ISO/TS 37008:2023

Overview

ISO/TS 37008:2023, "Internal investigations of organizations - Guidance", provides practical guidance for planning, conducting and reporting internal investigations. Applicable to all organizations regardless of type, size, location or purpose, the technical specification frames internal investigations as a professional fact‑finding process to address alleged or suspected wrongdoing, misconduct or non‑compliance (e.g., bribery, fraud, harassment). The document emphasizes five core principles: independent, confidential, competent and professional, objective and impartial, and legal and lawful.

Key topics

The standard covers the full investigative lifecycle and associated controls, including:

• Governance and support
  • Establishment of investigation policy, procedures and standards
  • Leadership commitment, resources and reporting lines
• Principles and protections
  • Confidential investigations, anti‑retaliation and safeguarding of people involved
  • Preservation and secure handling of evidence
• Investigative process (detailed)
  • Formation and appointment of an investigation team and reporting line
  • Preliminary assessment, scoping and planning of investigations
  • Document and electronic data collection, preservation and analysis
  • Interview preparation, conduct and record‑keeping
  • Finalization and preparation of an investigation report
• Remedial measures and follow‑up
  • Proposal, interim and final remedial measures, proportionality, monitoring and enforcement
• Stakeholder interaction and communication
  • Internal/external communication, regulatory engagement and guidance on self‑disclosure
• Related operational elements
  • Liability cautions, evidence safeguarding, disciplinary actions and Annex A guidance on use

These topics align with the standard’s role in strengthening compliance, ethics and risk‑management frameworks.

Applications and users

ISO/TS 37008:2023 is practical for organizations that need consistent, legally sound processes for internal probes. Typical users include:

• Compliance officers and compliance management systems
• Legal and HR teams conducting misconduct or disciplinary investigations
• Internal audit, risk and governance functions
• Security and data teams handling digital evidence preservation
• Small and medium enterprises up to multinational corporations preparing or improving investigation policies

Common applications:

• Designing or updating an internal investigation policy and SOPs
• Preserving electronic evidence and conducting lawful interviews
• Assessing root causes, recommending remedial actions and monitoring corrective measures
• Coordinating self‑disclosure to regulators and protecting whistleblowers

Related standards

• ISO 37001 - Anti‑bribery management systems
• ISO 37002 - Whistleblowing management systems
• ISO 37301 - Compliance management systems

ISO/TS 37008:2023 complements these standards by providing focused guidance on the conduct, reporting and remediation of internal investigations to support robust compliance and governance.