Quick Read
Clause 8.3 of ISO 37301 requires a process that encourages and enables people to report attempted, suspected or actual breaches of the compliance policy or compliance obligations, with reports treated confidentially, anonymous reports accepted and reporters protected from retaliation. Clause 8.4 requires processes to assess, investigate and close those reports with fair and impartial decision-making, carried out independently and without conflict of interest by competent people. Most organisations already operate a hotline and some form of investigation. The gap is usually not existence but trust, independence and learning: channels nobody uses in the places that matter, investigations run by people with a stake in the outcome, and findings that close a case without ever changing the system. This paper builds on Speeki’s ISO 37002 work to set out what an auditor expects across a broad ISO 37301 scope.
Executive Summary
The speak-up channel is the most important detective control in any compliance management system. Controls fail, monitoring misses things, and auditors sample. People see what actually happens. Whether they say so, and whether anything changes when they do, is one of the clearest tests of whether a compliance system is real.
ISO 37301 addresses this in two linked clauses. Clause 8.3 requires a process for raising concerns that encourages and enables reporting, is visible and accessible, treats reports confidentially, accepts anonymous reports, protects those making reports from retaliation and enables personnel to receive advice; it covers reports made where there are reasonable grounds to believe the information is true. Clause 8.4 requires processes to assess, evaluate, investigate and close reports of suspected or actual non-compliance, ensuring fair and impartial decision-making and carried out independently and without conflict of interest by competent personnel, with outcomes used to improve the system, the numbers and outcomes of investigations reported regularly to the governing body or top management, and documented information retained.
Organisations certified to ISO 37001 already operate both processes for bribery concerns. Under ISO 37301 the same channel and process must handle every in-scope domain — sanctions, data protection, competition, safety compliance, conduct rules. That widens the range of reports, the range of competence needed to investigate them and the range of stakeholders who must be told. ISO 37002:2021 provides detailed guidance on whistleblowing management systems and is the natural companion to these clauses.
This paper sets out what the clauses require, how to design a channel that people trust, how to run investigations that withstand scrutiny, how to turn reports into system improvement, and what Speeki’s auditors test.
CORE ARGUMENT A speak-up channel is measured by whether the right people use it in the right places, and an investigation process is measured by whether the system is different afterwards. A hotline with no reports from your highest-risk market, and investigations that end with a disciplinary letter and nothing else, both fail the standard’s intent. |
1. What the Standard Requires
Clause | Requirement in substance | Key tests |
|---|---|---|
8.3 Raising concerns | Establish a process to encourage and enable reporting of attempted, suspected or actual breaches of the compliance policy or obligations; visible and accessible; reports treated confidentially; anonymous reports accepted; protection from retaliation; personnel able to receive advice; all personnel aware of the procedures, their rights and protections | Trust, accessibility, protection, use |
8.4 Investigation processes | Processes to assess, evaluate, investigate and close reports, ensuring fair and impartial decision-making; carried out independently, without conflict of interest, by competent personnel; outcomes used to improve the CMS; numbers and outcomes reported regularly to the governing body or top management; documented information retained | Independence, competence, conflict management, closure, reporting |
5.1.2 Compliance culture | Develop, maintain and promote a compliance culture at all levels; Annex A.5.1.2 treats personnel being enabled and encouraged to raise concerns as evidence of that culture | Culture evidence, not policy statements |
9.1.2 Sources of feedback | Use multiple sources of feedback on compliance performance | Speak-up data feeds performance evaluation |
5.1.1, 5.2, 5.3.3 and 7.3 Supporting requirements | Leadership ensures a system for raising and addressing concerns exists; the policy encourages raising concerns and prohibits retaliation; managers encourage reporting and preclude retaliation; personnel are aware of how to raise concerns | The channel is embedded across the standard, not only in Clause 8 |
9.3.2 Management review inputs | Review takes into account communication from persons raising concerns and investigations | Leadership sees speak-up and investigation themes |
10.2 Nonconformity and corrective action | React to nonconformity, determine causes, take corrective action and verify effectiveness | Investigations drive system change |
1.1 One channel, one process
The first design decision is integration. Organisations sometimes build separate channels for different domains — an ethics hotline, a data breach mailbox, a safety reporting system, a sanctions escalation route. Some separation is legitimate where regulation requires a specific mechanism. But a reporter should not have to decide which channel their concern belongs in, and the compliance function needs one view of everything reported. The strongest structure is a single front door with domain-based triage behind it.
2. What Carries Over from ISO 37001
Two other standards sit directly beside this paper. ISO 37001 already requires a reporting channel and an investigation process for bribery, and ISO 37002 provides detailed guidance on whistleblowing management systems. ISO 37301 widens the channel to any compliance concern in scope.
Source | Requirement or guidance | What ISO 37301 adds |
|---|---|---|
ISO 37001 (8.9) | Raising concerns about bribery, with confidentiality and protection from retaliation | Channel must accept concerns across every obligation domain in scope. |
ISO 37001 (8.10) | Investigating and dealing with bribery | Investigation competence must extend to other domains; outcomes must feed the CMS. |
ISO 37002 | Guidance on trust, impartiality and protection, and on receiving, assessing, addressing and concluding reports | Not certifiable on its own as a requirement standard; ISO 37301 provides the certifiable requirement for the channel within a CMS. |
ISO 37301 (8.3, 8.4, 9.3.2) | Raising concerns, investigation processes, reporting outcomes to leadership | One integrated process, measured and reported as part of compliance performance. |
3. Designing a Channel People Trust
ISO 37002 is built on three principles — trust, impartiality and protection — which Speeki’s earlier ISO 37002 whitepaper applied to speak-up programmes. They apply equally under ISO 37301.
3.1 Accessibility
Element | Good practice | Common gap |
|---|---|---|
Channels | Multiple routes: web, phone, app, in person, managers, compliance function directly | Single channel, often web-only |
Languages | Every language in which in-scope personnel work | Head-office language only |
Availability | Continuous; works for shift and field workers | Office hours; requires corporate network access |
Reach | Open to employees, contractors, suppliers, customers and other third parties where relevant | Employees only |
Visibility | Promoted repeatedly in context — onboarding, training, intranet, sites, supplier communications | Mentioned once in the code of conduct |
3.2 Confidentiality and anonymity
Clause 8.3 requires reports to be treated confidentially and anonymous reports to be accepted — both, not either. Anonymous channels must allow two-way communication, so that investigators can ask follow-up questions without learning the reporter’s identity. Confidentiality must be protected in practice: access to case records restricted, identities not disclosed to the subjects of reports, and case management systems configured so that managers cannot browse cases in their own areas.
3.3 Protection from retaliation
Protection is where most channels lose trust. A policy prohibiting retaliation is necessary but not sufficient. Effective systems actively monitor what happens to reporters after they report — performance ratings, promotion, role changes, exits — and treat retaliation as a serious breach in its own right. In many jurisdictions whistleblower protection is now a legal obligation, and it belongs in the obligations register.
THE SILENCE SIGNAL Zero reports is not good news. A large operation in a high-risk market that generates no concerns over a year is telling you that people do not know the channel exists, do not trust it, or fear the consequences. Speeki’s auditors treat unexplained silence as an indicator to investigate, not a success to report. |
3.4 Triage across domains
A broad ISO 37301 scope means reports range from minor HR grievances to potential criminal sanctions breaches. Triage must be fast and consistent.
Triage step | Purpose |
|---|---|
Acknowledge within a defined time | Reporter knows the concern was received |
Classify by domain and obligation | Link the report to the obligations register; route to competent investigators |
Assess severity and urgency | Identify potential legal reporting deadlines, evidence at risk, ongoing harm, involvement of senior management |
Check conflicts | Exclude anyone connected with the subject matter from handling the case |
Decide pathway | Full investigation, proportionate review, referral to another process, or closure with reasons |
4. Running Investigations That Withstand Scrutiny
4.1 Impartiality and independence
Clause 8.4 requires fair and impartial decision-making, and requires investigations to be carried out independently and without conflict of interests by competent personnel. In practice that means the investigator must not be in the line management of the subject, must have no stake in the outcome, and must be free to follow the evidence. Where the concern involves senior management, independence usually requires the investigation to be overseen by the governing body or a committee, and often conducted by an external party. Annex A.8.4 suggests organisations consider independent committees to oversee investigations where appropriate, to guarantee their completeness and independence, and notes that even where reporting to regulators is not legally required, voluntary self-disclosure can mitigate the consequences of non-compliance.
Who is implicated | Who should oversee | Who should investigate |
|---|---|---|
Staff below management level | Compliance function | Trained internal investigator outside the reporting line |
Middle management | Compliance function, with escalation route | Internal investigator or specialist; external where conflicts exist |
Top management | Board committee | Independent external investigator reporting to the committee |
Compliance function itself | Board committee | External investigator |
4.2 Competence across domains
An investigator experienced in fraud may not be equipped to assess whether a data transfer breached data protection law or whether a shipment breached export controls. The investigation process should define how subject-matter expertise is brought in, internally or externally, for each in-scope domain, and Clause 7.2 competence requirements apply to investigators as much as to anyone else.
4.3 The investigation lifecycle
Scope and plan. Define the allegations, the obligations engaged, the questions to answer, the evidence needed and the timetable.
Preserve evidence. Secure documents, systems data and devices before notifying subjects where appropriate.
Gather evidence. Document review, data analysis and interviews, following a fair process for the subject.
Assess. Reach findings on the balance of the evidence against each allegation.
Determine root causes. Ask not only who did what, but why the system allowed it — which control failed or was missing. Annex A.8.4 expects root-cause analysis to address the extent and pervasiveness of the non-compliance, the number and level of people involved, its seriousness, duration and frequency, and any accountability lapses, including among managers, top management and the governing body.
Report. Document findings, causes and recommendations to the appropriate level, including the governing body where criteria are met.
Close and feed back. Close the case with reasons, tell the reporter what can be shared, and hand system findings to corrective action.
4.4 External reporting obligations
Some breaches trigger obligations to notify a regulator, a data protection authority, a licensing body or a customer within strict timeframes. These deadlines are compliance obligations in their own right and must be in the register, with the investigation process designed to identify them at triage rather than discovering them at closure.
5. From Case Closure to System Change
The difference between an investigation process and a compliance management system is what happens after the case closes. Each substantiated breach is evidence that a control failed or was missing. Under Clause 10.2, that is a nonconformity requiring root-cause analysis and corrective action, with effectiveness verified.
Investigation outcome | System question | Where it goes |
|---|---|---|
Breach substantiated, control bypassed | Why was bypass possible? Is the control designed adequately? | Control redesign (8.2); corrective action (10.2) |
Breach substantiated, no control existed | Was the risk assessed? Was the obligation known? | Obligations register (4.5); risk assessment (4.6) |
Breach substantiated, person unaware of obligation | Was training risk-based and role-specific? | Competence and awareness (7.2, 7.3) |
Not substantiated, but weakness found | Is there a near miss to learn from? | Opportunity for improvement (10.1) |
Pattern across cases | Is there a systemic or cultural cause? | Management review (9.3); culture assessment (5.1) |
5.1 Indicators for raising concerns and investigations
Indicator | What it tells you |
|---|---|
Reports per 100 personnel, by unit and country | Where the channel is trusted and where it is silent |
Proportion anonymous | Level of trust in confidentiality and protection |
Substantiation rate | Quality of reports and of triage |
Time to acknowledge, triage and close | Responsiveness; whether reporters are left waiting |
Retaliation concerns raised and substantiated | Whether protection works |
Corrective actions arising and verified effective | Whether investigations change the system |
Repeat issues by domain or unit | Whether corrective actions address root causes |
COMMON FINDING An organisation investigates a substantiated breach of a data transfer restriction, disciplines the employee and closes the case. Six months later the same breach recurs in another team. No root-cause analysis was performed; the system that allowed the transfer was never changed. The investigation was closed; the nonconformity was not. |
6. Implementation Roadmap
Horizon | Actions |
|---|---|
First 30 days | Confirm the channel accepts all compliance concerns, not only ethics or bribery; check access in every language and location in scope; review the anti-retaliation policy. |
60 days | Introduce a triage matrix by domain and severity; agree investigator pools with documented competence and conflict checks; define timelines. |
90 days | Start reporting case volumes, timeliness, outcomes and root causes to top management and the governing body; test the channel with a mystery report. |
12 months | Run a speak-up culture survey; analyse trends by domain and location; demonstrate at least one system change driven by investigation findings. |
7. Common Failures
Failure | Why it matters | What a trusted process does instead |
|---|---|---|
Channel branded as an ethics or bribery hotline | Employees with safety, privacy or regulatory concerns assume it is not for them. | Communicates that any compliance concern can be raised, with examples. |
Investigations run by the reporter’s own management line | Impartiality is compromised and retaliation risk increases. | Assigns investigators independent of the matter, with recorded conflict checks. |
Cases closed without root cause | The individual matter is resolved; the control failure remains. | Records root cause and routes systemic findings into nonconformity management. |
Low report volumes read as good news | Silence usually signals distrust, not compliance. | Benchmarks volumes, checks anonymity rates and tests trust through surveys. |
Retaliation monitoring stops at case closure | Retaliation often appears months later in appraisal, promotion or redundancy decisions. | Monitors the reporter’s employment outcomes for a defined period after closure. |
8. What Speeki’s Auditors Test
8.1 The channel
Accessibility: auditors test the channel themselves — in different languages, from outside the corporate network, as a third party.
Awareness: interviews across levels and locations ask whether people know how to raise a concern and whether they would.
Distribution of reports against the risk profile, with explanations for silence in high-risk areas.
Evidence of retaliation monitoring.
8.2 Investigations
A selection of closed cases across domains, followed from intake to closure: triage, conflict checks, investigator independence and competence, evidence, findings, reporting and feedback.
Cases involving management: how independence was secured and how the governing body was informed.
Timeliness against defined service levels and external reporting deadlines.
Linkage from substantiated cases to root-cause analysis, corrective action and verification of effectiveness.
Where case management data is electronic, Speeki reviews the full case population rather than a sample, looking for patterns — ageing cases, clusters by unit, repeat subjects, cases closed without reasons — that sample testing would miss.
Finding pattern | Typical grading |
|---|---|
No anonymous or confidential reporting option | Major nonconformity |
Investigations of management conducted within the reporting line | Major nonconformity |
No conflict-of-interest check before assigning investigators | Minor nonconformity |
Substantiated breaches closed without root-cause analysis or corrective action | Minor nonconformity |
Channel inaccessible to significant in-scope populations | Minor nonconformity |
Grading is illustrative and depends on the evidence and its effect on the system.
Conclusion
Raising concerns and investigation are where a compliance management system meets reality. Every other control is designed in advance; these two respond to what actually happened. ISO 37301 asks that the channel be trusted and used, that investigations be impartial and competent, and that what they find changes the system.
Organisations already certified to ISO 37001, or that have built their speak-up system around ISO 37002, have most of what they need. The task under ISO 37301 is to widen the channel’s reach across every domain in scope, bring the right expertise to each investigation, and close the loop from case to corrective action every time.
About Speeki
Speeki is an accredited certification body operating across more than 100 countries, providing ISO management system certification, ESG and sustainability assurance, and executive education. Speeki provides no consulting of any kind. Our independence is structural, not a promise.
Speeki delivers its audits through AI working alongside a body of experts. Nicole, Speeki’s AI team member, works with our auditors to test full populations of evidence rather than samples, so that certification reflects how a management system actually performs, not how it looks on the day of the audit.
To learn more, see ISO 37301 certification with Speeki.
Related Reading
This whitepaper provides general information on ISO 37301:2021 and does not reproduce the text of the standard. Organisations should refer to the published standard for its exact requirements.