Whistleblowing Management (ISO 37002)

ISO 37002 is guidance for a whistleblowing management system. It describes the processes for receiving, assessing, addressing and closing a report, and the principles of protecting the whistleblower against retaliation and ensuring confidentiality. It is a guidance document, not a requirements standard.

• Groups with subsidiaries within scope of the EU Whistleblower Directive
• Organisations obliged to, or wanting to, establish an internal reporting channel
• Those wanting to strengthen the reporting mechanism of their ISO 37001 and ISO 37301 systems
• Compliance functions running an ethics line at publicly listed companies

The standard itself is not mandatory, and because it is guidance, no accredited certification is issued for it. However, the obligation to establish an internal reporting channel has become a legal requirement in some countries; ISO 37002 offers a method for meeting this obligation.

• Principles of the whistleblowing management system: trust, impartiality, protection
• Establishing reporting channels and their accessibility
• Receiving and recording the report and acknowledging receipt
• Assessing and prioritising the report
• Conducting and concluding the investigation
• Protecting the whistleblower and related persons, preventing retaliation
• Confidentiality and personal-data protection
• Closing the process, feedback, and record retention

1. 1Gap AnalysisCurrent practices are compared against the guidance's recommendations; gaps are identified.
2. 2ApplicationThe process, roles and records the guidance recommends are implemented, adapted to the organisation's own structure.
3. 3Internal AssessmentThe effectiveness of implementation is measured through internal audit and review.
4. 4Second-Party Assessment (optional)A customer or an independent party can assess the implementation's conformity with the guidance and issue a report. This is not an accredited certificate.

This document is guidance; because no accredited certificate is issued, it also has no validity period. Implementation depends on the organisation's own review schedule.

• Existing policy, procedure and process descriptions
• Relevant records and measurement data
• Definitions of responsibility and authority

There is no fixed list price; the cost is calculated based on the following variables and provided in writing in the quote.

• The scope of the gap analysis
• Whether implementation consultancy is requested
• Whether a second-party assessment is requested

This document is not a requirement but a guide; That's why accredited certification is NOT provided. If anyone submits an accredited document such as "ISO 31000 certificate", this is against the accreditation rules. Implementation of the guidance can be considered as evidence in the audit of the relevant specification standard (e.g. ISO 9001, ISO 45001).

The scope under which this scheme can be offered varies according to your product and activity; it is confirmed in writing at the quote stage.

• ISO 37001Anti-Bribery
• ISO 37301Compliance Management
• ISO 31000Risk Management
• ISO 37000Corporate Governance
• ISO 9001Quality Management System
• ISO 10002Customer Satisfaction and Complaint Management
• ISO 10004Customer Satisfaction Monitoring and Measurement
• ISO 10012Measurement Management System