National foreword

This British Standard is the UK implementation of ISO 37002:2021.

The UK participation in its preparation was entrusted to Technical Committee G/1, Governance.

A list of organizations represented on this committee can be obtained on request to its committee manager.

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 July 2021.

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO’s adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.

This document was prepared by Technical Committee ISO/TC 309, Governance of organizations.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

Whistleblowing is the act of reporting suspected wrongdoing or risk of wrongdoing. Studies and experience demonstrate that a large proportion of wrongdoing comes to the attention of the affected organization via reports from persons within or close to the organization.

Organizations are increasingly considering introducing or improving internal whistleblowing policies and processes in response to regulation or on a voluntary basis.

This document provides guidance to organizations for establishing, implementing, maintaining and improving a whistleblowing management system, with the following outcomes:

encouraging and facilitating reporting of wrongdoing;
supporting and protecting whistleblowers and other interested parties involved;
ensuring reports of wrongdoing are dealt with in a proper and timely manner;
improving organizational culture and governance;
reducing the risks of wrongdoing.

Potential benefits for the organization include:

allowing the organization to identify and address wrongdoing at the earliest opportunity;
helping prevent or minimize loss of assets and aiding recovery of lost assets;
ensuring compliance with organizational policies, procedures, and legal and social obligations;
attracting and retaining personnel committed to the organization’s values and culture;
demonstrating sound, ethical governance practices to society, markets, regulators, owners and other interested parties.

An effective whistleblowing management system will build organizational trust by:

demonstrating leadership commitment to preventing and addressing wrongdoing;
encouraging people to come forward early with reports of wrongdoing;
reducing and preventing detrimental treatment of whistleblowers and others involved;
encouraging a culture of openness, transparency, integrity and accountability.

This document provides guidance for organizations to create a whistleblowing management system based on the principles of trust, impartiality and protection. It is adaptable, and its use will vary with the size, nature, complexity and jurisdiction of the organization’s activities. It can assist an organization to improve its existing whistleblowing policy and procedures, or to comply with applicable whistleblowing legislation.

This document adopts the “harmonized structure” (i.e. clause sequence, common text and common terminology) developed by ISO to improve alignment among International Standards for management systems. Organizations may adopt this document as stand-alone guidance for their organization or along with other management system standards, including to address whistleblowing-related requirements in other ISO management systems.

Figure 1 is a conceptual overview of a recommended whistleblowing management system showing how the principles of trust, impartiality and protection overlay all elements of such a system.

1 Scope

This document gives guidelines for establishing, implementing and maintaining an effective whistleblowing management system based on the principles of trust, impartiality and protection in the following four steps:

receiving reports of wrongdoing;
assessing reports of wrongdoing;
addressing reports of wrongdoing;
concluding whistleblowing cases.

The guidelines of this document are generic and intended to be applicable to all organizations, regardless of type, size, nature of activity, and whether in the public, private or not-for profit sectors.

The extent of application of these guidelines depends on the factors specified in 4.1, 4.2 and 4.3. The whistleblowing management system can be stand-alone or can be used as part of an overall management system.

2 Normative references

3 Terms and definitions

4 Context of the organization

4.1 Understanding the organization and its context

4.2 Understanding the needs and expectations of interested parties

4.3 Determining the scope of the whistleblowing management system

4.4 Whistleblowing management system

5 Leadership

5.1 Leadership and commitment

5.2 Whistleblowing policy

5.3 Roles, responsibilities and authorities

6 Planning

6.1 Actions to address risks and opportunities

6.2 Whistleblowing management system objectives and planning to achieve them

6.3 Planning of changes

7 Support

7.1 Resources

7.2 Competence

7.3 Awareness

7.4 Communication

7.5 Documented information

8 Operation

8.1 Operational planning and control

8.2 Receiving reports of wrongdoing

8.3 Assessing reports of wrongdoing

8.4 Addressing reports of wrongdoing

8.5 Concluding whistleblowing cases

9 Performance evaluation

9.1 Monitoring, measurement, analysis and evaluation

9.2 Internal audit

9.3 Management review

10 Improvement

10.1 Continual improvement

10.2 Nonconformity and corrective action

Bibliography

BS ISO 37002:2021

Whistleblowing management systems. Guidelines

Current

Published:

31 Jul 2021