Establish a trusted speak-up system. Confidential intake, fair investigations, zero retaliation, measurable outcomes.
ISO 37002 provides guidelines for implementing, managing, evaluating, maintaining and improving a robust whistleblowing management system. It is based on the principles of trust, impartiality and protection and offers voluntary guidance rather than certifiable requirements. A well-designed system covers policy, reporting channels, intake, triage, investigation, outcome management and anti-retaliation measures.
AEC delivers policy-to-practice implementation: we design governance models, multilingual speak-up channels, investigation SOPs, evidence handling and reporting dashboards. Our programmes integrate with ISO 37301 compliance and ISO 37001 anti-bribery systems, ensuring alignment across ethics, legal and risk functions.
ISO 37002 encourages organisations to provide safe channels and protection to whistleblowers so they can report wrongdoing without fear of retaliation.
ISO 37002 is flexible and can be adapted to organisations of any size or sector. It is voluntary guidance but may become a contractual requirement in some industries. Triggers indicating a need for a formal whistleblowing management system include:
Whistleblowing programmes can be led by Compliance, Legal or blended with Internal Audit, with board audit/ethics committee oversight. Ownership should ensure independence from operational management and provide clear lines of accountability.
Adopt the three-lines model: first-line managers encourage speak-up culture, second-line compliance/legal teams run the programme and third-line internal audit provides assurance.
Define a RACI for intake, triage, investigation, closure and retaliation monitoring. Establish independence and conflict safeguards with recusal rules. Provide an external channel for contractors and suppliers to report concerns.
Provide multiple reporting channels – hotline, web portal, email, in-person and postal. Offer 24/7 availability, multi-language support and anonymous options. Send an acknowledgement with a protection notice to the reporter.
Assess severity, people risk, legal or regulatory exposure and evidence availability. Identify immediate safeguards and assign investigators based on independence and expertise.
Prepare an investigation plan, define roles, maintain a chain of custody and conduct interviews. Capture digital evidence with confidentiality flags and document all steps in the case record.
Classify cases as substantiated or unsubstantiated. Implement corrective actions, HR measures and control fixes. Provide structured updates to the reporter within defined timelines and track retaliation for 6–12 months.
Update control libraries and training based on findings. Produce dashboards and reports to management and the board, highlighting trends, root causes and improvement actions.
Typical timeline: 8–12 weeks to go-live for a single-country rollout; 12–16 weeks for multi-country. Our approach is phased to manage risk and build capability.
Dependencies: hotline/case-management tool selection, data protection/IT approvals and union or staff council consultations where applicable.
60–90 minute e-learning module for all staff covering speak-up principles, channels and protection from retaliation.
Practical training for managers on handling disclosures, anti-retaliation duties and escalation paths.
2–3 day course on case handling, interviewing techniques, evidence management and report writing.
Advanced training on triage, prioritisation, KPI tracking and board reporting for programme leads.
Programme to enable internal rollout of awareness and manager briefings by your own trainers.
Interactive session for executives on tone-from-the-top, governance responsibilities and building a speak-up culture.
24/7, multi-language, anonymous whistleblower portals with ticketing functionality; support via phone and web forms to maximise accessibility.
Role-based access, encryption, retention controls, audit trails and analytics capabilities.
Access controls, DPIA templates, data residency options and cross-border routing. Ensure lawful basis and minimisation for personal data processing.
Integration with HRIS, email and SIEM/DLP tools for evidence capture. Evaluate vendors on uptime, ISO 27001/27701 posture, sub-processor transparency, translations and telephony reach.
Address regulator reporting timelines, market abuse rules and conduct risk. Support multi-currency and cross-border channels.
Ensure patient safety and clinical research integrity with secure evidence handling and privacy compliance.
Meet procurement integrity rules, provide ombudsman links and adhere to transparency mandates.
Support remote sites, contractor channels and community interfaces while managing operational risks.
Enable supplier reporting, protect temporary workers from retaliation and align with supply chain ethics programmes.
Policy and channels design, core SOPs and investigator training. 8–10 weeks.
Global policy with local addenda, multilingual intake, DPIA and investigation playbook. 12–16 weeks.
Annual programme review, test incidents, KPI audit and board reporting support.
External intake & triage, case QA and quarterly analytics. Pricing on request based on size, countries/languages, tool choice and training volume.
| Standard | Type | Purpose | Certifiable |
|---|---|---|---|
| ISO 37002 | Whistleblowing management system | Guidance on speak-up programmes based on trust, impartiality and protection | No |
| ISO 37301 | Compliance management system | Requirements with guidance for establishing, developing, implementing and improving a compliance framework | Yes |
| ISO 37001 | Anti-bribery management system | Requirements and guidance for preventing, detecting and addressing bribery | Yes |
| ISO/IEC 27001 & 27701 | Security & privacy management | Controls for information security and privacy management systems | Yes |
No. ISO 37002 is a guidance standard. It provides recommendations for implementing a whistleblowing management system and is not intended for certification.
Multiple reporting channels are required. A hotline and web portal provide scalability, language coverage and anonymity options for reporters.
Unique case codes and encrypted mailboxes protect identity. Systems should avoid caller ID logging and enforce strict access controls.
Adopt an anti-retaliation policy, train managers, build HR workflow flags and monitor retaliation incidents for 6–12 months.
Consult employee representatives early. Align on privacy and process transparency to build trust and secure buy-in.
Conduct Data Protection Impact Assessments (DPIAs), apply data minimisation, define retention schedules and establish lawful bases for processing. Consider cross-border routing and data residency.
Assignment is case-by-case. Avoid conflicts of interest; Legal or Compliance teams typically lead with Internal Audit assurance.
Define service levels. Acknowledge within 7 days and provide updates within three months; tighten timelines for high-risk cases.
This page is informational and not legal advice. For data processing details regarding speak-up channels, see our privacy notice.
Reduce regulatory exposure, enhance culture and demonstrate ethical leadership with ISO 37002 guidance tailored to your organisation.
Free consultation • Global implementation support • Proven expertise across regulated industries
Governance, Compliance & Ethics family
Related standards: ISO 37301 (Compliance, certifiable), ISO 37001 (Anti-bribery, certifiable), ISO/IEC 27001 (Security) and ISO/IEC 27701 (Privacy)