ISO 37002:2021 - Whistleblowing Management Systems

International (ISO)

v2021

14 domains

47 controls

ISO 37002:2021 provides guidelines for establishing, implementing, maintaining, and improving a whistleblowing management system. It covers receiving, assessing, and addressing reports of wrongdoing. Based on four principles: trust, impartiality, protection, and accessibility. Applicable to all organisations regardless of type, size, or sector. Supports compliance with whistleblowing legislation including the EU Whistleblowing Directive, US SOX, and Dodd-Frank. Complementary to ISO 37001 (anti-bribery) and ISO 37301 (compliance).

Unverified

ISO 37002:2021 - Whistleblowing Management Systems is a compliance framework from International (ISO) with 14 domains and 47 controls that map to 21 other frameworks. The largest domains are Operation (6 controls), Clause 7: Support (5 controls), Clause 8: Operation - Whistleblowing Process (5 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (14)

Clause 10: Improvement

2 controls

Controls in the Clause 10: Improvement domain of ISO 37002:2021 - Whistleblowing Management Systems — 2 controls
Code	Title	Description
ISO-37002-10.1	Nonconformity and corrective action	Requires reacting to nonconformities, determining causes, implementing corrective actions, and reviewing effectiveness.
ISO-37002-10.2	Continual improvement	Requires continual improvement of the suitability, adequacy, and effectiveness of the whistleblowing management system.

Clause 4: Context of the Organization

4 controls

Controls in the Clause 4: Context of the Organization domain of ISO 37002:2021 - Whistleblowing Management Systems — 4 controls
Code	Title	Description
ISO-37002-4.1	Understanding the organization and its context	Requires determining external and internal issues relevant to the purpose of the whistleblowing management system.
ISO-37002-4.2	Understanding the needs and expectations of interested parties	Requires identifying interested parties and their requirements relevant to the whistleblowing management system.
ISO-37002-4.3	Determining the scope of the whistleblowing management system	Requires determining the boundaries and applicability of the whistleblowing management system.
ISO-37002-4.4	Whistleblowing management system	Requires establishing, implementing, maintaining, and continually improving the whistleblowing management system.

Clause 5: Leadership

3 controls

Controls in the Clause 5: Leadership domain of ISO 37002:2021 - Whistleblowing Management Systems — 3 controls
Code	Title	Description
ISO-37002-5.1	Leadership and commitment	Requires top management to demonstrate leadership and commitment by promoting a speak-up/listen-up culture.
ISO-37002-5.2	Whistleblowing policy	Requires establishment of a whistleblowing policy that promotes a speak-up/listen-up culture and provides protection.
ISO-37002-5.3	Organizational roles, responsibilities and authorities	Requires assignment and communication of roles and responsibilities for the whistleblowing management system.

Clause 6: Planning

2 controls

Controls in the Clause 6: Planning domain of ISO 37002:2021 - Whistleblowing Management Systems — 2 controls
Code	Title	Description
ISO-37002-6.1	Actions to address risks and opportunities	Requires identifying risks and opportunities related to the whistleblowing management system and planning actions to add...
ISO-37002-6.2	Whistleblowing management system objectives and planning	Requires establishing measurable objectives for the whistleblowing management system with plans to achieve them.

Clause 7: Support

5 controls

Controls in the Clause 7: Support domain of ISO 37002:2021 - Whistleblowing Management Systems — 5 controls
Code	Title	Description
ISO-37002-7.1	Resources	Requires providing resources needed for establishment, implementation, maintenance, and improvement of the system.
ISO-37002-7.2	Competence	Requires ensuring persons performing whistleblowing-related functions have the necessary competence.
ISO-37002-7.3	Awareness and training	Requires ensuring all personnel are aware of the whistleblowing policy and their rights and obligations.
ISO-37002-7.4	Communication	Requires internal and external communication to build awareness and trust in the whistleblowing system.
ISO-37002-7.5	Documented information	Requires creating, updating, and controlling documented information for the whistleblowing management system.

Clause 8: Operation - Whistleblowing Process

5 controls

Controls in the Clause 8: Operation - Whistleblowing Process domain of ISO 37002:2021 - Whistleblowing Management Systems — 5 controls
Code	Title	Description
ISO-37002-8.1	Receiving reports of wrongdoing	Requires establishing accessible and secure channels for receiving reports of wrongdoing from whistleblowers.
ISO-37002-8.2	Assessing reports of wrongdoing	Requires a systematic process for assessing received reports including initial triage and determination of actions.
ISO-37002-8.3	Addressing reports of wrongdoing	Requires investigation of substantiated reports and implementation of corrective and preventive actions.
ISO-37002-8.4	Concluding whistleblowing cases	Requires formal closure of cases with documented outcomes, feedback to whistleblowers, and lessons learned.
ISO-37002-8.5	Protection of whistleblowers	Requires protecting whistleblowers from retaliation and providing support throughout and after the process.

Clause 9: Performance Evaluation

3 controls

Controls in the Clause 9: Performance Evaluation domain of ISO 37002:2021 - Whistleblowing Management Systems — 3 controls
Code	Title	Description
ISO-37002-9.1	Monitoring, measurement, analysis and evaluation	Requires monitoring and measuring the effectiveness of the whistleblowing management system.
ISO-37002-9.2	Internal audit	Requires conducting internal audits at planned intervals to verify conformance and effectiveness.
ISO-37002-9.3	Management review	Requires top management to review the whistleblowing management system for continuing suitability and effectiveness.

Context

3 controls

Controls in the Context domain of ISO 37002:2021 - Whistleblowing Management Systems — 3 controls
Code	Title	Description
ISO37002-4.1	Organizational Context for Whistleblowing	Determine internal and external context affecting whistleblowing risk and the management system's ability to function.
ISO37002-4.2	Needs and Expectations of Interested Parties	Identify whistleblowers, recipients, investigators, regulators, and other interested parties and their requirements.
ISO37002-4.3	Scope of the WBMS	Determine the boundaries and applicability of the whistleblowing management system across the organization.

Improvement

2 controls

Controls in the Improvement domain of ISO 37002:2021 - Whistleblowing Management Systems — 2 controls
Code	Title	Description
ISO37002-10.1	Continual Improvement	Continually improve the suitability, adequacy, and effectiveness of the WBMS based on monitoring and reviews.
ISO37002-10.2	Nonconformity and Corrective Action	Identify nonconformities, conduct root cause analysis, and implement corrective actions with verified effectiveness.

Leadership

3 controls

Controls in the Leadership domain of ISO 37002:2021 - Whistleblowing Management Systems — 3 controls
Code	Title	Description
ISO37002-5.1	Leadership and Commitment	Top management and governing body demonstrate leadership and commitment to the whistleblowing management system.
ISO37002-5.2	Whistleblowing Policy	Establish and communicate a whistleblowing policy that encourages reporting, protects whistleblowers, and prohibits reta...
ISO37002-5.3	Roles, Responsibilities, Authorities	Assign and communicate responsibilities and authorities for the whistleblowing management system including independence.

Operation

6 controls

Controls in the Operation domain of ISO 37002:2021 - Whistleblowing Management Systems — 6 controls
Code	Title	Description
ISO37002-8.2	Receiving Reports of Wrongdoing	Provide accessible reporting channels with options for anonymity and confidentiality across multiple media and languages...
ISO37002-8.3	Assessing Reports	Assess reports promptly to determine credibility, scope, urgency, and appropriate handling pathway.
ISO37002-8.4	Addressing Reports of Wrongdoing	Address reports through investigation, mediation, or other appropriate action with documented findings and corrective me...
ISO37002-8.5	Concluding Whistleblowing Cases	Conclude cases with appropriate outcomes, communication to the whistleblower, and lessons learned capture.
ISO37002-8.6	Protection Against Detriment	Protect whistleblowers and others involved from retaliation and other detrimental treatment through active monitoring.
ISO37002-8.7	Confidentiality and Data Protection	Protect the identity of whistleblowers and personal data throughout the case lifecycle in line with applicable law.

Performance

3 controls

Controls in the Performance domain of ISO 37002:2021 - Whistleblowing Management Systems — 3 controls
Code	Title	Description
ISO37002-9.1	Monitoring, Measurement, Analysis, Evaluation	Monitor and measure the WBMS for effectiveness including case throughput, outcomes, and whistleblower experience.
ISO37002-9.2	Internal Audit	Conduct internal audits at planned intervals to evaluate WBMS conformity and effective implementation.
ISO37002-9.3	Management Review	Top management reviews WBMS at planned intervals to ensure suitability, adequacy, and effectiveness.

Planning

2 controls

Controls in the Planning domain of ISO 37002:2021 - Whistleblowing Management Systems — 2 controls
Code	Title	Description
ISO37002-6.1.2	Whistleblowing Risk Assessment	Assess risks and opportunities related to whistleblowing including risks to whistleblowers and the management system.
ISO37002-6.2	Whistleblowing Objectives	Establish measurable whistleblowing objectives consistent with the policy and plan how to achieve them.

Support

4 controls

Controls in the Support domain of ISO 37002:2021 - Whistleblowing Management Systems — 4 controls
Code	Title	Description
ISO37002-7.2	Competence	Ensure receivers, investigators, and decision makers have the competence to perform whistleblowing roles effectively.
ISO37002-7.3	Awareness	Make personnel and relevant parties aware of the whistleblowing policy, channels, and their protections.
ISO37002-7.4	Communication	Determine internal and external communications relevant to the whistleblowing management system including with whistlebl...
ISO37002-7.5	Documented Information	Maintain documented information with strict confidentiality, retention, and access controls appropriate to sensitivity.

Your Compliance Coverage

If you comply with ISO 37002:2021 - Whistleblowing Management Systems, you already cover:

ISO 22301:2019

45%

21 controls mapped

Compare →

ISO 45001:2018

43%

20 controls mapped

Compare →

ISO 22000:2018

43%

20 controls mapped

Compare →

+ 18 more: ISO 37301:2021 (43%), ISO 27701:2019 (43%)

See all 21 mapped frameworks ↓

Maps to 21 other frameworks

47 total controls

ISO 22301:2019

21 source controls mapped|12 target controls covered

45%

ISO 45001:2018

20 source controls mapped|13 target controls covered

43%

ISO 22000:2018

20 source controls mapped|13 target controls covered

43%

ISO 37301:2021

20 source controls mapped|14 target controls covered

43%

ISO 27701:2019

20 source controls mapped|11 target controls covered

43%

ISO 14001:2015

20 source controls mapped|12 target controls covered

43%

ISO 9001:2015

20 source controls mapped|13 target controls covered

43%

ISO 37001:2016

20 source controls mapped|11 target controls covered

43%

ISO 55001:2014

17 source controls mapped|9 target controls covered

36%

ISO 50001:2018 - Energy Management Systems

16 source controls mapped|9 target controls covered

34%

ISO 14004:2016

16 source controls mapped|9 target controls covered

34%

ISO 27005:2022

10 source controls mapped|7 target controls covered

21%

ISO/IEC 23894:2023

9 source controls mapped|11 target controls covered

19%

ISO 31000:2018

8 source controls mapped|5 target controls covered

17%

ISO 10006:2003

4 source controls mapped|2 target controls covered

ISO 13485:2016

4 source controls mapped|2 target controls covered

Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law

3 source controls mapped|3 target controls covered

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration

2 source controls mapped|2 target controls covered

ISO/IEC 42001:2023

2 source controls mapped|1 target controls covered

ISO 10007:2017

2 source controls mapped|1 target controls covered

ISO 19011

1 source controls mapped|1 target controls covered

Compare ISO 37002:2021 - Whistleblowing Management Systems with ISO 22301:2019

What is ISO 37002:2021 - Whistleblowing Management Systems and who does it apply to?

ISO 37002:2021 - Whistleblowing Management Systems is a compliance framework from International (ISO) with 14 domains and 47 controls. ISO 37002:2021 provides guidelines for establishing, implementing, maintaining, and improving a whistleblowing management system. It covers receiving, assessing, and addressing reports of wrongdoing. Based on four principles: trust, impartiality, protection, and accessibility. Applicable to all organisations regardless of type, size, or sector. Supports compliance with whistleblowing legislation including the EU Whistleblowing Directive, US SOX, and Dodd-Frank. Complementary to ISO 37001 (anti-bribery) and ISO 37301 (compliance). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO 37002:2021 - Whistleblowing Management Systems actually require?

ISO 37002:2021 - Whistleblowing Management Systems has 47 controls organised across 14 domains. The largest domains are Operation (6 controls), Clause 7: Support (5 controls), Clause 8: Operation - Whistleblowing Process (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO 37002:2021 - Whistleblowing Management Systems do I already cover?

ISO 37002:2021 - Whistleblowing Management Systems maps to 21 other compliance frameworks. The top mapping partners are ISO 22301:2019 (45% coverage), ISO 45001:2018 (43% coverage), ISO 22000:2018 (43% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement ISO 37002:2021 - Whistleblowing Management Systems?

Start your ISO 37002:2021 - Whistleblowing Management Systems compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 37002:2021 - Whistleblowing Management Systems requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 47 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required