The ISO 37008 Internal investigation standard framework and what this means for financial services institutions

Abstract

ISO 37008 provides companies with a way to standardise their reporting and investigations protocols while providing a framework to tailor these processes to manage key requirements in new and existing compliance and ESG regulations. The Association of Corporate Investigators (ACi) played an integral part in developing this ISO 37008 ‘Internal Investigations of Organizations — Guidance’, which looks at the full cycle of an internal investigation for organisations. It covers the establishment of investigative policies and procedures, implementation of the investigation process, the reporting of the investigation result and the performance of remedial measures. Readers will see that financial services institutions of all types and sizes may have occasions where they want to set up an internal investigation. This may be necessitated by matters coming to their attention that require immediate response and include internal misconduct, significant financial irregularity and risk, together with compliance breaches. An internal investigation which is properly carried out may help organisations negate or mitigate the effects, and with the foresight gained through an investigation, an organisation can then develop timely remedial measures to resolve these breaches. This ISO standard lays out the essential aspects of an internal investigation with a view to practical application and overlays the ACi Investigation Principles. Drafted generically, it can be tailored to meet different organisational needs, and a detailed case study helps to guide readers through the benefits of setting up a well-rounded investigative process ready to be deployed when breaches happen.