core subject, so questionnaires are answered from evidence, not rewritten each time.
- A reputation that rests on what you doCommitments matched by actions and data, in wording that claims neither more nor less than you achieved.
- People who choose to stayFair employment, safe work, social dialogue and training treated as management priorities, which shows in retention and productivity.
- Confidence for investors and lendersA recognised structure for environmental, social and governance performance, owned at the top, with records that stand up to due diligence.
- Better relationships beyond the gateCommunities, suppliers and regulators engaged before your decisions affect them, so disputes are prevented rather than managed.
- One programme behind reporting and certificationEvidence from ISO 14001, ISO 45001, ISO 37001 or SA8000 reused for GRI, ESRS and EcoVadis, instead of separate projects answering one question.
Choose a few measures, such as the share of spend with suppliers who accept your code, grievances resolved, employee turnover or rating scores over time, and review whether they move. A longer sustainability report is not a business result.
Principles, core subjects and integration
What does ISO 26000 cover?
ISO 26000 recommends; it does not require. Clause 3 explains social responsibility, clause 4 its seven principles, clause 5 the two fundamental practices, clause 6 the seven core subjects and their issues, and clause 7 how to put them into practice. This table maps the 2010 edition in plain language; your programme is designed against it clause by clause, and your leadership decides which issues are relevant and significant.
| Clause | What it gives guidance on | What it looks like in practice |
|---|---|---|
| 3 Understanding social responsibility | The background, recent trends and characteristics of social responsibility, and the role of the state | A leadership briefing on what social responsibility means in your sector and countries |
| 4 Principles of social responsibility | Seven principles: accountability, transparency, ethical behaviour, and respect for stakeholder interests, for the rule of law, for international norms of behaviour and for human rights | A policy commitment and code of conduct built on the principles, used to explain decisions |
| 5 Recognising social responsibility and engaging stakeholders | Two fundamental practices: recognising your social responsibility within your sphere of influence, and identifying and engaging your stakeholders | An impact map across operations and the value chain, a stakeholder register, and engagement records showing what changed |
| 6.2 Organisational governance | How the organisation makes and implements decisions, so that it acts on its impacts and on the other core subjects | Leadership oversight of social responsibility, clear accountabilities, and the principles built into approval processes |
| 6.3 Human rights | Eight issues: due diligence; human rights risk situations; avoidance of complicity; resolving grievances; discrimination and vulnerable groups; civil and political rights; economic, social and cultural rights; fundamental principles and rights at work | A human rights policy, due diligence on operations and suppliers, a grievance channel people use, and remediation records |
| 6.4 Labour practices | Five issues: employment and employment relationships; conditions of work and social protection; social dialogue; health and safety at work; human development and training in the workplace | Contracts and working-time records, dialogue with worker representatives, a safety system and training plans |
| 6.5 The environment | Four issues: prevention of pollution; sustainable resource use; climate change mitigation and adaptation; protection of the environment, biodiversity and restoration of natural habitats | An aspects register, energy, water, waste and emissions data, a greenhouse gas inventory and targets |
| 6.6 Fair operating practices | Five issues: anti-corruption; responsible political involvement; fair competition; promoting social responsibility in the value chain; respect for property rights | Anti-bribery controls, rules on political contributions and lobbying, competition-law training, a supplier code with due diligence |
| 6.7 Consumer issues | Seven issues: fair marketing, factual and unbiased information and fair contractual practices; protecting consumers' health and safety; sustainable consumption; consumer service, support, and complaint and dispute resolution; consumer data protection and privacy; access to essential services; education and awareness | Marketing claims checked, product safety controls, complaints resolved on time and personal data protected |
| 6.8 Community involvement and development | Seven issues: community involvement; education and culture; employment creation and skills development; technology development and access; wealth and income creation; health; social investment | Engagement with the communities near your sites, local hiring and sourcing data, and social investment chosen with the community |
| 7.3–7.4 Understanding and integrating social responsibility | Determine which core subjects and issues are relevant and significant, how far your sphere of influence reaches and what comes first; then build social responsibility into direction, governance, systems and procedures | A relevance and significance assessment with reasons recorded, priorities leadership has approved, and social criteria in procurement, product and investment decisions |
| 7.5–7.8 Communication, credibility, review and voluntary initiatives | Communicate in forms that suit each audience, strengthen the credibility of reports and claims, review progress and improve performance, and evaluate voluntary initiatives before joining them | A report worded as ISO recommends, figures that trace to source, an annual leadership review with decisions recorded, and a register of initiatives joined |
What does useful ISO 26000 evidence look like?
A stakeholder register with engagement records, the relevance and significance assessment with the reasons behind each decision, a policy leadership has signed, priorities with objectives and owners, supplier and human rights due diligence, a grievance log, the data your priorities call for, the last leadership review and the report that went out. Much of it already exists; we connect it instead of producing paperwork, and it sits in Effivity from the first workshop.
The seven core subjects and their issues, one by oneImplementation route
How do you implement ISO 26000?
There is no audit at the end of this route and no body that decides whether you pass. Leadership sets priorities after hearing from stakeholders, the business acts on them, and credibility comes from the evidence and, where you choose it, independent assurance of what you report. Sterling works through each stage with you; the priorities and commitments are yours.
- 01Define the scope and who you answer to.Confirm the entities, sites and value-chain relationships to cover, who is asking questions, and what leadership wants the programme to achieve.
- 02Gap analysis: compare what you do today with the guidance.The gap analysis tests policies, practices and data against the seven principles and each core subject's issues, keeps what works and sets actions with owners, dates and resources.
- 03Map impacts, engage stakeholders and set priorities.Identify the impacts of your decisions and activities and the stakeholders they affect, engage them, judge which issues are relevant and significant, and have leadership approve the priorities.
- 04Integrate into governance, operations and the value chain.Policy commitment, accountabilities, objectives, procedures and supplier expectations built into the processes that run the business, with training for the people who apply them.
- 05Monitor, review internally and close the gaps.Indicators for each priority, an internal review of the programme against its commitments, and gaps closed with evidence before anything is published.
- 06Review and report.Leadership reviews progress and sets the next priorities; results go out as a report, a GRI or ESRS disclosure, a rating submission or a self-declaration, worded to present ISO 26000 as guidance, with Sustain™ supporting every cycle.
Look past the price to what is actually on offer. ISO states that any offer to certify, or claim to be certified, to ISO 26000 misrepresents and misuses the standard, and that, as it contains no requirements, such a certificate would not demonstrate conformity with it. Ask instead how your priorities will be set, which stakeholders will be heard and what will still be running a year later. How to choose a credible ISO 26000 provider · The certification buyer's checklist
Cost
How much does ISO 26000 implementation cost?
No single price fits every ISO 26000 programme. A service company with a supplier code needs a different scope from a manufacturing group with sites beside communities, a global supply chain and an ESRS statement to prepare. What we offer is one all-inclusive proposal, each component itemised, and no certification fee, since ISO 26000 has no certificate.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Current maturity, the entities, sites and value chain in scope, the stakeholder groups to engage, the core subjects that prove significant, and how much of the work your team takes on (Design™ or Drive™) |
| Report assurance, only if you want it | There is no certificate. If you want a report assured, or a customer wants an independent opinion, the provider you appoint prices it separately |
| Internal resources | Leadership time for priorities, the owners of HR, HSE, procurement and community programmes, data collection, and any operational changes the priorities call for |
| Software and learning | Included in a Sterling engagement: Effivity for registers, due diligence, indicators and reviews, and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Engagement rounds, the annual review, the next report or rating, and refresher courses, all under Sustain™ |
What moves the price
- How many entities, sites and countries, and how far into the value chain
- The stakeholder groups to engage, and the methods each needs
- Which core subjects prove significant, and what exists for each
- Reporting or rating deadlines, and your team's capacity
- Languages, sector expectations and certificates you already hold
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- No certificate to pay for; report assurance, if you commission it, listed separately
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does ISO 26000 implementation take?
How long it takes depends on your starting point, how many stakeholder groups need to be heard, how quickly leadership agrees priorities and your reporting or rating calendar. Expect months, not days, typically four to eight: stakeholders are engaged before priorities are set, and actions must run long enough to produce the data a report or rating will ask for. We plan around the first full cycle, with milestones tracked in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to leadership, policies, HR, HSE and procurement records, reports and customer questionnaires |
| Impacts, stakeholders and priorities | The number and reach of stakeholder groups, the engagement methods, and the time leadership needs to decide |
| Integration and action | The extent of change in governance, procurement and operations, approvals, training and supplier communication |
| Review and first report | Enough months of data, the internal and leadership reviews, and the reporting or rating deadline |
If a report, a rating renewal or a customer sets the date, share it on day one; we will show what can be ready and which decisions come first. A programme promised in a fortnight, before anyone has spoken to your stakeholders, is marketing, not a plan.
Challenges
Common ISO 26000 implementation challenges
Five problems stop most ISO 26000 programmes. Each has a practical answer.
Seven core subjects look like seven projects.
They are not meant to be. ISO 26000 has you identify the issues that are relevant and significant for you and act on those. We assess every issue once, record why it matters or not, and concentrate effort where your real impacts are.
Stakeholder engagement turns into a survey nobody reads.
Engagement is useful when it reaches the people your decisions affect and changes something. We choose a method for each group, from worker committees to community meetings and supplier briefings, and record what was raised and what leadership did.
Social responsibility sits beside the business, not inside it.
A sustainability team running projects the business does not own will not last. We build the commitments into governance, budgets, procurement criteria, product decisions and job responsibilities, while Design™ or Drive™ carries the work load.
Every report, rating and questionnaire asks the question differently.
GRI, the ESRS, EcoVadis and customer questionnaires overlap heavily but word things their own way. We organise your evidence once, by core subject, in one Effivity workspace and map it to each framework, so a new questionnaire is a mapping exercise, not a new project.
Someone sold you an ISO 26000 certificate.
ISO says such a certificate misuses the standard and does not demonstrate conformity with it. We review what the provider delivered, keep what is genuinely useful, take the claim off your website, proposals and reports, and rebuild the programme so your communications use the wording ISO recommends.
Your engagement
What your ISO 26000 engagement includes
The engagement is scoped to leave a programme that runs and a leadership team that can explain it. Many providers sell a policy template or a report and leave the rest to you; Sterling takes you through all of it, one team and one fee, start to finish.
Scope, gap analysis and implementation plan
Entities, sites, value chain and deadlines agreed, with responsibilities and decision owners set before the first workshop.
Impact mapping and stakeholder engagement
Stakeholders engaged in ways that suit each group, every issue assessed for relevance and significance, and priorities put to leadership for decision.
Effivity ISO & GRC software
Your stakeholder register, priorities, due diligence, indicators and reviews run in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for the people who will review the programme, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Policy, commitments and integration
The policy, code of conduct, supplier expectations and procedures, on Sterling's own template sets, built into your governance and processes with the people who run them.
Internal review and first report
An internal review, the leadership review and the first report or public statement, worded to present ISO 26000 as guidance, with gaps closed before publication.
ISO 26000 is guidance without requirements: nothing in this engagement is, or leads to, an ISO 26000 certificate.
How we deliver
How Sterling supports your ISO 26000 implementation
ISO 26000 engagements follow Sterling OS™, our delivery operating system: five phases, each ending in agreed deliverables, a decision owner and evidence. Pick the support level your capacity allows; the approach, the tools and who answers for results stay fixed.
- 01Design™Guided implementation: your own leads do the work, using Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants take on the agreed mapping, engagement, documentation and reporting; decisions stay with you.
- 03Sustain™After the first cycle: engagement rounds, internal and leadership reviews, the next report or rating, and refresher and new-joiner training each year.
- 04Automate™Effivity holds the programme: stakeholders, priorities, due diligence, indicators, actions and reviews, together.
- 05Revise™Changes in your sites, supply chain, regulation or reporting obligations, and any future edition of ISO 26000.
At kick-off we agree who leads, when the weekly session sits, what is delivered and who decides, then track delivery against it, so a slipping priority shows months before the report is due.
How Sterling OS™ worksOften combined with
Standards organisations pair with ISO 26000
- AA1000AA1000 implementation and requirements: apply the AccountAbility Principles and SES, then prepare for AA1000AS v3 assurance by a licensed provider.
- amfori BSCIamfori BSCI audit preparation for producers: gap assessment across the 13 performance areas, remediation, worker-facing evidence and support from Sterling.
- B Corp CertificationB Corp certification made clear: the new B Lab Standards, Foundation Requirements, seven Impact Topics, the audit route and how Sterling prepares you.
- CBAMCBAM compliance and requirements explained: authorised declarant status, the 50-tonne threshold, verified embedded emissions and how Sterling helps you prepare.
- CDPCDP disclosure consulting: a complete, evidenced response on climate, forests and water, prepared with your team.
- CSDDDCSDDD compliance and requirements after Omnibus I: scoping, risk-based due diligence, complaints, monitoring and the 2029 start, delivered in one all-inclusive proposal.
Effivity · ISO 26000 social responsibility software, included in every engagement
How Effivity helps you fulfil, automate and simplify the core subjects and practices of ISO 26000:2010.
Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries, comes with every Sterling ISO 26000 engagement. Within the agreed scope, your consultant sets it up so the stakeholder register, policies, supplier due diligence, grievances, indicators, actions and reviews sit together and are used daily; anyone asking for evidence then sees dated, owned records, not a slide deck. The subscription is included with the Sterling engagement, at no additional cost.
Stakeholder register and engagement log
Stakeholders and interested parties with their needs and expectations, each engagement recorded with what was raised and what changed, and issues reviewed on a schedule.
Policy, commitments and accountabilities
The policy and code of conduct with approvals and distribution, an owner for each priority, and objectives with measures and dates tracked in the system rather than in spreadsheets.
Due diligence and grievances
Human rights risks assessed across operations and suppliers, actions tracked to closure, and each grievance logged with its outcome and resolution time.
Workforce, safety and training
Employment, working-time and training records, incidents and hazard assessments, and indicators such as turnover and training hours by site.
Aspects, resources and emissions
Environmental aspects and impacts, energy, water and waste data, emission sources and targets, and legal obligations tracked to the processes they affect.
Anti-corruption and the value chain
Anti-bribery controls, gifts and conflict-of-interest registers, supplier evaluations against your code, and corrective actions agreed with suppliers.
Complaints, product safety and personal data
Complaints handled with root cause and resolution time, product safety checks and marketing claims reviewed before release, and privacy incidents closed.
Community engagement and social investment
Community meetings, concerns and commitments, local hiring and sourcing figures, and social investment tracked against objectives agreed with the community.
What this means when the questionnaire arrives
A customer's questionnaire, a rating analyst, an assurance provider or your board will ask for the policy, the stakeholder engagement, the due diligence, the grievance log, the indicators and the last leadership review. In Effivity every one of those is already on screen, dated, owned and evidenced, rather than a folder built in the week of the deadline. Sustain™ then continues in the same workspace, so the next report begins from a programme that never stopped.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your registers, policies and indicator data migrated, not retyped
- Admin and user training for the teams who own priorities
- EMS, OHSMS, QMS and ISMS modules for the systems you hold
ISO 26000 client experience
Client letters on file, available on request.
Signed client letters for ISO 26000 are available on request. The client feedback wall lists every letter by standard.
Programmes with ISO 26000 in scope
How an ISO 26000 programme runs.
- 01How integrated ESG programmes run
Social responsibility as the frame over certified systems and ESG reporting
ISO 26000 is commonly used as the organising frame for a programme that already holds certified systems, such as ISO 14001, ISO 45001 and ISO 37001, and must also feed a sustainability report or a supplier rating. In such a programme stakeholder engagement and the relevance assessment are done once, each core subject points to the system or policy that manages it, issues no certified system covers, such as human rights due diligence or community involvement, get owners of their own, and one evidence base serves the audits, the GRI or ESRS disclosures and the EcoVadis questionnaire.
Sterling Academy · ISO 26000 e-learning
Train every employee on ISO 26000, not only the ESG team.
Sterling Academy builds each course from video lessons, practice checkpoints and a final exam, for everyone from new starters to the programme's owners, and each learner earns a numbered Certificate of Completion, verifiable online. Social responsibility works when people see the issues in their own jobs, from procurement to scheduling overtime. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- ISO 26000 awareness for every employee, so the principles show up in everyday decisions
- Practitioner courses for the leads and managers who own priorities
- Internal auditor training for the people who will review the programme, as applicable to your standard, as part of the engagement
- Department-level progress, plus a training status report for leaders and rating questionnaires
- New hires trained as they arrive, so records stay current for every report and rating cycle
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about ISO 26000
Watch a video on how to implement ISO 26000 here.
Watch a video on ISO 26000 guidance here.
Why Sterling
Want ISO 26000 implementation your stakeholders will believe? Come to Sterling.
Whether you are shaping one company's first social responsibility programme or aligning subsidiaries across countries, Sterling helps you set group priorities that local teams own, working through differences in law, labour markets, supply chains and community expectations, so the programme is consistent where it should be and local where it must be.
Implementation experience in 60+ countries since 2003
Management systems delivered for manufacturers, contractors, food businesses, BPOs and service firms, from offices in 21 countries, with a single engagement team answerable for every location.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal; no certification fee, because no certificate exists, and any report assurance listed separately. No surprises, ever.
A programme that lives in daily work
Less documentation and more effect: priorities in plain language, evidence gathered in the processes people already use, and reports built from records.
Expert and experienced consultants
Consultants who have advised on management systems across sectors and countries since 2003, know the labour, environmental and anti-corruption expectations of your markets, and set up your programme properly the first time, so your first report is one you can stand behind.
The Sterling Promise
What our ISO 26000 implementation success guarantee means
We stay with you until your agreed ISO 26000 implementation outcome is achieved: stakeholders engaged, priorities approved, the policy in force, priority actions running and the first review and report delivered. Clear explanations, practical delivery, included software and employee learning turn the fee into a programme your organisation keeps.
The engagement identifies the guidance, scope, outcome and responsibilities. Your organisation supplies accurate information, listens to its stakeholders, decides its priorities and puts the agreed actions into use. With no requirements to certify against, the outcome is a working programme, not a certificate; where you commission assurance or submit to a rating, the conclusions belong to the assurance provider or the platform. What we commit to is the agreed consulting support, not a rating score, a tender award or any stakeholder's approval.
After implementation
What happens after ISO 26000 implementation?
The programme should keep working as your business, supply chain and stakeholders change. Indicators are collected, grievances answered, suppliers reviewed, and new sites, products and markets tested against the principles before decisions are final. Once a year leadership reviews performance, revisits the priorities with fresh stakeholder input and decides what to communicate.
Under Sterling OS™ Sustain™ we run the engagement rounds and the internal review with you, prepare the leadership review and the next report or rating submission, and train new joiners, keeping the programme alive between reporting cycles rather than rebuilding it for each.
FAQs
Frequently asked questions about ISO 26000
Can an organisation be certified to ISO 26000?
No. ISO states that ISO 26000 is not a management system standard, is not intended or appropriate for certification, and that any offer to certify, or claim to be certified, to it would misrepresent and misuse it; with no requirements, such a certificate would not demonstrate conformity. What you can show is evidence that you use the guidance.
What can we say publicly about our use of ISO 26000?
ISO's communication protocol for ISO 26000 suggests wordings such as "based on ISO 26000", "inspired by ISO 26000" and "follow the guidance provided by ISO 26000", and lists wordings to avoid, including "certified according to", "in accordance with", "compliance with", "assessed against" and "meets the requirements of" ISO 26000. Sterling drafts your public language to that protocol.
What is an ISO 26000 self-declaration?
Your own public statement, backed by evidence, of how you apply ISO 26000; not a third-party certificate. In the Netherlands, for example, the standards body NEN publishes the guideline NPR 9026 (now NPR 9026+C1:2012) and a platform for self-declarations; NEN checks that a declaration and its evidence are complete, not whether the answers are right, and states that it does not certify. Elsewhere it is simply your statement, in the wording ISO recommends.
How does ISO 26000 relate to GRI and ESRS reporting?
ISO 26000 guides what to do; GRI and the ESRS set out what to disclose. A joint GRI and ISO guide from 2014 presents ISO 26000 as the structure for organising activities that are then reported with GRI, and notes that applying GRI in full does not equal applying ISO 26000. For companies in the CSRD's scope, narrowed in 2026 to more than 1,000 employees and over EUR 450 million net turnover, ESRS S1 to S4 (own workforce, workers in the value chain, affected communities, consumers and end-users) and G1 (business conduct) parallel ISO 26000's labour, human rights, community, consumer and fair operating practices subjects.
How does ISO 26000 relate to SA8000, ISO 45001, ISO 14001 and ISO 37001?
They are certifiable standards for issues ISO 26000 covers: SA8000:2026 for decent work, through SAAS-accredited bodies; ISO 45001 for health and safety at work, under labour practices; ISO 14001 for the environment; and ISO 37001 for anti-bribery, under fair operating practices. Each certificate is legitimate evidence for part of your programme; none is, or implies, an ISO 26000 certificate.
How does ISO 26000 relate to the UN Guiding Principles on Business and Human Rights?
ISO 26000 was published in 2010; the UN Human Rights Council endorsed the Guiding Principles on 16 June 2011. ISO's 2017 linkage document on ISO 26000 and the OECD Guidelines for Multinational Enterprises says both use the Guiding Principles, and both ask organisations to respect human rights, exercise due diligence, apply a human rights policy, provide grievance mechanisms and prevent and mitigate adverse impacts. Legal due diligence duties still need checking against their own text.
Will ISO 26000 improve our EcoVadis rating?
It can help, but nobody can reliably promise a score. EcoVadis states that its methodology is aligned to the UN Global Compact, GRI and ISO 26000, and it rates policies, actions and results, with evidence, across environment, labour and human rights, ethics and sustainable procurement: the evidence an ISO 26000-based programme produces. There is no ISO 26000 certificate to upload.
Is ISO 26000 still current, and is a new edition coming?
Yes. The 2010 edition is the only one; ISO confirmed it in March 2025 and iso.org shows no revision in development. A future edition would bring new guidance to consider under Revise™, not a certificate transition.
What do you need to prepare an ISO 26000 proposal?
The entities, sites and value-chain relationships to cover, approximate headcount, the certificates you hold, any report, rating or questionnaire you must answer and its deadline, and who is asking. With that, we can scope the work and fix the fee.
Before the first call
Prepare a useful ISO 26000 readiness brief
Nothing needs writing before we talk; an accurate outline of what you do, whom it affects and who is asking will do. Seven questions are enough:
- Which customer, rating platform, investor, regulator or leader is asking? Or, if nobody has asked, what should your social responsibility achieve?
- Which entities, sites and parts of the value chain should the programme cover?
- Which groups are most affected by what you do, and how do you hear from them today?
- What policies, codes, certificates and reports already exist, and who owns them?
- What do questionnaires, rating scorecards, grievances or incidents say about the starting point?
- Who in leadership decides priorities, and who runs HR, HSE, procurement and community programmes?
- Is there a report, a rating renewal, a tender or a board date to plan around?
From your answers we scope the work and set a realistic price. Nothing is scored, and nothing you share is taken as a verdict on your programme.
Don’t be fooled by certification scams
If it is called ISO 26000 certification, it is not ISO 26000.
ISO is unusually direct: ISO 26000 is not intended or appropriate for certification, and any offer to certify or claim to be certified to it would misrepresent and misuse it. The market sells certificates anyway, with "ISO 26000 certified" seals, one-week CSR audits and policies copied from another company's report, until a customer's sustainability team, a rating analyst or an assurance provider reads what ISO actually says.
How to choose a credible ISO 26000 provider
- Refuse any "ISO 26000 certificate" for your organisation. ISO states that such certification would not demonstrate conformity with ISO 26000; displaying one invites the question of what it was assessed against.
- Ask how the provider will word your public claims. ISO's communication protocol recommends "based on ISO 26000" and lists "certified according to" and "in accordance with" ISO 26000 among wordings to avoid.
- Ask which stakeholders will be heard, and how. Priorities chosen without talking to workers, communities, customers or suppliers reflect the consultant's assumptions, not your impacts.
- Check any certificate said to be "based on" ISO 26000. ISO 26000 leaves room for more demanding national standards; a certificate to one of those certifies that standard, so ask which one, who accredits the issuer and whether your customer recognises it.
- Ask what will still be running a year after the consultant leaves. Trained people, owned priorities and records in a system survive; a report written for you does not.
- Walk away from "ISO 26000 compliant in two weeks" and one invoice for a policy pack and certificate. Stakeholders must be engaged and actions must run before there is anything true to report.
Keep exploring
More on ISO 26000 and related standards
More in ESG & sustainability reporting
Talk to a consultant
Plan your ISO 26000 implementation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice