Our summary
ISO 37002 is an international standard that gives guidance on whistleblowing management systems. The public ISO page explains that it helps organisations set up, run and maintain a system built on trust, impartiality and protection of the people who report. It follows four steps: receiving reports of wrongdoing, assessing them, addressing them, and closing the case. The system can stand alone or be part of a wider management system. It was published in July 2021 by ISO/TC 309 (Governance of organizations), and ISO confirmed in 2026 that it remains current.
The guidance is generic. It applies to all organisations in the public, private and not-for-profit sectors, whatever their size or activity. It is a paid document: the full text (33 pages) must be bought from ISO or a national standards body. This entry only describes the public product page and does not reproduce the standard.
How auditors use it: Internal auditors and fraud examiners can use ISO 37002 as a reference model when they review an organisation’s speak-up or hotline arrangements. It helps them check whether reports are received, assessed and handled in a fair and consistent way, and whether reporters are protected. Investigators can also use it to improve how cases move from a first report to a final conclusion.