Governance, Ethics & Social
Regulators, lenders and buyers expect evidence that integrity is managed: bribery prevented, obligations met, concerns heard and workers treated fairly. We help you choose the right standards and prepare for certification.
Start from the question you must answer
Anti-bribery and compliance management integrate in one system. SA8000 covers decent work, and two sector standards cover nuclear supply and ship recycling.
Prevent, detect and respond to bribery, with transition by 28 February 2027.
ISO 37001 → Compliance ISO 37301 ISO 37301:2021All compliance obligations, risks and culture in one management system.
ISO 37301 → Decent work SA8000 SA8000:2026Workers' rights and working conditions, certified by SAAS-accredited bodies.
SA8000 → Whistleblowing ISO 37002 GuidelinesSpeak-up channels and protection, applied within ISO 37301 or ISO 37001.
ISO 37002 → Nuclear supply chain ISO 19443 ISO 19443:2018Quality for products and services important to nuclear safety.
ISO 19443 → Ship recycling ISO 30000 ISO 30000:2009Safe and environmentally sound ship recycling facilities.
ISO 30000 →Side by side
| Standard | Answers the question | Certifiable | Who decides | Typical engagement |
|---|---|---|---|---|
| ISO 37001 | Is bribery prevented? | Yes | Accredited certification body | 4 to 9 months |
| ISO 37301 | Are obligations met? | Yes | Accredited certification body | 4 to 9 months |
| ISO 37002 | Are concerns heard and protected? | No (guidelines) | Applied within ISO 37301 or 37001 | 2 to 4 months |
| SA8000 | Is work decent? | Yes | SAAS-accredited body | 6 to 12 months |
| ISO 19443 | Is nuclear supply controlled? | Yes | Accredited certification body | 6 to 12 months |
| ISO 30000 | Is ship recycling safe and sound? | Yes | Accredited certification body | 6 to 12 months |
One methodology across integrity standards
Delivered by registered lead auditors with hands-on sector experience.
- AssessGap assessment, scope and roadmap
- DesignProcesses, risks and documented information
- ImplementProcesses embedded on the ground
- TrainAwareness to internal auditor competence
- VerifyInternal audit, management review, mock audit
- Certify & sustainCertification audit support, then surveillance
One compliance system, not three programmes.
ISO 37001 and ISO 37301 share the harmonized structure, and ISO 37002 fits inside them. Run them with one compliance function, one risk assessment and one audit programme.
Governance and compliance training
CQI/IRCA Approved Training Partner. In-house, public, virtual or hybrid.
- ISO 37001 Implementer and ISO 37301 Implementer courses
- Awareness sessions for staff, managers and board members
- In-house internal auditor training for anti-bribery and compliance systems
Governance and compliance FAQ
Does AEC issue these certificates?
No. ISO 37001, ISO 37301, ISO 19443 and ISO 30000 certificates are issued by accredited certification bodies, and SA8000 certificates by SAAS-accredited bodies. AEC prepares your organisation for those audits.
What changes in 2026 and 2027?
ISO 37001:2016 certificates must transition to the 2025 edition by 28 February 2027. SA8000:2026 replaces SA8000:2014, with recertification to the new edition expected by 31 May 2029.
Is ISO 37002 certifiable?
No. It is a set of guidelines, usually applied within an ISO 37301 or ISO 37001 system that can be certified.
Do these standards replace legal advice?
No. They provide management systems that help you meet legal and ethical obligations. Interpretation of specific laws remains with your legal advisers.
Plan your integrity programme
Tell us your operations, regulators and stakeholders. We recommend the right standards and send a proposal covering implementation, training and certification support.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.