ISO 37002:2021 - Whistleblowing Management Systems

Requires reacting to nonconformities, determining causes, implementing corrective actions, and reviewing effectiveness.

• Feedback loop documentation
• Innovation maturity reassessment
• Lessons learned reports
• Root cause analysis records
• Process improvement proposals tracker

• Nonconformities not logged or trended
• Maturity reassessment skipped year over year
• Feedback loops from operations back to strategy missing
• Corrective actions closed without verifying effectiveness
• Root cause analysis stops at symptom level

Requires continual improvement of the suitability, adequacy, and effectiveness of the whistleblowing management system.

• Continual improvement register
• Nonconformity and corrective action log
• Lessons learned reports

• Lessons learned stored but never reused
• Improvement register stale, items older than 12 months unactioned
• Feedback loops from operations back to strategy missing

Requires determining external and internal issues relevant to the purpose of the whistleblowing management system.

• IMS scope statement signed by leadership
• Innovation maturity baseline assessment
• Competitor innovation benchmark

• Stakeholder map omits external innovation partners (universities, startups)
• Context analysis treated as one-off, not refreshed annually
• Trend scanning is ad hoc and undocumented

Requires identifying interested parties and their requirements relevant to the whistleblowing management system.

• Competitor innovation benchmark
• Market and technology radar
• PESTEL/SWOT analysis covering innovation landscape
• Trend and foresight scan report
• IMS scope statement signed by leadership

• Strategic intelligence not feeding into innovation decisions
• Stakeholder map omits external innovation partners (universities, startups)
• Trend scanning is ad hoc and undocumented
• Internal capability gaps not assessed against strategy
• IMS scope undefined or inconsistent across business units

Requires determining the boundaries and applicability of the whistleblowing management system.

• Interested-party requirements log
• Trend and foresight scan report
• Innovation maturity baseline assessment

• Innovation maturity baseline never established
• Context analysis treated as one-off, not refreshed annually
• IMS scope undefined or inconsistent across business units

Requires establishing, implementing, maintaining, and continually improving the whistleblowing management system.

• Trend and foresight scan report
• Interested-party requirements log
• PESTEL/SWOT analysis covering innovation landscape
• Stakeholder map with innovation interests

• Stakeholder map omits external innovation partners (universities, startups)
• Context analysis treated as one-off, not refreshed annually
• Strategic intelligence not feeding into innovation decisions
• Internal capability gaps not assessed against strategy
• Trend scanning is ad hoc and undocumented

Requires top management to demonstrate leadership and commitment by promoting a speak-up/listen-up culture.

• Approved innovation policy
• Leadership innovation commitments register
• Culture assessment results
• Innovation council terms of reference
• Board minutes referencing innovation strategy

• Executive sponsorship limited to lip service, no time committed
• Innovation strategy disconnected from corporate strategy
• Culture barriers to risk-taking not addressed by leadership
• No clear accountability for innovation outcomes
• Roles and responsibilities for innovation undefined

Requires establishment of a whistleblowing policy that promotes a speak-up/listen-up culture and provides protection.

• Executive innovation charter
• Innovation council terms of reference
• Culture assessment results
• Board minutes referencing innovation strategy
• Strategic alignment matrix linking innovation to business goals

• Executive sponsorship limited to lip service, no time committed
• Innovation strategy disconnected from corporate strategy
• Governance forum lacks decision-making authority
• Roles and responsibilities for innovation undefined
• No clear accountability for innovation outcomes

Requires assignment and communication of roles and responsibilities for the whistleblowing management system.

• Strategic alignment matrix linking innovation to business goals
• Innovation vision and strategy document
• RACI for innovation roles

• Innovation strategy disconnected from corporate strategy
• Innovation policy not formally approved or communicated
• Roles and responsibilities for innovation undefined

Requires identifying risks and opportunities related to the whistleblowing management system and planning actions to address them.

• Opportunity and risk register
• Resource allocation plan
• Change management plan for innovation initiatives
• Initiative prioritisation scorecard
• Innovation objectives with measurable targets

• Roadmap not updated when strategy changes
• Opportunities and risks tracked separately with no link to objectives
• Portfolio biased toward horizon 1 incremental projects

Requires establishing measurable objectives for the whistleblowing management system with plans to achieve them.

• Opportunity and risk register
• Action plans tied to innovation objectives
• Innovation portfolio dashboard

• Opportunities and risks tracked separately with no link to objectives
• Risk treatment plans absent for high-uncertainty bets
• No resource plan tied to portfolio priorities

Requires providing resources needed for establishment, implementation, maintenance, and improvement of the system.

• Innovation infrastructure inventory
• Document control register for IMS
• Partnership and collaboration agreements
• Strategic intelligence repository
• Communication plan (internal/external)
• Competence matrix for innovation roles

• Time allocation for innovation crowded out by BAU
• Strategic intelligence siloed in one team
• Partnership agreements lack IP and confidentiality clauses

Requires ensuring persons performing whistleblowing-related functions have the necessary competence.

• Partnership and collaboration agreements
• Document control register for IMS
• Knowledge repository / lessons learned database
• Competence matrix for innovation roles
• IP register and assignment agreements
• Innovation tools and methods catalogue

• Strategic intelligence siloed in one team
• Tools and methods inconsistent across teams
• Knowledge from past projects not captured or reused
• Innovation budget not ring-fenced from operating budget
• Competence requirements for innovation roles not defined

Requires ensuring all personnel are aware of the whistleblowing policy and their rights and obligations.

• IP register and assignment agreements
• Innovation tools and methods catalogue
• Time-allocation policy (e.g., 10% innovation time)

• Competence requirements for innovation roles not defined
• Knowledge from past projects not captured or reused
• Strategic intelligence siloed in one team

Requires internal and external communication to build awareness and trust in the whistleblowing system.

• IP register and assignment agreements
• Time-allocation policy (e.g., 10% innovation time)
• Knowledge repository / lessons learned database
• Communication plan (internal/external)

• Partnership agreements lack IP and confidentiality clauses
• Time allocation for innovation crowded out by BAU
• IP register incomplete, ownership disputes likely
• Competence requirements for innovation roles not defined
• Innovation budget not ring-fenced from operating budget

Requires creating, updating, and controlling documented information for the whistleblowing management system.

• Communication plan (internal/external)
• Knowledge repository / lessons learned database
• Partnership and collaboration agreements
• Innovation tools and methods catalogue

• Partnership agreements lack IP and confidentiality clauses
• IP register incomplete, ownership disputes likely
• Innovation budget not ring-fenced from operating budget

Requires establishing accessible and secure channels for receiving reports of wrongdoing from whistleblowers.

• Inventory of intake channels covering hotline, web form, email, postal, in person and external regulator routes
• Anonymous reporting option with secure two way communication where law permits
• Acknowledgement to reporter within seven days as expected by EU Directive 2019/1937
• Triage record capturing receipt, channel, reporter category and initial classification
• Confidentiality undertaking signed by all handlers

• Anonymous channel removed by vendor change without notice
• Acknowledgement window slips past statutory expectations
• Receipt logged with reporter identity in non confidential systems such as helpdesk tickets

Requires a systematic process for assessing received reports including initial triage and determination of actions.

• Documented assessment procedure with criteria for accepting, redirecting or closing reports
• Conflict of interest screening before assignment
• Risk based prioritisation criteria covering harm severity, urgency, regulatory exposure and protection needs
• Assessment outcome record with rationale and decision maker
• Reporter feedback at the assessment outcome stage where appropriate

• Reports closed at triage as out of scope without rationale documented
• Assignment decisions made without conflict screening
• Urgent protection needs not surfaced during triage

Requires investigation of substantiated reports and implementation of corrective and preventive actions.

• Investigation plan tailored to the report including objectives, scope, evidence sources, interviewees and timeline
• Evidence chain of custody log
• Interview records with consent and confidentiality notices
• Independence statement from investigator and any external counsel
• Periodic update to reporter and subject as appropriate within confidentiality limits
• Quality review of investigation by a second qualified reviewer

• Investigations conducted by line manager of the subject
• No quality review so flawed conclusions reach decision makers
• Subjects denied procedural fairness creating legal exposure

Requires formal closure of cases with documented outcomes, feedback to whistleblowers, and lessons learned.

• Final report with findings, evidence basis, conclusions and recommended actions
• Decision record by an authorised body covering disciplinary, control and remediation outcomes
• Feedback to reporter on outcome at the level permitted by confidentiality and law
• Notification to regulators or law enforcement where required
• Lessons learned register feeding control improvements
• Closure record with reporter protection follow up scheduled

• Reporter never informed of outcome
• Conclusions reached without referenced evidence
• Lessons learned not fed into control owners so the same issue recurs

Requires protecting whistleblowers from retaliation and providing support throughout and after the process.

• Protection plan from the moment of receipt covering identity protection, employment protection and welfare support
• Retaliation risk assessment refreshed at intake, during investigation and after closure
• Burden of proof reversal procedure aligned to EU Directive 2019/1937 Article 21
• Anti retaliation training for managers of areas where reporters work
• Support services such as employee assistance, occupational health and external counsel access
• Retaliation incident handling procedure with separate investigation track

• Protection focuses only on identity confidentiality and ignores employment outcomes such as performance ratings
• No mechanism to reverse the burden of proof in alleged retaliation
• Post closure check ins not scheduled so late retaliation goes unnoticed

Requires monitoring and measuring the effectiveness of the whistleblowing management system.

• Audit nonconformity log
• Measurement and evaluation procedure
• Benchmarking study results

• Management reviews skip innovation as an agenda item
• Internal audits of IMS not scheduled
• Customer feedback not systematically captured

Requires conducting internal audits at planned intervals to verify conformance and effectiveness.

• Audit nonconformity log
• Benchmarking study results
• Customer and partner feedback summary

• Benchmarking against peers absent
• KPIs measure activity (idea count) not outcomes (revenue, adoption)
• Evaluation criteria differ across portfolio without rationale
• Lagging indicators only, no leading indicators

Requires top management to review the whistleblowing management system for continuing suitability and effectiveness.

• Innovation analytics report
• Innovation KPI dashboard
• Audit nonconformity log
• Benchmarking study results

• Lagging indicators only, no leading indicators
• Management reviews skip innovation as an agenda item
• Customer feedback not systematically captured
• Internal audits of IMS not scheduled

Determine internal and external context affecting whistleblowing risk and the management system's ability to function.

• Context analysis document
• Jurisdictional whistleblowing law register
• Cultural readiness assessment
• Operating model overview

• Country-specific legal differences ignored
• No cultural readiness assessment
• External reporting routes unmapped

Identify whistleblowers, recipients, investigators, regulators, and other interested parties and their requirements.

• Stakeholder register
• Regulator expectations log
• Whistleblower needs analysis
• Communication plan

• Contractor and supplier whistleblowers omitted
• Regulator notification timelines unknown
• No external stakeholder engagement

Determine the boundaries and applicability of the whistleblowing management system across the organization.

• Documented scope
• Subsidiary and JV inclusion list
• Exclusion rationale
• Scope review schedule

• JVs and contractors excluded
• Scope not aligned with EU directive
• No periodic review

Continually improve the suitability, adequacy, and effectiveness of the WBMS based on monitoring and reviews.

• Continual improvement register
• Trend-driven actions
• Best practice adoption
• Improvement KPIs

• Improvements ad hoc
• No trend-driven changes
• No innovation tracking

Identify nonconformities, conduct root cause analysis, and implement corrective actions with verified effectiveness.

• NC register
• RCA records
• Corrective action plans
• Effectiveness verification

• Symptom-only fixes
• No RCA
• Effectiveness not verified

Top management and governing body demonstrate leadership and commitment to the whistleblowing management system.

• Board minutes referencing WBMS
• CEO communications
• Resource allocation
• Management performance objectives

• Leadership silent on whistleblowing
• Insufficient resources
• No board reporting

Establish and communicate a whistleblowing policy that encourages reporting, protects whistleblowers, and prohibits retaliation.

• Whistleblowing policy
• Multi-language versions
• Acknowledgement records
• Public website posting

• Policy too legalistic
• No translation
• Acknowledgements not tracked

Assign and communicate responsibilities and authorities for the whistleblowing management system including independence.

• WBMS roles matrix
• Function charter
• Independence safeguards
• Authority documentation

• Roles informal
• Independence undermined by reporting line
• Authorities insufficient

Provide accessible reporting channels with options for anonymity and confidentiality across multiple media and languages.

• Hotline and web portal
• Multi-language support
• Anonymity safeguards
• Channel availability metrics

• One channel only
• No anonymous option
• Languages limited

Assess reports promptly to determine credibility, scope, urgency, and appropriate handling pathway.

• Triage procedure
• Assessment template
• Severity matrix
• Triage decisions log

• No triage criteria
• Inconsistent severity
• Triage by untrained staff

Address reports through investigation, mediation, or other appropriate action with documented findings and corrective measures.

• Investigation procedure
• Case files
• Closure reports
• Corrective action records

• Investigations led by conflicted persons
• No closure
• Corrective actions not tracked

Conclude cases with appropriate outcomes, communication to the whistleblower, and lessons learned capture.

• Outcome decision records
• Whistleblower closure letters
• Lessons learned register
• Trend analysis

• Whistleblower never informed of outcome
• No lessons capture
• Cases linger open

Protect whistleblowers and others involved from retaliation and other detrimental treatment through active monitoring.

• Anti-retaliation policy
• Retaliation monitoring procedure
• Remediation records
• Manager training on non-retaliation

• No active monitoring
• Subtle retaliation missed
• No remediation

Protect the identity of whistleblowers and personal data throughout the case lifecycle in line with applicable law.

• Confidentiality procedure
• Data protection impact assessment
• Privacy notice for whistleblowers
• Breach response plan

• Identity revealed in investigation
• No DPIA
• Breach response missing

Monitor and measure the WBMS for effectiveness including case throughput, outcomes, and whistleblower experience.

• WBMS KPI dashboard
• Whistleblower satisfaction survey
• Trend reports
• Benchmarking data

• Volume metrics only
• No experience measurement
• No trend analysis

Conduct internal audits at planned intervals to evaluate WBMS conformity and effective implementation.

• Audit charter
• Risk-based audit plan
• Audit reports
• Findings tracker

• Audit lacks WB expertise
• Findings not closed
• No follow-up audits

Top management reviews WBMS at planned intervals to ensure suitability, adequacy, and effectiveness.

• Review agenda
• Review pack
• Minutes
• Action tracker

• Review descriptive only
• No challenge
• Actions not tracked

Assess risks and opportunities related to whistleblowing including risks to whistleblowers and the management system.

• Risk assessment
• Retaliation risk analysis
• Confidentiality risk register
• Mitigation plans

• Retaliation risk not assessed
• No confidentiality threat modelling
• Risks not tracked

Establish measurable whistleblowing objectives consistent with the policy and plan how to achieve them.

• Documented objectives
• KPI dashboard
• Resource plan
• Progress reviews

• No objectives
• Objectives qualitative only
• No progress tracking

Ensure receivers, investigators, and decision makers have the competence to perform whistleblowing roles effectively.

• Competency profiles
• Training records
• Investigator certifications
• Periodic assessments

• Untrained receivers
• No interviewer training
• Bias awareness missing

Make personnel and relevant parties aware of the whistleblowing policy, channels, and their protections.

• Awareness plan
• Posters and intranet content
• Onboarding inclusion
• Awareness survey results

• Awareness one-off at onboarding
• No measurement
• External parties unaware

Determine internal and external communications relevant to the whistleblowing management system including with whistleblowers.

• Communication plan
• Status update templates
• Regulator notification protocol
• Communication log

• Whistleblowers not updated
• No regulator protocol
• External comms ad hoc

Maintain documented information with strict confidentiality, retention, and access controls appropriate to sensitivity.

• Case management system
• Access control logs
• Retention schedule
• Encryption standards

• Shared drives used
• Excessive access
• No retention enforcement