The ISO 37000 series is a family of international standards covering organizational governance, anti-bribery, compliance management and whistleblowing. It is produced by ISO/TC 309, the ISO technical committee for governance of organizations.
Standards Academy is directed by the Convenor of ISO/TC 309/WG 1, the working group that developed ISO 37000 and ISO 37005, who also serves as Vice-Chair of ISO/TC 309, the committee that produces the whole series. The account that follows draws on that direct involvement in the drafting.
The series rests on four core documents. ISO 37000 gives governance principles, ISO 37301 sets requirements for a compliance management system, ISO 37001 sets requirements for an anti-bribery management system, and ISO 37002 gives guidelines for a whistleblowing management system. This article maps each standard, the available PECB credentials, and the ISO 37001:2025 transition.
Scope and purpose of the ISO 37000 series
ISO/TC 309 defines its scope as 'Standardization in the field of governance relating to aspects of direction, control and accountability of organizations' (ISO, no date). As of 23 October 2026, the committee lists 13 published standards and eight under development on the ISO/TC 309 committee page.
The purpose of the series is coherence. Boards set direction under ISO 37000 governance principles. Compliance functions operationalize obligations under ISO 37301. Anti-bribery controls follow ISO 37001. Whistleblowing channels follow ISO 37002 guidance.
ISO 37000:2021 applies to all organizations regardless of type, size, location, structure or purpose (ISO, 2021a, Clause 1). It sets out 11 principles in three categories (ISO, 2021a, Table 1). Purpose is the single primary principle (Clause 6.1). Four foundational principles follow: value generation, strategy, oversight and accountability (Clauses 6.2 to 6.5). Six enabling principles complete the set: stakeholder engagement, leadership, data and decisions, risk governance, social responsibility, and viability and performance over time (Clauses 6.6 to 6.11).
The drafters placed purpose at the centre deliberately. Every other principle is read in the context of purpose, and the governing body's first task is to define the organization's reason for existence and its intentions towards the natural environment, society and its stakeholders (ISO, 2021a, Clause 6.1). The standard was written for governing bodies of every kind of organization, which is why it carries principles and key aspects of practice and no auditable requirements. ISO reviewed and confirmed the 2021 edition in 2026.
ISO 19600, the former compliance guidance document, is withdrawn. ISO 37301:2021 replaced it with auditable requirements (ISO, 2021c). ISO 37301:2021 carries Amendment 1:2024 on climate action.
PECB credentials and training routes for the series
A PECB credential attests the competence of a person. It never certifies an organization. Organizational certification against ISO 37001 or ISO 37301 is granted only by accredited certification bodies.
The table below maps common roles to the nine PECB credential courses delivered by Standards Academy, a PECB-authorized training partner.
| Role | Credential | Course | Formats |
|---|---|---|---|
| Board member, governance adviser | ISO 37000 Corporate Governance Manager | ISO 37000 Corporate Governance Manager | Self-Study and eLearning |
| Governance lead, company secretary | ISO 37000 Lead Corporate Governance Manager | ISO 37000 Lead Corporate Governance Manager | Self-Study and eLearning |
| Staff new to anti-bribery | ISO 37001 Foundation | ISO 37001 Foundation | Self-Study and eLearning |
| Anti-bribery programme owner | ISO 37001 Lead Implementer | ISO 37001 Lead Implementer | Self-Study and eLearning |
| Internal or third-party auditor | ISO 37001 Lead Auditor | ISO 37001 Lead Auditor | Self-Study and eLearning |
| Holder of a 2016-edition credential | ISO 37001:2025 Transition | ISO 37001:2025 Transition | eLearning |
| Staff new to compliance management | ISO 37301 Foundation | ISO 37301 Foundation | Self-Study and eLearning |
| Compliance officer, compliance manager | ISO 37301 Lead Implementer | ISO 37301 Lead Implementer | Self-Study and eLearning |
| Compliance auditor | ISO 37301 Lead Auditor | ISO 37301 Lead Auditor | Self-Study and eLearning |
The ISO 37001 Lead Implementer route suits those building a system. ISO 37301 training at Lead Auditor level suits those assessing one. Anti-bribery training at Foundation level fits teams needing shared vocabulary before deeper work.
Organizations and roles within scope
Organizational scope
The series addresses public, private and non-profit organizations of any size. A government agency, a listed company and a small charity can each apply ISO 37000 governance principles. ISO 37001 requires the anti-bribery management system to be reasonable and proportionate to the organization's context and bribery risk (ISO, 2025, Clause 4.4). ISO 37301 names proportionality among the principles on which a compliance management system should rest (ISO, 2021c, Clause A.4.4).
Governing bodies and senior management
ISO 37000 speaks to those who direct and oversee. Boards, trustees and executive committees use it to define purpose and assign accountability. Senior management then demonstrates leadership within the ISO 37001 and ISO 37301 management systems.
Compliance, audit and risk functions
Compliance officers own the obligations register and the compliance programme. Internal auditors assess conformity of the management system. Risk managers feed bribery and compliance risk assessments. Each role maps to a distinct credential route, which is why the decision table above separates implementer and auditor paths.
Structure of the series: guidance, requirements and their relationship
Guidance documents without certification
ISO 37000:2021 and ISO 37002:2021 are guidance standards. They describe principles and good practice, not auditable criteria. No organization can be certified to either document (ISO, 2021a; ISO, 2021b). Related guidance covers fraud control management systems (ISO 37003:2025), a governance maturity model (ISO 37004:2023) and the development of indicators for effective governance (ISO 37005:2024).
For whistleblowing competence, three courses are available by title: ISO 37002 Introduction, ISO 37002 Foundation and ISO 37002 Lead Implementer. ISO 37301 Introduction is also available by title.
Requirements standards and accredited certification
Only ISO 37001 and ISO 37301 contain certifiable requirements. Certification is issued by accredited certification bodies alone. Neither PECB nor Standards Academy certifies organizations.
ISO/TC 309 designed the series so that the two kinds of document work together. ISO 37000 addresses the governing body and its oversight of performance, ethical behaviour and compliance obligations (ISO, 2021a, Clause 6.4). ISO 37001 and ISO 37301 give top management the auditable systems through which that oversight is exercised, and both name the governing body expressly in their leadership clauses (ISO, 2025, Clause 5.1; ISO, 2021c, Clause 5.1).
The harmonized structure as the connecting frame
Both requirements standards follow the harmonized structure, Clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. Shared clauses mean one integrated management system can satisfy both standards. One policy framework, one audit programme, one management review can serve anti-bribery and compliance together.
Requirements of an anti-bribery and a compliance management system
Core ISO 37001 requirements
ISO 37001:2025 requires an organization to establish, carry out, maintain and continually improve an anti-bribery management system (ISO, 2025). Central requirements include a bribery risk assessment, an anti-bribery policy, and an anti-bribery function with the competence, status, authority and independence to operate. Operational controls cover due diligence on business associates, financial and non-financial controls, and limits on gifts, hospitality and donations. Reporting channels, investigation procedures, internal audit and management review complete the cycle.
Core elements of ISO 37301
Three elements carry ISO 37301:2021. First, the compliance obligations: the organization systematically identifies them, assesses their impact on its operations and maintains documented information of them (ISO, 2021c, Clause 4.5). Second, the compliance risk assessment, which identifies, analyses and evaluates the risk of non-compliance (Clause 4.6). Third, the compliance function, which has direct access to the governing body, independence, and appropriate authority and competence (Clause 5.1.3).
One integrated system for both
Because both standards share Clauses 4 to 10, an organization can run a single system. ISO 37301 provides the broad compliance frame. ISO 37001 adds bribery-specific depth within it. Compliance management system training and anti-bribery competence therefore complement each other.
Changes in ISO 37001:2025 and the transition from the 2016 edition
Principal changes in the 2025 edition
ISO 37001:2025 replaces the 2016 edition and incorporates Amendment 1 of 2024 (ISO, 2025). The core structure stands. Changes include explicit consideration of climate change in context analysis, stronger emphasis on compliance culture, clearer treatment of conflicts of interest, and clarification of the anti-bribery function. The edition also adopts the latest harmonized structure, improving alignment with ISO 37301.
Transition deadlines for certified organizations
Under IAF MD 30:2025, certificates to ISO 37001:2016 cease to be valid on 28 February 2027, and from 31 August 2026 initial certifications and recertifications are conducted to the 2025 edition only (International Accreditation Forum, 2025).
Credential implications for professionals
Holders of 2016-edition credentials can follow the transition route listed in the table above (PECB, 2026). Implementers update documented systems against the new clauses. Auditors update audit criteria before their next certification cycle.
The series now gives decision-makers a clear sequence. ISO 37000 governance sets direction, ISO 37301 structures compliance, ISO 37001 controls bribery risk, and ISO 37002 supports reporting channels. Professionals choosing a first credential should match role to route, then plan the 2025 transition early. Standards Academy teaches the series from the position of having taken part in writing it.
Frequently asked questions
Which standards make up the ISO 37000 series?
Four core documents. ISO 37000:2021 gives governance principles. ISO 37301:2021 sets requirements for a compliance management system. ISO 37001:2025 sets requirements for an anti-bribery management system. ISO 37002:2021 gives guidance on whistleblowing management systems (ISO, 2021a; ISO, 2021b; ISO, 2021c; ISO, 2025).
Which of the four standards can an organization be certified to?
Only ISO 37001 and ISO 37301 contain certifiable requirements. ISO 37000 and ISO 37002 are guidance standards, and no organization is certified to either. Certification to ISO 37001 or ISO 37301 is granted by an accredited certification body alone. Neither PECB nor Standards Academy certifies an organization.
What changed between ISO 37001:2016 and ISO 37001:2025?
ISO 37001:2025 replaces the 2016 edition. It adds explicit consideration of climate change in the analysis of context. It gives more weight to compliance culture and treats conflicts of interest more clearly. It clarifies the responsibilities of the anti-bribery function. It adopts the current harmonized structure, which aligns it with ISO 37301 (ISO, 2025).
How do ISO 37001 and ISO 37301 fit together in one management system?
Both follow the harmonized structure, Clauses 4 to 10. ISO 37301 sets the compliance management system: obligations, compliance risk assessment and controls. ISO 37001 adds the anti-bribery requirements: bribery risk assessment, due diligence, financial controls and reporting. An organization integrates the two into one system. It keeps one policy framework, one audit programme and one management review (ISO, 2021c; ISO, 2025).
Which PECB credential suits a compliance officer, and which an internal auditor?
A compliance officer who builds and runs the compliance management system suits the ISO 37301 Lead Implementer credential. Where the role also owns anti-bribery controls, ISO 37001 Lead Implementer applies. An internal auditor assessing either system suits the matching Lead Auditor credential. The decision table under heading 2 maps each role to its course.
Does a PECB credential certify the organization?
No. A PECB credential attests the competence of a person who has completed the training. It confers no status on an organization. Organizational certification to ISO 37001 or ISO 37301 is granted only by an accredited certification body. It follows an audit of the management system.
References
International Organization for Standardization (2021a) ISO 37000:2021 Governance of organizations. Guidance. Geneva: ISO. Available at: https://www.iso.org/standard/65036.html (Accessed: 23 October 2026).
International Organization for Standardization (2021b) ISO 37002:2021 Whistleblowing management systems. Guidelines. Geneva: ISO. Available at: https://www.iso.org/standard/65035.html (Accessed: 23 October 2026).
International Organization for Standardization (2021c) ISO 37301:2021 Compliance management systems. Requirements with guidance for use. Geneva: ISO. Available at: https://www.iso.org/standard/75080.html (Accessed: 23 October 2026).
International Organization for Standardization (2025) ISO 37001:2025 Anti-bribery management systems. Requirements with guidance for use. Geneva: ISO. Available at: https://www.iso.org/standard/37001 (Accessed: 23 October 2026).
International Organization for Standardization (no date) ISO/TC 309 Governance of organizations. Available at: https://www.iso.org/committee/6266703.html (Accessed: 23 October 2026).
International Accreditation Forum (2025) IAF MD 30:2025 Transition requirements for ISO 37001:2025. Issue 1, 10 October 2025. Available at: https://iaf.nu/iaf_system/uploads/documents/IAF_MD_30_Transition_Requirements_for_ISO_37001_2025_Issue_1.pdf (Accessed: 23 October 2026).
PECB (2026) ISO 37001:2025 Transition. Available at: https://pecb.com/en/education-and-certification-for-individuals/iso-37001/iso-37001-2025-transition (Accessed: 23 October 2026).
