Overview
ISO/TS 37008:2023, "Internal investigations of organizations - Guidance", provides practical guidance for planning, conducting and reporting internal investigations. Applicable to all organizations regardless of type, size, location or purpose, the technical specification frames internal investigations as a professional fact‑finding process to address alleged or suspected wrongdoing, misconduct or non‑compliance (e.g., bribery, fraud, harassment). The document emphasizes five core principles: independent, confidential, competent and professional, objective and impartial, and legal and lawful.
Key topics
The standard covers the full investigative lifecycle and associated controls, including:
- Governance and support
- Establishment of investigation policy, procedures and standards
- Leadership commitment, resources and reporting lines
- Principles and protections
- Confidential investigations, anti‑retaliation and safeguarding of people involved
- Preservation and secure handling of evidence
- Investigative process (detailed)
- Formation and appointment of an investigation team and reporting line
- Preliminary assessment, scoping and planning of investigations
- Document and electronic data collection, preservation and analysis
- Interview preparation, conduct and record‑keeping
- Finalization and preparation of an investigation report
- Remedial measures and follow‑up
- Proposal, interim and final remedial measures, proportionality, monitoring and enforcement
- Stakeholder interaction and communication
- Internal/external communication, regulatory engagement and guidance on self‑disclosure
- Related operational elements
- Liability cautions, evidence safeguarding, disciplinary actions and Annex A guidance on use
These topics align with the standard’s role in strengthening compliance, ethics and risk‑management frameworks.
Applications and users
ISO/TS 37008:2023 is practical for organizations that need consistent, legally sound processes for internal probes. Typical users include:
- Compliance officers and compliance management systems
- Legal and HR teams conducting misconduct or disciplinary investigations
- Internal audit, risk and governance functions
- Security and data teams handling digital evidence preservation
- Small and medium enterprises up to multinational corporations preparing or improving investigation policies
Common applications:
- Designing or updating an internal investigation policy and SOPs
- Preserving electronic evidence and conducting lawful interviews
- Assessing root causes, recommending remedial actions and monitoring corrective measures
- Coordinating self‑disclosure to regulators and protecting whistleblowers
Related standards
ISO/TS 37008:2023 complements these standards by providing focused guidance on the conduct, reporting and remediation of internal investigations to support robust compliance and governance.
