What will the recently adopted ISO 37002 – whistleblowing management system – standard bring?
Andrew is CEO of WislPort. He is a recognised expert in establishing and maintaining whistleblowing programmes. He has been an active participant in the development of ISO37002 the international standard for whistleblowing management systems, provided industry input to the UK All Party Parliamentary Group on Whistleblowing, participated by invitation in the UNODC / IOC Reporting Mechanisms in Sports Guide as well as supporting organisations across multiple sectors in establishing and running effective whistleblowing programmes. Andrew is a frequent media commentator and panellist.
WislPort was founded by internationally renowned leaders in whistleblowing operations. Their leadership team and advisors were actively involved in the design and development of the International Standard for Whistleblowing, ISO37002. WislPort provide organisations with easy-to-use, cost-effective products and services that are designed to deliver best-practice in whistleblowing programmes in line with the new standard.
You have been an active contributor of the ISO working group who has drafted the ISO 37002; could you remind us what is the process to issue such a standard?
ISO37002 was the first standard that I was involved in the development of. When I first got involved with the standard at the end of 2016, I was unaware of the process, commitment and effort required to create a standard. It has been a four year journey and I call it a journey both in terms of the travel and international approach taken, but also a personal journey of really learning how to engage with experts from so many backgrounds, how to debate rather than argue and how to build consensus around a topic everyone is passionate about, yet one where there are many different views on what best practice is or should be.
There are six stages involved in the creation of a standard and for anyone that would like to know more, the following links from ISO provide more details on each of these stages.
- https://www.iso.org/developing-standards.html
- https://www.iso.org/stages-and-resources-for-standards-development.html
In developing ISO37002, a team of experts from over 40 countries and liaison bodies met in the UK, Canada, China, Australia, France and India every 6 months where a full one week was dedicated to building the content of the standard, whilst the time in between was used for reviews and comments which formed much of the discussion and update for the subsequent meeting. What I understand now and more importantly what I appreciate about the process and effort that goes into the development of a standard is that:
-
- International Standards are used and trusted globally – from the more ‘general’ standards that many will be familiar with such as ISO9001 through to what I’d call ‘specialist’ standards such as ISO37002 or ISO37001. This trust is based on the quality of guidance as well as a consistency in the structure and approach taken. Building a standard that can support organisations of all shapes, sizes and regions requires a strong process and the quality and detail that has been delivered in this standard is testament to the effectiveness of this approach;
- The people that put their time and effort into developing standards are not just experts, they are genuinely passionate about providing expertise to help organisations and their stakeholders benefit. The people on ISO37002 gave their time and expertise freely and generously, taking time away from families and jobs to contribute;
- The strength of the standard is further enhanced by the diversity of participants. As well as the cultural differences that come with working with over 40 nations, the experts covered a range of backgrounds from private sector, charity, not for profits, government, trade unions and international bodies. In building a framework that is applicable globally, the strength in diversity cannot be understated in its importance.
What are the key lessons of this standard?
The three key lessons that I would ask readers to take away from the standard are:
-
- Effective whistleblower programmes deliver economic and reputational benefits to organisations and their stakeholders;
- The benefits can only be received when whistleblowers are not just protected, but supported and valued as well;
- That effective whistleblowing programmes are more than just a policy and reporting channel and that ISO37002 provides a complete picture of effective whistleblowing.
Whistleblowing programmes have the ability to deliver multiple benefits to organisations and their stakeholders. The standard is built around the three principles of Trust, Impartiality and Protection. Where there is a weakness in any of these principles, organisations will not achieve the benefits that effective whistleblowing programmes can deliver.
Whilst many organisations have a policy and channels for reporting concerns, there are many other factors involved in establishing, running and improving a whistleblowing programme. From the tone and commitment by leadership and top management to encouraging and supporting those who raise concerns about wrongdoing through to training, awareness, and support. Operations are more than just having a phoneline or a channel to speak up, the standard covers the whistleblowing lifecycle of receiving, assessing, addressing and concluding reports. And of course the need for continual improvement and the measurement of performance.
This standard does not define requirements but guidelines – unlike some other ISO compliance standards such as the ISO37001 and the ISO37301 that are intended for certification. What would be the added value of such standard?
Standards such as ISO37301 started off as a guidance standard (ISO19600) and was reviewed and updated to become a requirements standard released earlier this year. From my perspective this feels like a sensible approach, one that could be applied to 37002 in time where the market need is there. In forming a global framework that has to operate within multiple jurisdictions, there’s a risk to being too prescriptive too soon which could impede the adoption and effectiveness of a standard where certain requirements are perceived as overly restrictive or in conflict with laws or regulation. Providing guidance, reviewing and feeding back on a regular basis will give involved experts an opportunity to learn and improve. In time as the benefits and challenges become better understood, where there is a market need for turning this into a requirements standard, the option will be there.
As an expert in designing whistleblowing programmes, do you have some tips or recommendations to enhance whistleblowing system and foster a culture of open dialogue and transparency?
My three main tips for enhancing a whistleblowing system are:
- Build the business case – the ethical benefits will follow;
- Ensure you have a complete whistleblowing programme, not just a part of;
- Review the programme annually to test its controls and effectiveness.
Whistleblowing often comes with certain negative connotations. Culture and open dialogue must be driven from the very top of an organisation, and this requires more than just words. What a lot of senior leaders don’t understand are the ‘tangible’ benefits that whistleblowing programmes deliver. These benefits are both economic and reputational – and the best part about this is that where organisations achieve these benefits they are naturally delivering ethical benefits as well! For example, organisations with effective whistleblowing programmes see a 2.8% increase on their return on assets and 46% fewer negative media stories. We work with organisations to help make the business case and have found that once the benefits are understood, there is a notable change in the tone and intent of senior leaders to encourage, support and value whistleblows.
Let me give you an example – with the EU directive on whistleblowing for organisations coming into force in December 2021, a company with 251 staff and assets of €10m can achieve an additional 2.8% on their return on assets. That’s €280,000! This organisation is likely on average to receive 3-6 reports per year. Ensuring that staff are aware of the whistleblowing policy and when and how to engage with it, that managers and leaders are alert to concerns that get raised directly to them, and that the information is handled, assessed and actioned appropriately can have substantial benefits. That represents a substantial return on investment financially whilst delivering all of the ethical benefits associated with protecting whistleblowers and other stakeholders such as customers, donors or investors.
To achieve these benefits though an organisation needs a full whistleblowing programme. Whilst many organisations have a policy and reporting channels, without support, training and awareness these are often not utilised. Where the right controls are not established there is greater risk, more so when organisations outsource the reporting to third part providers, and without a consistent approach to the assessing, addressing and concluding of cases, trust, impartiality and protection cannot be built. And as with the fight against all wrongdoing, it is critical to undertake annual assessments on the effectiveness of your programme – not just to stay ahead of the wrongdoing, but to continue achieving the economic, reputational AND ethical benefits.
For more information on ISO37002: https://committee.iso.org/sites/tc309/home/projects/published/ongoing-4.html
Statistics are from George Washington University: George Washington University – Evidence on the use and efficacy of internal whistleblowing systems