ISO 37500 outsourcing governance: assessed, strengthened and evidenced.

What it is

What is ISO 37500 and what is it used for?

ISO 37500 is the international guidance standard on outsourcing. It covers the main phases, processes and governance aspects of outsourcing, independent of the size of the organisation or its sector, and aims to give client and provider a sound foundation for entering into an arrangement and keeping it successful for the whole contractual period. Its four themes are governance for the mutual benefit of both parties, flexibility as requirements change, outsourcing risk and collaborative relationships.

Outsourcing governance is a governance subject before it is a procurement one, which is why ISO 37500 sits on this site with the governance, risk and resilience standards, beside ISO 37301 and ISO 37000. Supplier security, distribution and customs schemes are covered in the supply chain, logistics and customs standards.

Current edition. ISO 37500:2014 is the first edition, published in November 2014 and developed by ISO's project committee on outsourcing, ISO/PC 259. It is now maintained by ISO/TC 286, Collaborative business relationship management. ISO confirmed the edition in 2021 and opened a further systematic review in January 2026, which closed on 5 June 2026; ISO's page does not yet show the outcome, so the 2014 edition remains the current one.

Who it is for

Who uses ISO 37500 outsourcing governance?

ISO 37500 is written for outsourcing clients, providers and practitioners: decision makers, the people who set up and manage arrangements, and staff at every level of experience. Organisations come to Sterling from four starting points:

• A customer or tender asks how you govern what you outsource. A large client wants evidence that your subcontracted services are selected, monitored and controlled.
• A regulator expects outsourcing to be governed. Financial services, healthcare and public bodies are often asked to show oversight of material outsourcing, with risk assessment, exit plans and board reporting.
• A group wants one way of outsourcing across companies. Each subsidiary contracts differently, with no common view of providers, risks or value.
• You are the provider. A BPO, IT or facilities provider wants to show clients a mature model for transition, joint governance, change and exit, and to run its accounts the same way.

The intended benefit is arrangements that keep delivering after the contract is signed, with fewer disputes and less value lost at transition and exit.

Business benefits

How ISO 37500 protects the value of outsourcing

Outsourcing governance earns its place when the arrangement delivers what the business case promised.

• Decisions taken on evidenceA business case and risk view before anything is outsourced.
• Joint governance that worksClear roles, meetings and escalation for client and provider.
• Exit without disruptionPlans for renewal, re-tender or return in-house prepared early.

Measure the outcomes, such as service levels met, disputes resolved and changes agreed on time.

Guidance areas

What does ISO 37500 cover?

ISO 37500 contains guidance rather than requirements, so there is no clause-by-clause audit and nothing to certify. ISO's own summary describes what the guidance addresses; an assessment reviews your arrangements against each of these areas, at the level your scope needs:

• The outsourcing life cycle. The main phases of an arrangement, recognising that client and provider act separately in some phases and together in others
• Processes. The activities that run through each phase, from deciding what to outsource to managing the arrangement until it ends
• Governance. Good outsourcing governance for the mutual benefit of client and provider, with decision rights, roles and escalation agreed by both
• Flexibility. Arrangements that accommodate changing business requirements rather than locking in the needs of the day the contract was signed
• Risk. Identifying the risks involved in outsourcing, for both parties, across the arrangement
• Collaborative relationships. Relationships that benefit both sides, so performance problems are solved jointly rather than argued over
• Tailoring. Adapting the guidance to the sector, to international, national and local law, and to the size of the arrangement
• Scope of use. Any outsourcing relationship, first-time or repeat, with a single provider or several

Assessment route

How does an ISO 37500 assessment work?

There is no certification body in this route. Sterling assesses your outsourcing governance against the guidance, you decide what to strengthen, and your leadership, internal audit and, where you want one, an independent reviewer judge the result. The five steps:

1. 01
   Agree the scope.Confirm the arrangements, providers, entities and services in scope, whether you are the client, the provider or both, and who is asking for evidence.
2. 02
   Assess against the guidance.Review strategy, contracts, governance, risk, transition, performance and exit records against ISO 37500, interview both parties and rate maturity area by area.
3. 03
   Agree a prioritised improvement plan.Leadership chooses what to strengthen first, with owners, dates and resources, starting with the arrangements that carry most risk or value.
4. 04
   Strengthen the governance.Design the joint governance model, the risk register, the change and exit arrangements and the reports, with client and provider, and put them into operation.
5. 05
   Re-assess and report.Check that the improved arrangements operate as designed, close the remaining gaps with evidence and report the result to management and the board.

Check the route before you sign. ISO 37500 provides guidance, not requirements, so any "ISO 37500 certificate" is a document of the seller's own design and is not recognised by any accreditation body. Where your client or regulator needs certification, ask which certifiable standard they mean, such as ISO 9001, ISO/IEC 27001 or ISO 37301, and check the certification body's accreditation. The certification buyer's checklist

Cost

What does an ISO 37500 assessment cost?

There is no useful universal price for outsourcing governance. A company with one critical provider needs a different scope from a group with dozens of arrangements across countries, or a provider running governance on many client accounts. What we can promise is a proposal in which every component is visible and nothing is added later, with no certification fee, because none exists.

Timeline

How long does an ISO 37500 assessment take?

The timeline depends on the number of arrangements, the availability of both parties, the quality of existing contracts and records, and how quickly leadership decides on the improvement plan. The timeline is set in the proposal once the scope is known; a large portfolio is often phased by risk.

If a contract renewal, a tender or a regulator's date sets the deadline, share it at the start. We will tell you what is achievable and which decisions cannot wait. Governance promised in days, before anyone has read your contracts, is not a plan; it is a sales tactic.

Challenges

Common ISO 37500 implementation challenges

Most outsourcing governance stalls for the same reasons.

Your engagement

What your ISO 37500 engagement includes

Your agreed scope brings together what assessed and strengthened outsourcing governance needs, from one team, under one all-inclusive proposal. Sterling OS™ gives two alternative support levels: Design™, where we develop and your team implements under our advice and supervision, or Drive™, where we design and build under your approval, fully managed. Sustain™ keeps the governance current year after year, and Automate™ runs it in Effivity.

• Scope and assessment

  Arrangements, providers and decision owners agreed, then each assessed against the guidance, with a maturity rating by area.

• Prioritised improvement plan

  What to strengthen first, with owners, dates and resources, approved by leadership.

• Effivity ISO & GRC software

  Your outsourcing register, risks, reviews, actions and exit plans in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for the people who will audit outsourcing governance, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Governance design with both parties

  The joint governance model, risk, change and exit arrangements and reporting, designed with client and provider.

• Re-assessment and report

  The improved arrangements re-assessed and reported to management and the board, with gaps closed with evidence.

Sterling does not certify, and ISO 37500 carries no certificate; none is promised.

How we deliver

How Sterling supports your ISO 37500 assessment

Every ISO 37500 engagement runs on Sterling OS™. Choose the support level your capacity allows.

1. 01
   Design™Guided: we develop, your team implements under our advice and supervision.
2. 02
   Drive™Managed: we design and build under your approval.
3. 03
   Sustain™Periodic re-assessments, internal audits and refreshers.
4. 04
   Automate™The governance running in Effivity.
5. 05
   Revise™A future edition of ISO 37500, new arrangements and new standards.

Before work starts we agree the engagement team, the deliverables and who decides what.

Often combined with

Standards organisations pair with ISO 37500

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
• ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
• ISO 22313 · ISO/TS 22317 · ISO/TS 22318ISO 22313 and ISO 22317 / 22318 guidance explained: applying ISO 22301, business impact analysis and supplier continuity.