It suits public bodies, banks, listed companies and any organisation that wants concerns raised early. It often sits beside anti-bribery and compliance programmes.

• Current practice is compared with the guidance.
• Management agrees which parts apply and who owns them.
• Practices are adopted in policies, procedures and training.
• Results are reviewed after a set period and adjusted.

Cost is mainly staff time and any outside support. The number of processes and teams involved decides the effort. No certification fees apply, as no certificate is issued.

Most organisations adopt it in phases over several months. It can run alongside work on a certifiable standard.

ISO 37002 is guidance, so accredited certificates are not issued against it. Its practices support the reporting requirements of ISO 37001 and ISO 37301.