Simon Scales introduces ISO 37008 and explains its role in strengthening investigative governance and compliance frameworks. The article outlines the standard’s approach to conducting professional, independent, and legally defensible investigations while
ISO 37008 is an International Standards Organisation
(ISO) guidance document that sets out a framework for how organisations should
design, govern and conduct internal investigations.
Published in July 2023, it sits within the broader
ISO 37000 series on organisational governance and integrity, alongside guidance
on governance, antibribery management systems, whistleblowing, fraud control
and governance maturity.
Whilst ISO 37008 is not a certifiable standard, it
offers a practical, internationally informed reference point that strengthens
how organisations manage investigative risk. Investigations are a natural extension
of effective governance and a necessary complement to compliance programmes.
Compliance management focuses on what should happen;
investigations establish facts about what did happen when governance or
controls fail.
Used together, ISO 37002 and ISO 37008 reinforce a
strong risk, control and governance environment and support the three lines of
defence model.
The document defines an internal investigation as a
professional fact-finding process initiated by an organisation to establish
facts about suspected wrongdoing, misconduct or non-compliance.
Examples include bribery and corruption, fraud,
bullying and harassment, violence, discrimination and breaches of a code of conduct.
It also notes that the term “investigation” covers matters ranging from
operational enquiries to serious misconduct issues, making clarity in governance
documents essential.
ISO 37008 emphasises clear investigative governance,
starting with a written investigations policy or procedure. In practice,
organisations usually require both.
The guidance frames governance through practical
questions covering where investigations sit within the organisation,
accountability at executive and board level,
outsourcing arrangements, reporting lines,
regulatory requirements, triage and referral processes, oversight committees,
management information, and whether investigators are suitably qualified.
The Association of Corporate Investigators (ACi)
recommends governance artefacts that align with existing frameworks rather than
replace them.
These include a charter defining the investigations
mandate, an investigations policy covering remit and case allocation,
procedures manuals, oversight committee terms of reference, investigation
response plans for significant cases, and templates supporting planning,
investigative actions and reporting.
The overall objective is consistency, transparency
and defensible decisionmaking, particularly where multiple functions interact
during investigations.
The ACi also recognises that many organisations
locate investigations within Audit or Legal reporting lines, while some combine
investigations and whistleblowing within a wider Business Integrity function.
A central feature of ISO 37008 is its articulation
of investigation principles.
