ISO 37002
ISO 37002 whistleblowing management implementation
ISO 37002 consulting helps businesses establish trusted whistleblowing and case-handling processes. Vosurein reviews existing channels, authority to receive reports and case records, then defines responsibilities for routing, protection and closure so reports receive an appropriate response.
For Your Business
Who this service is for and when to start
For businesses with a reporting mailbox but no complete handling procedure, or those combining integrity, compliance and internal control channels. When systems change, groups merge or major customers raise requirements, check that people can use the channels and receive a response.
The Challenge
Common challenges faced by businesses
Publishing a reporting address does not establish an effective system. People may be reluctant to use it if reports go to the manager implicated, handlers cannot avoid conflicts of interest, or reporters do not know what happens next.
Route service complaints, employment grievances and reports of wrongdoing to the appropriate processes. Circulating information too widely can expose identities and sensitive details.
Our Approach
Methods and applicable requirements
ISO 37002:2021 provides whistleblowing management guidance based on trust, impartiality and protection, covering receipt, assessment, handling and closure. It can operate alone or within an existing system. This service does not include case investigation or legal representation, or promise standalone management system certification.
The priorities below depend on the organisation’s context. Confirm the scope and level of supporting evidence at the start.
Reporting channels and receipt
Define who can use the channels, what reports they accept and which details need to be recorded. Distinguish acknowledging receipt from subsequent case handling.
Preliminary assessment
Define case classification, urgency, conflict-of-interest checks and decision responsibilities, with appropriate escalation routes for reports involving management.
Case handling
Establish arrangements for information access, confidentiality, and protection, confirm referral methods for professional investigations or legal needs, and do not require general contact points to handle all cases themselves.
Case closure and improvement
Define what can be communicated in a response and who retains or deletes records. Use identified gaps to improve management arrangements; closure should mean more than filing a case away.
Process
Consulting scope and process
Review existing reporting channels
Review report sources, departmental responsibilities and current case procedures to define the scope.
Plan receipt and case routing
Work with management and compliance contacts to define classification, authority, conflict-of-interest safeguards and protection arrangements.
Walk through case-handling scenarios
Use de-identified scenarios to test receipt, escalation and closure, checking whether information is shared appropriately.
Hand over responsibility for maintaining the system
Revise procedures and training. Confirm record-management responsibilities, review intervals and who owns system improvements.
Preparation
What documents do companies need to prepare?
- Channels and notifications: Email, platform, announcements, and instructions for use.
- Responsibilities and Authorization: Responsibilities for case handling, approval, recusal and escalation.
- Procedures and records: Templates for report receipt, routing, confidentiality and closure.
- Existing problems: De-identified cases and required system improvements.
An index or summary is enough for an initial discussion. Before sharing personal data, confidential contract information or system records, agree on access authorisation, redaction and retention.
Project Planning
Estimating time and cost
The workload depends on reporting channels, languages, group structure and the number of test scenarios. Platform development, outsourced report intake, investigation and legal services are agreed separately. Agree how sensitive case information will be handled before sharing it.
FAQ
Frequently asked questions
Does having an anonymous email address meet the requirements?
You also need working arrangements for receiving, assessing and addressing reports, and protecting those involved. A reporting channel is the starting point, not a replacement for these procedures.
Should the whistleblowing contact handle every complaint?
Classify reports first, directing general complaints and whistleblowing matters to the appropriate processes. Avoid unrestricted circulation of information between departments.
Can you guarantee that your identity will never be revealed?
It is not advisable to make absolute promises. Confidentiality arrangements, authority, and applicable legal conditions must be clearly stated, and if necessary, professional judgment should be made.
Will consultants investigate cases directly?
This section focuses on system design and scenario drills. Case investigations require additional confirmation of qualifications, authorization, scope, and legal arrangements.
How to handle reports involving supervisors?
Set conflict-of-interest safeguards and escalation routes in advance so the person implicated cannot control the case.
Can it be incorporated into compliance or anti-bribery systems?
Appropriate channels and records can be shared, but whistleblower protection, case access rights and routing decisions must remain clear.
Related
Related services and enquiries
Tell us your industry, the activities you want to improve, your existing system and your target completion date so we can define the scope together.
Content checked: . Applicable versions and requirements depend on the company’s circumstances.
Let's Talk
Start a conversation about your needs.
Tell us how the work is done today and when you hope to finish,
so we can agree the scope and way of working together.
Blog
Sustainability and AI insights
Start with understanding,
and see where change can lead.