ISO 37002 whistleblowing management and requirements, so people speak up early and are protected when they do.

What it is

What is ISO 37002 and what is it used for?

ISO 37002 gives guidelines for setting up, running and maintaining a whistleblowing management system: the policy, roles, channels and case process through which an organisation hears about wrongdoing and deals with it. ISO frames the work in four steps, receiving reports, assessing them, addressing them and concluding the case, and rests the whole system on trust, impartiality and protection. It was written by ISO/TC 309, the committee responsible for governance of organisations, and it can run on its own or inside a wider management system.

The practical test for a board is whether bad news reaches it in time. Fraud, safety shortcuts, harassment and bribery are usually known to someone long before an audit or a news story finds them. A speak-up line nobody trusts wastes that early warning and exposes the person who raised it. The guidance helps an organisation make reporting easy, assess each report fairly, protect the whistleblower and the people named, and close cases with decisions that can be explained afterwards.

Current edition. ISO 37002:2021, the first edition, was published in July 2021. ISO completed a systematic review and confirmed it on 30 July 2026, so no revision or transition is under way. Because it is a guideline, it uses recommendations rather than requirements, and no certificate is issued against it. ISO 37002:2021 on iso.org

Who it is for

Who needs ISO 37002?

ISO describes the guidance as applicable to every kind of organisation, public, private or not-for-profit, whatever its size. It is not mandatory in itself; organisations adopt it when they want a speak-up arrangement that holds up under scrutiny. Four situations bring them to Sterling:

• A customer, investor or lender asks how concerns are handled. Supplier codes, due diligence questionnaires and ESG reviews ask for a reporting channel, protection from retaliation and closed cases. ISO 37002 gives the answer a recognised shape.
• A tender or public buyer scores integrity arrangements. Bid teams must describe the policy, who handles reports independently and how the board oversees them, with records behind it.
• Whistleblower protection law applies to you. Where national rules, such as those transposing the EU Directive on the protection of persons who report breaches of Union law, set duties for reporting channels, ISO 37002 helps organise the system that meets them. The legal duties themselves come from the law, and we work alongside your legal advisers on them.
• A group needs one approach across its companies. Subsidiaries often run separate hotlines with no consolidated reporting. The guidance gives one policy and case process, with local handling where local law requires it.

The benefit, earlier and fairer handling of wrongdoing, depends on leaders acting on what the system tells them.

Requirements

What are the main ISO 37002 requirements?

Strictly, ISO 37002 contains recommendations, not requirements, but it is organised on the harmonised structure used by ISO management system standards, clauses 4 to 10, so it sits naturally beside ISO 37001, ISO 37301 or ISO/IEC 27001. The operational clause follows the four steps of a case. The list below is a plain-language map of the areas; the design is tested against the full text of the standard during the programme.

• Clause 4 Context of the organisation: the issues and interested parties that shape your speak-up needs, and the scope of the whistleblowing system.
• Clause 5 Leadership: commitment from the governing body and top management, a whistleblowing policy, a whistleblowing management function and clear delegated decision-making.
• Clause 6 Planning: risks and opportunities for the system, objectives with plans to achieve them, and changes planned deliberately.
• Clause 7 Support: resources, competence, awareness and training for personnel, leaders and specific roles, communication, and documented information handled with data protection and confidentiality in mind.
• Clause 8 Operation: receiving reports of wrongdoing; assessing the report and the risk of detrimental conduct; addressing the wrongdoing while protecting the whistleblower, the subjects of a report and other parties involved; and concluding the case.
• Clause 9 Performance evaluation: indicators, information sources, internal audit and management review.
• Clause 10 Improvement: continual improvement, and nonconformity with corrective action.

Getting started

How do you implement ISO 37002?

There is no certification audit at the end, so the route is implementation, operation and your own assurance that the system works. Sterling designs and builds it with your team; oversight stays with your governing body.

1. 01
   Decide what the system must cover.Agree the entities, countries, reporters in scope (personnel, contractors, suppliers, customers), the types of wrongdoing, and the legal duties your advisers have identified.
2. 02
   Gap analysis: compare current arrangements with the guidance.Review the existing policy, hotline, triage, investigation practice, protection measures and board reporting; keep what works and agree actions, owners and dates.
3. 03
   Design and launch the system.Policy, whistleblowing function, channels, assessment and escalation rules, protection and support measures, investigator guidance, confidentiality and data protection controls, and training for leaders and case handlers.
4. 04
   Run real cases and learn from them.Reports are received, assessed, addressed and concluded under the new process; indicators start flowing to management and the board.
5. 05
   Audit, review and keep it improving.Internal audit and management review test the system, findings are closed with evidence, and where a certificate is needed the system feeds an ISO 37001 or ISO 37301 certification.

Check the route before you sign. ISO 37002 is guidance, so if anyone offers an "ISO 37002 certificate", ask exactly what is being issued, by whom, and whether any accreditation stands behind it, then verify with the accreditation body named. For certifiable standards, accreditation recognition runs through the Global ACI arrangement. How to verify an ISO 37001 or ISO 37301 certificate · The certification buyer's checklist

Cost

How much does ISO 37002 implementation cost?

The effort for a single company with a working hotline is very different from a multinational group building its first common process. There is no certification body fee, because there is no certification. What we can promise is a proposal in which every component is visible and nothing is added later.

Timeline

How long does ISO 37002 implementation take?

Pace depends on how quickly the governing body approves the policy, how many entities and languages are involved and whether a channel already exists. A first working system typically takes two to four months; after that, the system needs a period of real cases before an internal audit can say much about how well it works.

If a customer questionnaire, tender or legal deadline is driving the work, tell us at the start and we will say what is achievable and which decisions need to come early.

Your engagement

What your ISO 37002 engagement includes

The engagement runs on Sterling OS™. You choose the support level: Design™, where we guide and your team builds, or Drive™, where we manage the build with your team; they are alternatives, not stages. Once the system is running, Sustain™ keeps audits, refreshers and reporting on schedule, and Automate™ is Effivity, in use from the first workshop.

• Scope, gap analysis and implementation plan

  Entities, reporters and legal duties agreed, with owners and dates, before design starts.

• Policy, function and case process

  Whistleblowing policy, function charter, triage and escalation rules, protection measures and investigator guidance, built with your people.

• Effivity ISO & GRC software

  The management system runs in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal audit and management review

  Conducted or facilitated as agreed, with findings closed with evidence and reported to the governing body.

• Integration and certification readiness

  Where ISO 37001 or ISO 37301 certification is planned, the speak-up system is built to serve it.

Sterling does not certify, attest or validate anything, and ISO 37002 itself has no certificate. Where a related standard is certified, certification decisions remain with the independent certification body.

Often combined with

Standards organisations pair with ISO 37002

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
• ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
• ISO 22313 · ISO/TS 22317 · ISO/TS 22318ISO 22313 and ISO 22317 / 22318 guidance explained: applying ISO 22301, business impact analysis and supplier continuity.