Quick Read
SPK CSMS1000:2026 requires organisations to operate speak-up channels that are explicitly accessible to all personnel and third parties for sustainability concerns—not just financial misconduct—and to conduct rigorous investigations that demonstrate genuine commitment rather than performative compliance. The effectiveness of these mechanisms depends equally on structural design (confidentiality, independence, accessibility) and organisational culture, particularly visible management response to reported concerns and protection against retaliation. Together, the speak-up channel and investigation process function as an early-warning system that allows organisations to identify and address sustainability failures before they become incidents.
Executive Summary
The speak-up channel and investigation process are the two CSMS elements most directly connected to the organisation's ability to learn about its own sustainability failures before they become incidents. An organisation with a functioning speak-up channel and a rigorous investigation process discovers sustainability problems early, addresses them systematically, and demonstrates to regulators, investors, and stakeholders that its commitment to sustainability is genuine rather than performative.
This paper covers both clauses together because they function as a system: the speak-up channel is the intake mechanism through which sustainability concerns enter the management process; the investigation process is the mechanism through which those concerns — and sustainability incidents identified through other channels — are examined, reported, and acted upon.
An organisation that never receives speak-up reports about sustainability concerns does not have a speak-up culture — it has a silence culture. Personnel know about sustainability problems. If they are not reporting them, they have concluded that reporting is not safe or not useful.
1. The Speak-Up Channel — Clause 10.9
1.1 Structural requirements
The speak-up channel must be: accessible to all personnel and relevant third parties (including supply chain workers and affected communities); confidential — reports can be made without identifying the reporter if the reporter chooses; independent — operated or overseen independently of the management whose activities are being reported; and capable of receiving sustainability-related concerns, not just financial misconduct reports.
Most organisations have speak-up channels for financial misconduct and compliance concerns. Many do not extend these channels explicitly to sustainability concerns, or do not communicate them to supply chain workers and affected communities. SPK CSMS1000:2026 requires the channel to be explicitly available for sustainability-related concerns — environmental incidents, human rights violations, safety concerns, data quality issues, and conduct inconsistent with the sustainability policy — and to be accessible to the stakeholder groups most likely to observe them.
1.2 Cultural requirements
The structural existence of a speak-up channel is necessary but not sufficient. For the channel to function as a sustainability management control, personnel must: know it exists; understand how to use it; believe it is safe to use; and believe that concerns raised will be taken seriously. These are cultural requirements that cannot be created by publishing a hotline number.
The most important cultural enabler of speak-up is visible management response. When a sustainability concern is raised and personnel can observe that it was investigated seriously and acted upon — without adverse consequences for the person who raised it — confidence in the channel builds. When concerns disappear without visible response, or when the person who raised a concern experiences retaliation or marginalisation, the channel stops functioning.
1.3 ISO 37002:2021 alignment
SPK CSMS1000:2026 Clause 10.9 references ISO 37002:2021 — the international standard for whistleblowing management systems. ISO 37002 provides detailed requirements for speak-up channel design, intake procedures, assessment of reports, investigation, and feedback to reporters. For organisations implementing Clause 10.9, ISO 37002 provides the most comprehensive operational guidance available and is directly applicable to the sustainability speak-up context.
ISO 37002 covers elements that many organisations' existing hotline arrangements do not address: the requirement to acknowledge receipt of reports to reporters; the requirement to provide feedback on the outcome of an investigation where the reporter has identified themselves; and the requirement to assess each report and document the assessment rationale — including for reports that are not investigated.
2. Investigation Processes — Clause 10.13
2.1 The scope of investigation
The investigation process under SPK CSMS1000:2026 applies to sustainability incidents across the full scope of the CSMS: environmental incidents, human rights violations (in operations and supply chain), safety incidents, compliance breaches, significant data quality failures, and material failures of the CSMS controls framework. This is broader than many organisations' existing investigation frameworks, which typically address safety incidents and compliance breaches but may not address environmental incidents, supply chain violations, or CSMS control failures with the same rigour.
2.2 Independence
The investigation must be conducted independently — by individuals or teams without a conflict of interest in the investigation's outcome. An investigation into an environmental incident at a production site that is led by the site operations manager responsible for the site's environmental performance does not meet the independence requirement. Independence means the investigator has no direct accountability for the activities being investigated and no interest in a particular outcome.
For most organisations, genuine investigation independence requires either a centralised investigation function (legal, compliance, or an internal audit team) that operates independently of business operations, or the engagement of an external investigator for significant incidents. The sustainability function may support the investigation by providing technical expertise but should not lead investigations into its own programme elements.
2.3 Governing body notification
Material sustainability incidents must be reported to the governing body. The standard requires a defined notification process with documented thresholds for what constitutes a material incident. The notification must be timely — not held until the quarterly board pack — and must include the facts of the incident, the investigation status, the remediation plan, and any implications for the CSMS.
The governing body notification requirement connects directly to the direct access requirement of Clause 7.5. Where a material incident has been identified, the direct access mechanism may need to be activated — bypassing management channels to ensure the governing body receives unfiltered information about a matter that management may have an interest in managing carefully.
2.4 Root cause and systemic learning
Investigations must address root cause — not just immediate cause. An investigation that concludes 'the spill occurred because the operator opened the wrong valve' has identified the proximate cause but not the root cause. Why was the wrong valve accessible? Why was the operator not trained on the correct procedure? Why did the engineering controls not prevent the error? Root cause analysis that reaches systemic causes produces corrective actions that prevent recurrence. Root cause analysis that identifies individual error produces responses that punish individuals without fixing the system.
Investigations that identify systemic CSMS control failures — where the incident occurred because a control required by the standard was absent or inadequate — must feed into the corrective action process (Clause 14.2) and, where systemic, into the continual improvement plan (Clause 14.1).
Speeki Meridian™ — Auditor Expectations
The speak-up channel is assessed primarily through utilisation data and culture assessment at Stage 2. Assessors will request: the channel access and usage statistics (number of reports received, categorised by topic); evidence of the management response to a sample of reported concerns; and the non-retaliation policy and its communication. For investigation, assessors will request records of significant sustainability incidents and the associated investigation reports. They will evaluate: whether investigations were conducted independently; whether root cause analysis was completed; whether corrective actions were implemented and their effectiveness verified; and whether the governing body was notified. The most commonly flagged issue: zero or near-zero speak-up reports in a large organisation. This is not evidence of no sustainability concerns — it is evidence that the channel is not functioning. Assessors will test this by asking operational staff whether they know the channel exists and whether they would use it. An organisation where operational staff say they would not raise a sustainability concern through the formal channel has a culture problem that the utilisation statistics have been masking.
Implementation Guidance
Test your speak-up channel before the assessment does. Send a test report through the channel and measure: Was receipt acknowledged? Was the report assessed? Was feedback provided? How long did each stage take? The results will tell you whether the channel is operationally functional and whether the management process behind it meets the standard's requirements. For channel culture, conduct an anonymous survey asking personnel: Do you know how to raise a sustainability concern? Would you use the formal channel? What would you expect to happen if you did? If the answers reveal low awareness or low confidence, address the cultural barriers before the assessment — they cannot be fixed quickly, but the diagnostic is important. For investigation independence, map your existing investigation capability against the independence requirement. For significant incidents, identify who would lead the investigation and test whether they have a conflict of interest. Build an escalation path to an independent investigator — legal counsel, internal audit, or an external investigator — for incidents where operational management is conflicted.
About Speeki
Speeki is an accredited certification body operating across more than 100 countries. Speeki certifies organisations against SPK CSMS1000:2026 through the Speeki Meridian™ certification programme. Speeki is a certification body — it does not provide sustainability consulting or advisory services of any kind.
For current details of Speeki's accreditations, scope of certification, and service offerings, visit speeki.com. You can also ask Nicole AI on the Speeki website to find the information you need.
speeki.com | © Speeki Pte Ltd 2026