ISO 37008 2023 - Internal investigations of organizations - Guidance

Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Principles
	4.1 Independent
	4.2 Confidential
	4.3 Competent and professional
	4.4 Objective and impartial
	4.5 Legal and lawful
5 Support for internal investigations
	5.1 Resources
	5.2 Leadership and commitment
6 Establishment of investigation policy or procedure
7 Safety and protection measures
	7.1 Preserving and securing evidence
	7.2 Protection of and support to personnel involved in investigations
	7.3 Anti-retaliation
	7.4 Safeguarding
8 Investigative process
	8.1 Investigation team
		8.1.1 Appointment of the investigation team
		8.1.2 Investigation reporting line
	8.2 Preliminary assessment
	8.3 Determining the scope of the investigation
		8.3.1 Scope
		8.3.2 Scope changes
		8.3.3 Determination elements
	8.4 Investigation planning
	8.5 Maintaining confidentiality
	8.6 Liability caution to deter disclosure
		8.6.1 Written caution notice
		8.6.2 Verbal caution notice
	8.7 No interference
	8.8 Evidence
		8.8.1 Document collection and review
		8.8.2 Electronic data collection, preservation, analysis and review
	8.9 Interviews
		8.9.1 Preparations
		8.9.2 Conducting an interview
		8.9.3 Keeping records of an interview
	8.10 Finalization process
	8.11 Investigation report
9 Potential remedial measures or improvements
	9.1 Proposal of remedial measures and improvements
	9.2 Interim remedial measures
	9.3 A final plan for post-investigation remedial measures
	9.4 Proportionality of remediation and improvement measures
	9.5 Monitoring and enforcement of remedial measures
10 Interaction with stakeholders
	10.1 General
	10.2 Planning
	10.3 Measures for the communication process
	10.4 Effective communication channels
	10.5 Government and regulator communication
	10.6 Self-disclosure to the authorities
11 Disciplinary actions
Annex A (informative)  Guidance on the use of this document
Bibliography