Early warning
Problems surface internally before they become crises or regulatory cases.
Implementation & guidance
ISO 37002 Whistleblowing Management
Current edition: ISO 37002:2021 · guidelines
Guidelines for an effective whistleblowing management system, based on trust, impartiality and protection. It helps organisations receive reports of wrongdoing, assess and address them, and protect the people who raise them.
What the guidance covers
The four steps of whistleblowing management
ISO 37002 follows the life of a report, with principles of trust, impartiality and protection throughout.
Receiving reports
Accessible channels, including confidential and anonymous options.
Assessing reports
Triage that decides how each report is handled and by whom.
Addressing wrongdoing
Investigation and action proportionate to the issue raised.
Concluding cases
Closure, feedback to the reporter and learning for the organisation.
Protection
Measures that prevent and address retaliation against reporters.
Confidentiality
Identities and information protected throughout the process.
Roles and independence
Whistleblowing function with the authority and independence to act.
Monitoring
Indicators and reviews that show whether the system is trusted and works.
Why organisations implement it
What an effective speak-up system delivers
Legal alignment
Support for whistleblower protection obligations such as the EU Whistleblowing Directive.
Trusted channels
Employees and third parties confident that reports are handled fairly.
Consistent handling
Every report assessed, addressed and closed the same way.
Lower retaliation risk
Protection measures designed in, not improvised.
Feeds your CMS
Lessons learned flow into ISO 37301 and ISO 37001 systems.
How we work
Path to an effective speak-up system
One AEC methodology from first assessment to a working system, delivered by registered lead auditors.
- AssessCurrent channels, cases and legal obligations reviewed
- DesignPolicy, channels, roles, triage and protection measures designed
- ImplementChannels launched, procedures embedded
- TrainManagers and case handlers trained; staff awareness
- VerifyCase file review, indicators and internal audit
- SustainAnnual review within your compliance system
New speak-up system
We design and launch channels, procedures and protection from the start.
Typically 2 to 4 monthsProgramme upgrade
We bring an existing hotline up to the ISO 37002 approach and legal requirements.
Typically 1 to 3 monthsIntegration
We build whistleblowing into your ISO 37301 or ISO 37001 system.
Typically 1 to 2 months
How it is recognised
Guidelines, applied within your compliance system
ISO 37002 is a set of guidelines and is not certifiable on its own. Its approach is commonly applied within an ISO 37301 or ISO 37001 management system, which accredited certification bodies can certify, including the raising concerns and investigation requirements. AEC helps you apply the guidance and prepares your system for audit.
Practical
Guidance turned into channels and procedures that work.
Certifiable route
Where certification is needed, the route is ISO 37301 or ISO 37001.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO 37002 by industry
Finance · regulated whistleblowing duties
Healthcare · patient safety and conduct concerns
Government · public interest disclosure
Manufacturing · safety, quality and conduct reports
Related standards
Questions
ISO 37002 FAQ
Can we be certified to ISO 37002?
No. ISO 37002 is a set of guidelines. Organisations apply it within an ISO 37301 or ISO 37001 management system, which accredited certification bodies can certify.
Does ISO 37002 meet the EU Whistleblowing Directive?
It supports it. The directive sets legal requirements such as channels, timelines and protection; ISO 37002 gives a management approach for meeting them. We map your system to the laws that apply to you.
Should reports be anonymous?
The guidelines support confidential and, where lawful and appropriate, anonymous reporting. We design channels that fit your legal context and culture.
Who should handle reports?
A whistleblowing function with enough independence, authority and competence. We help you define roles so reports are handled impartially.
Build a speak-up system people trust
Tell us your organisation, current channels and legal obligations. We reply with a proposal covering design, launch and integration.
Certification, where sought, is carried out by independent, accredited certification bodies. AEC prepares organisations and does not guarantee audit outcomes.