ISO 37003:2025

ISO 37003:2025 gives guidance for developing, implementing and maintaining a fraud control management system (FCMS) covering internal and external fraud against the organization, fraud in collaboration between insiders and outsiders, and fraud by the organization itself. On the harmonized structure: context and a regular fraud risk assessment conducted with the other risk functions (clause 4); leadership by the governing body and top management, a fraud control policy, delegated decision-making free of conflicts of interest, and the roles of the fraud control, information security and internal audit functions (clause 5); risks, objectives and planned changes (clause 6); resources, competence, the employment process, awareness and training of personnel and business associates, communication and promotion of the FCMS, documented information and confidential record keeping (clause 7); and operation in three blocks: preventing fraud (an integrity framework, conflicts of interest, internal controls and the control environment, pressure testing, performance targets, personnel and business-associate screening, technology-enabled fraud, physical security), detecting fraud (post-transactional review, management accounting analysis, early warning indicators, data analytics, fraud reporting, artificial intelligence systems, complaints, exit interviews) and responding to fraud events (immediate actions, digital evidence, investigation, grievances, discipline, separation of investigation from decision, crisis management, escalation, the fraud event register, analysis and external reporting, recovery, business associates, insurance, post-event control assessment, impact on interested parties, disruption); performance evaluation with internal and external audit and management review, and improvement. Guidance, not certifiable, though certification bodies attest implementation against it; the fraud counterpart of ISO 37001 and the operational elaboration of ISO 37000 6.9. It comprises 78 controls organised across 7 domains, and applies in International.