ISO/TS 37008 implementation and requirements for internal investigations that stand up to scrutiny.

What it is

What is ISO/TS 37008 and what is it used for?

ISO/TS 37008, often searched as ISO 37008, is ISO's guidance on internal investigations of organisations. It was developed by ISO/TC 309, the committee responsible for governance of organisations, and it covers the whole life of an investigation: the principles behind it, the support it needs, the policy and procedures that govern it, the conduct of the inquiry, the reporting of results and the remedial measures that follow. It applies to any organisation, whatever its type or size.

Most organisations investigate something sooner or later: a whistleblowing report, an expense anomaly, a harassment complaint, a supplier kickback, a data leak. What separates a credible outcome from a damaging one is rarely the investigator's instinct. It is whether scope was agreed, evidence was preserved before it vanished, witnesses were protected, the people deciding had no stake in the answer, and the conclusions led to change. ISO/TS 37008 describes that discipline so it can be repeated case after case, rather than reinvented under pressure.

Current edition. ISO/TS 37008:2023, the first edition, is a Technical Specification published by ISO in July 2023. ISO completed its systematic review and confirmed the document on 25 August 2026, so it remains current and no revision is in progress. It is guidance and contains no requirements to certify against.

Who it is for

Who needs ISO/TS 37008?

No law or certification scheme makes ISO/TS 37008 compulsory. Organisations adopt it because the quality of their investigations is being tested by someone who matters. Four situations bring clients to Sterling:

• A customer, lender or tender asks how you handle misconduct. Due diligence questionnaires increasingly ask for an investigation procedure, not just a code of conduct. A documented, principled process answers the question with evidence.
• You run, or are building, ISO 37301 or ISO 37001. ISO 37301 includes a requirement for investigation processes, and an ISO 37001 programme faces the same question whenever a bribery concern is raised. ISO/TS 37008 supplies the practical detail on how to investigate well.
• A regulator or enforcement authority may one day look at your response. How promptly and fairly you investigated, and what you fixed, can shape the conversation that follows. Legal strategy stays with your lawyers; the process they rely on can be built in advance.
• A group company or new speak-up channel is producing cases. Subsidiaries investigate in different ways, or a new whistleblowing line has created more reports than the team can handle. One framework brings consistency across entities and countries.

Requirements

What are the main ISO/TS 37008 requirements?

Strictly, ISO/TS 37008 contains recommendations, not requirements: it tells you what good practice looks like, and you decide how to apply it in proportion to your size and risks. ISO describes its coverage in the areas below, organised around five guiding principles and the three stages of an investigation. The list is a plain-language map; your programme is checked against the document itself during the engagement.

• Principles: investigations that are independent, confidential, competent and professional, objective and impartial, and legal and lawful.
• Support for investigations: the resources, authority, competence and reporting lines investigators need to do the work properly.
• Policy, procedures, processes and standards: written rules for when an investigation is opened, who conducts it and how it is carried out and reported.
• Pre-investigation: planning the scope, preserving evidence and protecting witnesses and reporters before work starts.
• Conducting the investigation: managing documents and data, and interviewing personnel in a fair and controlled way.
• Reporting investigation results: findings communicated to the right decision makers, with the facts, the evidence and the conclusions kept distinct.
• Remedial measures: corrective action, adjustments to the compliance structure, consideration of self-reporting and engagement with stakeholders.

Putting it into practice

How do you implement ISO/TS 37008?

Because ISO/TS 37008 is guidance, there is no certification audit at the end. The route is to build a framework, prove it works on real or simulated cases, and, where you want independent assurance, have it audited as part of a certifiable compliance or anti-bribery system.

1. 01
   Agree the purpose and reach of the framework.The entities, countries and case types covered, who commissions investigations, and how the board, audit committee, legal and HR fit together.
2. 02
   Gap analysis: compare current practice with the guidance.Recent cases, existing policies and the speak-up channel are tested against the principles and stages, with actions, owners and dates agreed.
3. 03
   Write the policy, procedure and toolkit.Triage rules, investigator appointment and independence checks, evidence handling, interview guides, report templates and remedial action tracking, reviewed with your legal advisers.
4. 04
   Train the investigators and test the process.Role-based training, a simulated case or a review of a closed one, then internal audit and management review of how the framework performed.
5. 05
   Report, sustain and, where wanted, certify alongside.Case metrics go to the board; improvements follow; and if you pursue ISO 37301 or ISO 37001, an accredited certification body audits the investigation process as part of that system.

Check the route before you sign. ISO/TS 37008 is guidance, so any offer of an "ISO 37008 certificate" is not accredited certification. If a customer needs a certificate, ask which certifiable standard it should cover, usually ISO 37301 or ISO 37001, and confirm the certification body's accreditation with an accreditation body recognised under the Global ACI arrangement. The certification buyer's checklist

Cost

How much does ISO/TS 37008 implementation cost?

The investment depends far more on your organisation's shape than on the length of the guidance. A single company that needs a policy and a trained pair of investigators is a very different piece of work from a group with subsidiaries in several jurisdictions, each with its own reporting channel. Every component is shown in the proposal and nothing is added later.

Timeline

How long does ISO/TS 37008 implementation take?

As an estimate, building and testing an investigation framework typically takes two to four months. The pace is set by how quickly the policy is approved, how many entities must adopt it, the time needed to train investigators and whether a case review or simulation can be scheduled early. Where the framework forms part of an ISO 37301 or ISO 37001 programme, it follows that programme's plan and the certification body's schedule.

If an investigation is already open, tell us at the start. The framework can be phased so the live case benefits early, while your lawyers keep control of that matter.

Your engagement

What your ISO/TS 37008 engagement includes

Sterling does not certify, and ISO/TS 37008 carries no certificate: what we deliver is a working investigation framework and the evidence that it operates. The work follows the Sterling OS™ phases. Design™, where our consultants guide your team as it builds, and Drive™, where we manage the build for you, are alternative levels of support, so you choose one. Sustain™ keeps the framework reviewed once it is running, or after certification to a related standard, and Automate™ is Effivity, where the cases and actions live.

• Gap analysis and framework plan

  Current practice measured against the principles and stages, with actions and owners agreed.

• Policy, procedure and toolkit

  Triage, independence checks, evidence handling, interviews and reporting, drafted with your team and legal advisers.

• Effivity ISO & GRC software

  Case records and remedial actions in one controlled workspace, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Testing, internal audit and review

  A simulated or closed case walked through the process, then internal audit and management review.

• Board reporting and Sustain™

  Case metrics for the governing body and periodic reviews that keep the framework current.

Sterling does not provide legal advice; legal questions are decided by your organisation with its legal advisers. Certification decisions for any related standard remain with the independent certification body.

Often combined with

Standards organisations pair with ISO/TS 37008

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
• ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
• ISO 22313 · ISO/TS 22317 · ISO/TS 22318ISO 22313 and ISO 22317 / 22318 guidance explained: applying ISO 22301, business impact analysis and supplier continuity.