The international guidance framework for speak-up programmes — and the evidence base regulators, investors, and governance bodies increasingly look for when assessing whether an organisation's ethics culture is genuine.
ISO 37002 provides guidelines for establishing, operating, and improving a whistleblowing management system. It is a guidance document, not independently certifiable, but is implemented alongside ISO 37001 (anti-bribery) and ISO 37301 (compliance management) as a core component of a comprehensive ethics and integrity programme. A speak-up programme that works is one of the most cost-effective misconduct detection mechanisms available — and in the UAE and Saudi Arabia, it is increasingly a regulatory expectation.
The UAE's Federal Decree-Law No. 26/2020 on Anti-Corruption includes whistleblower protection provisions. Dubai Anti-Corruption Authority receives public interest disclosures. DFSA and FSRA in DIFC and ADGM supervise workplace culture as a conduct risk factor. Saudi Arabia's Nazaha has expanded private sector expectations. These are not compliance box-ticks — they reflect genuine regulatory scrutiny of whether governance cultures allow concerns to surface.
Regulatory and Legal Compliance — UAE
| Regulatory Framework | How This Standard Applies |
|---|---|
| UAE Federal Decree-Law No. 26/2020 on Anti-Corruption | UAE's primary anti-corruption legislation includes whistleblower protection provisions. ISO 37002 implementation demonstrates systematic speak-up capability aligned with the spirit and letter of this law |
| Dubai Anti-Corruption Authority (DAE) | DAE actively encourages private sector internal reporting mechanisms and receives public interest disclosures |
| Abu Dhabi Accountability Authority (ADAA) | ADAA oversees governance for Abu Dhabi government entities. Its governance standards expect functioning speak-up mechanisms |
| DFSA Culture Supervision — DIFC | DFSA supervises firm culture as a conduct risk. A functioning speak-up programme is a primary indicator of healthy compliance culture |
| FSRA Culture Supervision — ADGM | FSRA applies similar culture supervision principles for ADGM-regulated entities |
| SCA Corporate Governance Code | SCA code for listed companies includes expectations for internal reporting mechanisms as governance best practice |
Regulatory and Legal Compliance — Saudi Arabia
| Regulatory Framework | How This Standard Applies |
|---|---|
| Nazaha (National Anti-Corruption Commission) | Nazaha expects private sector organisations to maintain effective internal reporting mechanisms that surface and address wrongdoing before it reaches the Commission |
| SAMA AML/CFT Requirements | SAMA regulations require financial institutions to have internal controls facilitating reporting of suspicious activity. ISO 37002 provides the mechanism design framework |
| Saudi Anti-Bribery Law (Royal Decree No. M/36) | Anti-bribery obligations include internal controls facilitating bribery reporting — ISO 37002 provides the reporting mechanism component |
| Saudi Vision 2030 — Corporate Governance | Vision 2030's emphasis on transparency and anti-corruption creates expectations for systematic speak-up mechanisms as governance best practice |
Where This Is Most Relevant — Key Locations
| Location | Industry / Application Context |
|---|---|
| Dubai — DIFC financial institutions | DFSA conduct regulation makes speak-up programme quality a regulatory compliance issue, not just governance best practice |
| Abu Dhabi — ADGM regulated entities | FSRA culture and conduct supervision creates the same expectations |
| UAE — Listed companies (DFM, ADX) | SCA governance requirements and international investor ESG expectations |
| Saudi Arabia — SAMA regulated banks and insurers | SAMA compliance programme requirements include internal reporting mechanisms |
| Saudi Arabia — Major corporates (Riyadh, Jeddah, Dammam) | CMA governance, Nazaha expectations, and international investor governance requirements |
What the Standard Requires
| Requirement Area | What It Means in Practice |
|---|---|
| Reporting channels | Multiple accessible channels — telephone hotlines, web portals, email, in-person — available to employees, contractors, and third parties |
| Anonymity and confidentiality | Pseudonymous systems protecting reporter identity while enabling follow-up dialogue |
| Reporter protection | Explicit, enforced, documented non-retaliation protection for good-faith reporters |
| Investigation framework | Independent, competent, proportionate investigation of reported concerns |
| Governance oversight | Board/audit committee oversight of the programme with regular management reporting on usage and outcomes |
Why Nathan ISO Consulting — What We Do Differently
Designing a speak-up programme that actually gets used in a GCC organisation requires understanding specific cultural dynamics — hierarchical structures, expatriate workforce concerns, and varying familiarity with whistleblowing as a concept. Generic programmes designed for Western workplaces fail in GCC contexts.
| What We Do Differently | How It Benefits Your Project |
|---|---|
| We design for GCC cultural and linguistic diversity | Multilingual channels, culturally calibrated awareness communications, and manager training appropriate to GCC workplace hierarchies |
| We integrate with ISO 37001 and ISO 37301 | Whistleblowing mechanism designed as part of a coherent ethics and compliance programme — not as a standalone initiative |
| We know what DFSA and FSRA look for | Financial services regulators assess speak-up programme quality as part of culture supervision. We build programmes that satisfy their specific expectations |
| We design pseudonymous channels, not just anonymous ones | Purely anonymous reporting creates investigation challenges. Pseudonymous systems protect identity while enabling follow-up — ISO 37002 recommends this approach |
Frequently asked questions
No. ISO 37002 is a guidance document. Implementation strengthens ISO 37001 and ISO 37301 systems and demonstrates systematic speak-up management to regulators and governance bodies.
Federal Decree-Law No. 26/2020 includes whistleblower protection provisions in the anti-corruption context. ISO 37002 helps organisations provide protections that go beyond the current legal baseline.
Anonymous reporting hides identity completely, making follow-up impossible. Pseudonymous reporting protects identity through a reference number while enabling two-way dialogue between investigator and reporter — ISO 37002's recommended approach.
All wrongdoing concerns: bribery, fraud, financial misreporting, safety violations, environmental breaches, human rights violations, discrimination, harassment, and any breach of legal or ethical obligations.
ISO 37002 recommends governing body oversight — board or audit committee — with day-to-day management by an independent function such as internal audit, legal, or a dedicated ethics function.
Channels must be accessible in languages workers actually speak and understand. Nathan develops Arabic, Hindi, Urdu, Tagalog, and other language communications as required by your workforce composition.
Intake and triage (assessing seriousness and priority), investigation by independent competent investigator, outcome determination, feedback to reporter where confidentiality permits, and systemic lessons learned.
Good-faith reports that prove unfounded do not result in consequences for the reporter. Deliberately false and malicious reports may result in disciplinary action. The policy must make this distinction explicit.
Annually at minimum; after significant incidents or management changes; when regulatory requirements change. The governing body should receive periodic reporting on programme usage, investigation outcomes, and trends.
Yes. If an organisation has experienced a serious misconduct case or a failure of the speak-up programme, we provide post-incident review, system redesign, and remediation support.
Talk to Nathan ISO Consulting
We approach whistleblowing management as part of a broader ISO 37001/37301 ethics programme. Tell us your current programme status and regulatory requirements.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving