ISO 37000 governance guidance and requirements, made workable for your board.

What it is

What is ISO 37000 and what is it used for?

ISO 37000 is the international guidance standard on the governance of organisations, developed by ISO technical committee TC 309. It sets out principles, and the key aspects of practice behind each one, for the governing body or governing group that directs an organisation, oversees its management and is held to account for the results. ISO describes governance as a human-based system through which an organisation is directed, overseen and held accountable for achieving its defined purpose in an ethical and responsible manner.

In practice, boards use it as a common reference point. It helps a chair test whether the board spends its time on purpose and strategy, and gives directors, lenders and parent companies a shared benchmark. It does not replace company law, listing rules or a national governance code; it sits alongside them and applies to public, private and not-for-profit bodies alike.

Current edition. ISO 37000:2021, the first edition, was published in September 2021. ISO completed its systematic review in 2026 and confirmed the standard on 4 August 2026, so it remains current and no replacement is being drafted. No amendment has been issued.

Who it is for

Who needs ISO 37000 governance guidance?

No one is required to adopt ISO 37000, and no one can be certified to it. Organisations still turn to it, usually for one of four reasons:

• A customer or investor asks how you are governed. Due diligence questionnaires probe board oversight and accountability; a review against ISO 37000 gives a structured answer.
• A tender scores governance. Bids that award marks for ethical leadership and oversight reward a claim anchored in an international reference.
• A regulator or code expects stronger boards. Where a sector regulator or a national code sets governance expectations, the principles help the board organise its response and show how it meets the spirit as well as the letter.
• A group needs one approach across subsidiaries. Parent companies with entities in several countries use the standard to give every subsidiary board the same principles, delegations and reporting, while local law still applies.

Requirements

What are the ISO 37000 requirements, and what does it actually recommend?

Strictly, ISO 37000 has no requirements to conform to: ISO's committee states that it provides guidance and adds no further regulation. What it offers is eleven principles, arranged in three tiers, each supported by key aspects of practice. Purpose sits at the top; four foundational principles follow from it; six enabling principles make them work day to day.

• Purpose (primary principle): the governing body defines why the organisation exists and keeps every decision tied to that purpose.
• Value generation: be clear about the value the organisation creates, for whom, and how that value model is sustained.
• Strategy: direct a strategy that serves the purpose and the value model, and revisit it as conditions change.
• Oversight: monitor management and performance closely enough to know whether direction is being followed.
• Accountability: answer for the organisation's decisions and results, and ensure accountability is delegated and traceable.
• Stakeholder engagement: identify the stakeholders who matter and engage them in ways that inform decisions.
• Leadership: set the ethical tone and culture from the governing body downwards.
• Data and decisions: treat data as a strategic resource and base decisions on reliable information.
• Risk governance: decide how much risk the organisation will take in pursuit of its purpose and oversee how it is managed.
• Social responsibility: make decisions that are transparent and consider the organisation's wider impact on society and the environment.
• Viability and performance over time: balance present results with the organisation's ability to keep delivering in the long run.

Putting it into practice

How do you implement ISO 37000 without a certificate?

Because there is nothing to certify, the route is alignment and self-evaluation. The governing body owns the outcome; Sterling provides the method, the challenge and the workload. Organisations that also want independent assurance usually add a certifiable standard such as ISO 37301 or ISO 37001, audited by an accredited certification body.

1. 01
   Agree scope and sponsors.Name the boards, committees and entities in scope, the chair or director who sponsors the work, and the external expectations it has to satisfy.
2. 02
   Gap analysis: compare current practice with the principles.Interviews with directors and executives, a read of charters, papers and minutes, and a gap report ranked by governance risk, with owners and dates agreed.
3. 03
   Design the governance framework.Purpose statement, charters, delegations, risk appetite, stakeholder engagement plan and board reporting, drafted with the people who will use them.
4. 04
   Operate it through a full board cycle.Meetings run on the new papers and calendar, decisions are recorded against the purpose and strategy, and the board sees the effect for itself.
5. 05
   Evaluate, report and improve.A structured board evaluation, which can draw on the ISO 37004 maturity model, followed by a statement of alignment the board can share with stakeholders.

Check what you are being offered before you sign. Any "ISO 37000 certificate" is not an ISO certification, because the standard is guidance and ISO confirms it adds no regulation. If you need an audited certificate, ask which certifiable standard it covers, which certification body issues it and whether that body is accredited for the scope, then verify with the accreditation body directly. The certification buyer's checklist

Cost

How much does ISO 37000 alignment cost?

Cost follows the shape of your governance: one board with a clear mandate needs far less work than a group of boards across jurisdictions. Every proposal shows the components and an all-inclusive proposal.

Timeline

How long does ISO 37000 implementation take?

The pace is set by the board calendar more than by consulting effort. Directors need to be interviewed, drafts approved and at least one meeting cycle run on the new framework before the evaluation means anything. As an estimate, a single board typically needs two to four months; groups with several boards take longer.

If an investor meeting, annual report or regulator visit is driving the work, tell us at the start so the plan fits it.

Your engagement

What your ISO 37000 engagement includes

Engagements follow Sterling OS™. You choose the support level: Design™, where we guide and your company secretary or governance lead does the drafting, or Drive™, where our consultants carry the work and your board decides. The two are alternatives, not stages. Sustain™ keeps the framework current after the review, and Automate™ is Effivity. Sterling does not certify, and ISO 37000 has no certificate; where a certificate for a related standard is wanted, an independent, accredited certification body issues it.

• Scope and governance gap analysis

  Interviews, document review and a ranked gap report against the eleven principles.

• Governance framework

  Purpose statement, charters, delegation of authority, risk appetite and board reporting, written with your directors.

• Effivity ISO & GRC software

  Governance records, risks and actions in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Director and executive briefings, internal auditor training as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Board evaluation

  A structured self-evaluation, facilitated as agreed, with actions tracked to closure.

• Statement of alignment and Sustain™

  A board-owned statement for stakeholders, then annual reviews and updates as the organisation changes.

ISO 37000 is guidance; alignment is the governing body's own statement, not a certification.

Often combined with

Standards organisations pair with ISO 37000

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
• ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
• ISO 22313 · ISO/TS 22317 · ISO/TS 22318ISO 22313 and ISO 22317 / 22318 guidance explained: applying ISO 22301, business impact analysis and supplier continuity.