ISO 37500 guide
ISO 37500 and certifiable standards: how outsourcing guidance meets ISO 9001, ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 and ISO 37301
ISO 37500:2014 is guidance with no certificate; ISO 9001, ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 and ISO 37301 are certifiable requirements standards. How they differ, where each meets outsourced work, and how to run one set of outsourcing governance that serves them all.
Key points
- ISO 37500 is guidance on outsourcing governance and has no certificate. ISO 9001, ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 and ISO 37301 are requirements standards that accredited bodies certify.
- Each certifiable standard expects control of work done by others, from its own angle: quality, security, continuity, service or compliance.
- ISO 37500 supplies the method: one provider register, one risk method and one set of joint reviews that answer every standard in scope.
- Where a client or regulator needs a certificate, lead with the requirements standard; use ISO 37500 to make the outsourcing behind it work.
ISO 37500 and certifiable standards: the short answer
ISO 37500 and the certifiable management system standards do different jobs. ISO 37500:2014 is guidance on how to run outsourcing well across its life cycle; it has no requirements and no certificate. ISO 9001, ISO/IEC 27001, ISO 22301, ISO/IEC 20000-1 and ISO 37301 are requirements standards that an accredited certification body can audit, and each of them expects you to keep control of work that someone else does for you.
So the question is rarely which one to choose. Where a client or regulator needs a certificate, the requirements standard provides it. ISO 37500 supplies the method for governing providers that those standards expect you to control, so the same register, risk method and joint reviews answer every standard in your scope.
Guidance and requirements standards: the difference that matters
A requirements standard states what an organisation shall do, in a form an auditor can test; certification bodies accredited through the Global ACI arrangement audit against it and decide whether to certify. A guidance standard recommends good practice and leaves the choices to the user. ISO 37500 is the second kind: ISO describes it as guidance on outsourcing governance, flexibility, risk and collaborative relationships, and it can be tailored to the sector, the applicable laws and the size of the arrangement.
That difference decides how each is evidenced. Conformity with a requirements standard is shown by a certificate from an accredited body. Alignment with ISO 37500 is shown by an assessment, by the governance records themselves and, if you want one, by an independent review. Sterling does not certify either; an accredited body audits and decides for the requirements standards.
Side by side: where each standard meets outsourcing
Each certifiable standard approaches outsourced work from its own subject. The table describes their focus at topic level; the current edition of each standard is the reference for its exact requirements.
| Standard | Route | Its interest in outsourced work | What ISO 37500 adds |
|---|---|---|---|
| ISO 9001 | Certification by an accredited body | Control of externally provided processes, products and services, so they do not undermine conformity or customer satisfaction | A life-cycle method for choosing, transitioning, governing and exiting the providers you control |
| ISO/IEC 27001 | Certification by an accredited body | Information security in supplier relationships and control of externally provided processes within the ISMS | Joint governance and change arrangements in which the security requirements are agreed and reviewed with the provider |
| ISO 22301 | Certification by an accredited body | The suppliers and partners your prioritised activities depend on, and how their disruption is addressed | Exit and transition planning, and governance that keeps continuity arrangements current with each provider |
| ISO/IEC 20000-1 | Certification by an accredited body | Services, service components and processes delivered with other parties, for which the organisation stays accountable | A shared governance model for the parties involved in delivering the service, from initiation to exit |
| ISO 37301 | Certification by an accredited body | Compliance obligations that remain the organisation's own when processes are outsourced, and the controls over third parties | Due diligence, contract governance and joint reviews in which compliance obligations are tracked with each provider |
The pattern is the same in every row. The certifiable standard sets the outcome the auditor will test; ISO 37500 offers a structured way to run the outsourcing that produces it.
How the pairing works in practice
One provider register for every standard
A single register of outsourcing arrangements, with each provider's owner, contract dates, governance contacts and risk rating, serves the supplier expectations of every certified system at once, instead of one list per standard.
One risk method
Outsourcing risks are assessed on one scale, with the security, continuity, service and compliance angles recorded against the same arrangement, so an auditor for any of the standards sees the same evidence.
One set of joint reviews
The joint governance reviews ISO 37500 describes become the place where quality, security, continuity, service and compliance performance is reviewed with the provider, minuted once and followed up once.
For a BPO in the Philippines certified to ISO/IEC 27001 and ISO 9001 that subcontracts part of its service, or a software company in India running ISO/IEC 20000-1 with a hosting provider, the result is fewer duplicate documents and one story for every auditor. The outsourcing life cycle guide sets out the stages in detail.
When certification matters, and when ISO 37500 is enough
Lead with a certifiable standard when
- A client contract, tender or supplier list asks for a certificate.
- A regulator or parent company expects certified management systems.
- You need independent, accredited assurance that others can verify.
Lead with ISO 37500 when
- Your board or regulator asks how material outsourcing is governed, not for a certificate.
- You are setting up, renewing or exiting a significant arrangement and want it done well.
- You are a provider and want a consistent way to run transition, governance and exit for your clients.
Use both when
You hold or are seeking certification and outsource work that the certified system depends on. The certificate shows conformity; ISO 37500 makes the outsourcing behind it run well. See also the governance, risk and resilience standards and the supply chain, logistics and customs standards.
How Sterling approaches it
Outsourcing governance that serves every certificate you hold
Sterling's expert and experienced consultants assess your outsourcing against ISO 37500, map it to the supplier expectations of the standards you hold or are seeking, and build one register, one risk method and one set of joint reviews in Effivity. Certification itself is carried out by an accredited body; Sterling does not certify. We help our clients put it into practice and prove it.
Book a free discovery callISO 37500 and certifiable standards: questions organisations ask
Can ISO 37500 replace ISO 9001 or ISO/IEC 27001 certification?
No, ISO 37500 is guidance and cannot replace a certificate. Where a certificate is needed, the requirements standard provides it; ISO 37500 strengthens how you govern the providers that the certified system depends on.
Which certifiable standard is closest to ISO 37500?
It depends on what you outsource. For a managed IT or business service, ISO/IEC 20000-1 is often closest; for information handled by providers, ISO/IEC 27001; for compliance obligations, ISO 37301. All five standards in this guide have a supplier or outsourcing dimension.
Is ISO 37301 certifiable?
Yes, ISO 37301 is a requirements standard for compliance management systems, and accredited certification bodies certify against it. Our ISO 37301 page explains the route.
Will a certification auditor ask about ISO 37500?
Not as such, because ISO 37500 is not a requirement of the certified standard. The auditor will test how you control outsourced work under that standard, and governance built on ISO 37500 gives the records to show it.
Can one Sterling engagement cover ISO 37500 and a certifiable standard?
Yes. One engagement can assess outsourcing governance against ISO 37500 and implement the certifiable standard, with one all-inclusive proposal, one Effivity workspace and the certification audit carried out by an accredited body of your choice.
More ISO 37500 guides
Every guide in the ISO 37500 series is written for one question and links back to the hub for the whole picture.
Talk to a consultant
Make your outsourcing governance serve every certificate you hold.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice