Most serious organizational wrongdoing comes to light because an insider raises a concern. Whether that person is protected and the report acted on — or punished and ignored — defines whether an organization can actually catch its own problems. ISO 37002 is the international guidance for a whistleblowing management system that does the former.
Four stages of handling a report
ISO 37002 frames the lifecycle of a concern in four stages:
- Receiving reports — accessible, trusted channels people are willing to use.
- Assessing them — triaging seriousness and credibility.
- Addressing them — investigating fairly and acting.
- Concluding — closing the loop, including feedback to the reporter where appropriate.
The three principles that make it work
A whistleblowing system lives or dies on trust, built on three things ISO 37002 emphasises:
- Protection from retaliation — the single most important factor; without it, people stay silent.
- Confidentiality — protecting the reporter's identity and the information.
- Fairness — to the reporter, the subject of the report, and everyone involved (the accused has rights too).
A whistleblowing channel nobody trusts is worse than none — it creates the illusion of safety while wrongdoing stays hidden.
Culture over mechanism
Channels and procedures are necessary but not sufficient. What determines whether people speak up is whether they've seen it be safe to do so. Visible leadership commitment, consistent protection in practice, and acting on reports build that culture; a single retaliation case quietly tolerated destroys it.
Where it fits
ISO 37002 is guidance (not certifiable) and is designed to work alongside ISO 37001 (anti-bribery) and ISO 37301 (compliance) — together forming an integrity ecosystem where concerns can surface and be acted on before they become scandals.
