>>
<<
ISO 37000:2021(en)
ISO - Cover page
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
 3.1 Governance and organization
 3.2 Principles and outcomes
 3.3 Roles
4 The governance of organizations
 4.1 General
 4.2 Integrated governance
  4.2.1 General
  4.2.2 Governance and delegation
  4.2.3 Governance and management
  4.2.4 Governance and sustainability
  4.2.5 Governance and stakeholders
 4.3 The governing body
  4.3.1 Composition and structure
  4.3.2 Competence
5 Overview
6 Principles of governance
 6.1 Purpose
  6.1.1 Principle
  6.1.2 Rationale
  6.1.3 Key aspects of practice
 6.2 Value generation
  6.2.1 Principle
  6.2.2 Rationale
  6.2.3 Key aspects of practice
 6.3 Strategy
  6.3.1 Principle
  6.3.2 Rationale
  6.3.3 Key aspects of practice
 6.4 Oversight
  6.4.1 Principle
  6.4.2 Rationale
  6.4.3 Key aspects of practice
 6.5 Accountability
  6.5.1 Principle
  6.5.2 Rationale
  6.5.3 Key aspects of practice
 6.6 Stakeholder engagement
  6.6.1 Principle
  6.6.2 Rationale
  6.6.3 Key aspects of practice
 6.7 Leadership
  6.7.1 Principle
  6.7.2 Rationale
  6.7.3 Key aspects of practice
 6.8 Data and decisions
  6.8.1 Principle
  6.8.2 Rationale
  6.8.3 Key aspects of practice
 6.9 Risk governance
  6.9.1 Principle
  6.9.2 Rationale
  6.9.3 Key aspects of practice
 6.10 Social responsibility
  6.10.1 Principle
  6.10.2 Rationale
  6.10.3 Key aspects of practice
 6.11 Viability and performance over time
  6.11.1 Principle
  6.11.2 Rationale
  6.11.3 Key aspects of practice
Bibliography
30mm
10mm
15mm
15mm
10mm
17mm

International

Standard

ISO 37000
Governance of organizations — Guidance
Gouvernance des organismes — Recommandations
Reference number
ISO 37000:2021(en)
First edition
2021-09
30mm
10mm
15mm
15mm
10mm
17mm
30mm
10mm
15mm
15mm
10mm
17mm

ContentsPage

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO’s adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 309, Governance of organizations.
Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

The pursuit of purpose is at the centre of all organizations and is, therefore, of primary importance for the governance of organizations. Good governance of organizations lays the foundation for the fulfilment of the purpose of the organization in an ethical, effective and responsible manner in line with stakeholder expectations. The organizational outcomes of this good governance are:
effective performance;
responsible stewardship;
ethical behaviour.
Good governance means that decision-making within the organization is based on the organization’s ethos, culture, norms, practices, behaviours, structures and processes. Good governance creates and maintains an organization with a clear purpose that delivers long-term value consistent with the expectations of its relevant stakeholders. The implementation of good governance is based on leadership, values, and a framework of mechanisms, processes and structures that are appropriate for the organization’s internal and external context.
This guidance is directed at governing bodies and governing groups but can also be useful to those that support them in discharging their duties such as:
personnel;
governance practitioners;
other interested stakeholders.
Organizations that use this guidance will be better equipped to understand the expectations of their stakeholders and to apply the creativity, culture, principles and performance required to deliver the objectives of the organization according to its purpose and values. Their governing bodies will hold management to account and ensure that the culture, norms and practices in the organization align with the organization’s purpose and values.
This guidance sets out governance principles that will assist governing bodies in discharging their duties effectively, prudently and efficiently, while enhancing trust, inclusion, accountability, legitimacy, responsiveness, transparency and fairness. Governing bodies that apply this guidance can expect that the organizations they govern will realize effective performance, responsible stewardship and ethical behaviour.
When organizations use this document, stakeholders across countries and sectors can have increased confidence that the governing bodies of these organizations are responsible, accountable, fair and transparent, they act with probity and make decisions which are risk-based and informed by:
credible information and reliable data;
stakeholders’ expectations;
compliance obligations;
ethical and societal expectations, including those anticipated for future generations;
impacts, and reliance, on the natural environment.
The benefits of good governance can apply to:
a)
the organization itself;
b)
member stakeholders;
c)
other stakeholders.
Examples of the value generated by good governance include the following.
 
Improved long-term stakeholder value generation: Good governance promotes effective oversight of the organization and thus helps to ensure alignment between the organizational purpose, strategy, activities, and the United Nations Sustainable Development Goals (UN SDGs)[15]. This improves long-term stakeholder value generation.
Effective resource stewardship: Effective stakeholder engagement, protected disclosures (whistleblowing) and mediation, appropriate executive authority limits, consistent terminology, transparent decision-making and accountability, all contribute to improved stakeholder confidence that the organization is stewarding resources in a responsible manner.
Improved organizational resilience and performance: The organization is able to remain resilient when negatively impacted by its changing context and realize valuable opportunities as a result of these changes via good governance practices. These practices include adapting strategy, ethical leadership, effective succession planning, clear delegation of authority and responsibilities, and oversight of risk management and internal controls.
Improved decision-making effectiveness: With the increasing rate of change and complexity within which organizations operate, good governance promotes holistic consideration of the organization, its purpose, and the context within which it operates, resulting in improved decision-making. Clarity of accountability, responsibilities and delegated authority are good governance practices, which increase the speed of organizational decision-making, action and outcomes.
Improved personnel composition and retention: People who are motivated not only by financial interests, but also by the organizational purpose and by intangible organizational values such as fairness and transparency, are attracted to organizations demonstrating good governance practices, such as effective and ethical leadership.
Increased investor and creditor confidence: Effective leadership and oversight, holistic decision-making, transparency and effective stakeholder relations, sustainability considerations and certainty of compliance management all contribute to increased confidence in the organization. In turn, this can improve access to capital and reduce the cost of capital.
Increased value of intangible assets: Transparency with stakeholders and responsible organizational behaviour (corporate citizenship) contribute to the value of the organization’s intangible assets such as reputation, public image, public confidence and goodwill.
 
Finally, good governance includes actions by the governing body (e.g. creating governance policies) to direct their organizations to provide stakeholders with transparent, clear and concise reports and access to information. This allows regulators and society, through their duly appointed representatives, to evaluate the organization’s positive and negative natural environmental, social and economic impacts. Good governance further affords stakeholders the opportunity to hold organizations to account, benchmark their results, highlight inappropriate practices, and monitor organizational impacts on society, the economy and the natural environment.
The governance of organizations is enabled by the application of principles that help the organization fulfil its organizational purpose and, in doing so, generate value for the organization and its stakeholders.
Figure 1 provides an overview of the governance of organizations and the principles and governance outcomes outlined in this document. These components can already exist in full or in part within the organization. However, at times they need to be adapted or improved so that the governance of the organization remains effective, efficient, and appropriate for its unique and dynamic nature and context.
Figure 1 — Governance of organizations — Overview
graphic
Key
graphic
governance outcomes
graphic
primary governance principle
graphic
foundational governance principles
graphic
enabling governance principles
30mm
10mm
15mm
15mm
10mm
17mm

International StandardISO 37000:2021(en)
Governance of organizations — Guidance

1Scope

This document gives guidance on the governance of organizations. It provides principles and key aspects of practices to guide governing bodies and governing groups on how to meet their responsibilities so that the organizations they govern can fulfil their purpose. It is also intended for stakeholders involved in, or impacted by, the organization and its governance.
It is applicable to all organizations regardless of type, size, location, structure or purpose.

2Normative references

There are no normative references in this document.

3Terms and definitions

For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
ISO Online browsing platform: available at https://www.iso.org/obp
IEC Electropedia: available at http://www.electropedia.org/

3.1Governance and organization

3.1.1
governance of organizations
human-based system by which an organization (3.1.3) is directed, overseen and held accountable for achieving its defined purpose
3.1.2
organizational governance framework
strategies, governance policies (3.2.9), decision-making structures and accountabilities (3.2.2) through which the organization’s (3.1.3) governance arrangements operate
3.1.3
organization
person or group of people that has its own functions with responsibilities (3.2.3), authorities and relationships to achieve its objectives
Note 1 to entry: The concept of organization includes, but is not limited to, sole-trader, company, corporation, firm, enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated or not, public or private.
[SOURCE: ISO 37301:2021, 3.1, modified — Note 2 to entry has been deleted.]
3.1.4
organizational entity
organization (3.1.3) that has a distinct and independent existence
Note 1 to entry: In some cases, an organizational entity can be a legal entity.
3.1.5
constituting documents
authoritative and unique set or collection of documents that establishes the organization’s (3.1.3) existence and accountability (3.2.2) as amended from time to time
Note 1 to entry: Documents vary depending on the type and location of the organization, and can include a deed of incorporation, articles of association or charter.
3.1.6
risk
effect of uncertainty on objectives
Note 1 to entry: An effect is a deviation from the expected. It can be positive, negative or both, and can address, create or result in opportunities and threats.
Note 2 to entry: Objectives can have different aspects and categories, and can be applied at different levels.
Note 3 to entry: An objective can be expressed in other ways, e.g. as an intended outcome.
[SOURCE: ISO 31000:2018, 3.1, modified — Note 3 to entry has been replaced.]
3.1.7
risk appetite
amount and type of risk (3.1.6) that an organization (3.1.3) is willing to pursue or retain
[SOURCE: ISO Guide 73:2009, 3.7.1.2]
3.1.8
risk criteria
terms of reference against which the significance of a risk (3.1.6) is evaluated
Note 1 to entry: Risk criteria are based on organizational objectives, and external and internal context.
Note 2 to entry: Risk criteria can be derived from standards, laws, policies and other requirements.
[SOURCE: ISO Guide 73:2009, 3.3.1.3]
3.1.9
risk tolerance
organization’s (3.1.3) or stakeholder’s (3.3.1) readiness to bear the risk (3.1.6) after risk treatment (3.1.11) in order to achieve its objectives
Note 1 to entry: Risk tolerance can be influenced by legal or regulatory requirements.
[SOURCE: ISO Guide 73:2009, 3.7.1.3]
3.1.10
level of risk
magnitude of a risk (3.1.6) or combination of risks, expressed in terms of the combination of consequences and their likelihood
[SOURCE: ISO Guide 73:2009, 3.6.1.8]
3.1.11
risk treatment
process to modify risk (3.1.6)
Note 1 to entry: Risk treatment can involve:
avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk;
taking or increasing risk in order to pursue an opportunity;
removing the risk source;
changing the likelihood;
changing the consequences;
sharing the risk with another party or parties (including contracts and risk financing); and
retaining the risk by informed decision.
Note 2 to entry: Risk treatments that deal with negative consequences are sometimes referred to as “risk mitigation”, “risk elimination”, “risk prevention” and “risk reduction”.
Note 3 to entry: Risk treatment can create new risks or modify existing risks.
[SOURCE: ISO Guide 73:2009, 3.8.1]

3.2Principles and outcomes

3.2.1
principle
fundamental truth, proposition or assumption that serves as foundation for a set of beliefs or behaviours or for a chain of reasoning
[SOURCE: BS 13500:2013, 2.14, modified — The singular form has been used.]
3.2.2
accountability
obligation to another for the fulfilment of a responsibility (3.2.3)
Note 1 to entry: The obligation includes the duty to inform and to explain the manner in which the responsibility was fulfilled.
Note 2 to entry: The non-fulfilment of a responsibility has consequences that can be enforced on the accountable party.
3.2.3
responsibility
obligation to act and take decisions to achieve required outcomes
[SOURCE: ISO/IEC 38500:2015 2.22]
3.2.4
delegation
assignment of authority and responsibility (3.2.3) from one that holds them to another
3.2.5
compliance
meeting all the organization’s (3.1.3) compliance obligations (3.2.6)
[SOURCE: ISO 37301:2021, 3.26]
3.2.6
compliance obligations
requirements that an organization (3.1.3) mandatorily has to comply with as well as those that an organization voluntarily chooses to comply with
[SOURCE: ISO 37301:2021, 3.25]
3.2.7
ethical behaviour
behaviour that is in accordance with accepted principles (3.2.1) of right or good conduct in the context of a particular situation and is consistent with international norms of behaviour (3.2.8)
[SOURCE: ISO 26000:2010, 2.7]
3.2.8
international norms of behaviour
expectations of socially responsible organizational behaviour derived from customary international law, generally accepted principles (3.2.1) of international law, or intergovernmental agreements that are universally or nearly universally recognized
Note 1 to entry: Intergovernmental agreements include treaties and conventions.
Note 2 to entry: Although customary international law, generally accepted principles of international law and intergovernmental agreements are directed primarily at states, they express goals and principles to which all organizations (3.1.3) can aspire.
Note 3 to entry: International norms of behaviour evolve over time.
[SOURCE: ISO 26000:2010, 2.11]
3.2.9
governance policy
intentions and direction of an organization (3.1.3), as formally expressed by its governing body (3.3.4)
3.2.10
organizational purpose
organization’s (3.1.3) meaningful reason to exist
Note 1 to entry: The organizational purpose is the ultimate value the organization intends to generate for specified stakeholders (3.3.1).
Note 2 to entry: The organizational purpose guides the performance objectives and provides clear context for daily decision-making by relevant stakeholders.
3.2.11
organizational values
beliefs about desirable outcomes or actions defined by the organization (3.1.3) as good and important, to be explicitly or implicitly shared and applied by the organization
3.2.12
social responsibility
responsibility (3.2.3) of an organization (3.1.3) for the impacts of its decisions and activities on society and the environment, through transparent and ethical behaviour (3.2.7) that:
contributes to sustainable development (3.2.14), including the health and the welfare of society;
takes into account the expectations of stakeholders (3.3.1);
is in compliance (3.2.5) with applicable law and consistent with international norms of behaviour (3.2.8);
is integrated throughout the organization and practised in its relationships.
Note 1 to entry: Activities include products, services and processes.
Note 2 to entry: Relationships refer to an organization’s activities within its sphere of influence.
[SOURCE: ISO 26000:2010, 2.18]
3.2.13
sustainability
state of the global system, including environmental, social and economic aspects, in which the needs of the present are met without compromising the ability of future generations to meet their own needs
Note 1 to entry: The environmental, social and economic aspects interact, are interdependent and are often referred to as the three dimensions of sustainability.
Note 2 to entry: Sustainability is the goal of sustainable development (3.2.14).
[SOURCE: ISO Guide 82:2019, 3.1]
3.2.14
sustainable development
development that meets the needs of the present without compromising the ability of future generations to meet their own needs
Note 1 to entry: Sustainable development is about integrating the goals of a high quality of life, health and prosperity with social justice and maintaining the earth’s capacity to support life in all its diversity. These social, economic and environmental goals are interdependent and mutually reinforcing. Sustainable development can be treated as a way of expressing the broader expectations of society as a whole.
[SOURCE: ISO 26000:2010, 2.23]

3.3Roles

3.3.1
stakeholder
person or organization (3.1.3) that can affect, be affected by, or perceive itself to be affected by a decision or activity
Note 1 to entry: Depending on the nature of the organization, stakeholders can include member stakeholders (3.3.2) and other stakeholders, including customers, regulators, suppliers and employees.
Note 2 to entry: In ISO management system standards, a stakeholder can be referred to as an “interested party”.
[SOURCE: ISO 37301:2021, 3.2, modified — The term “interested party” has been deleted. Notes 1 and 2 to entry have been added.]
3.3.2
member stakeholder
stakeholder (3.3.1) who has a legal obligation or defined right to make decisions in relation to the governing body (3.3.4) and to whom the governing body is to account
Note 1 to entry: These rights or obligations are often recorded in the organization’s (3.1.3) constituting documents (3.1.5), laws and/or regulations.
Note 2 to entry: These decisions can include, for example, the determination of the composition of the governing body or the parameters within which the governing body is to make decisions.
Note 3 to entry: Governing bodies account to these stakeholders for the organization’s outcomes as well as the governing body’s performance.
Note 4 to entry: Member stakeholders are often referred to, and can include, shareholders and members of an organization.
3.3.3
reference stakeholder
stakeholder (3.3.1) to whom the governing body (3.3.4) has decided to account to when making decisions pertaining to the organizational purpose (3.2.10)
EXAMPLE        Scientific advisory board to a research organization, parents of the pupils in a school, community advisory boards for companies.
Note 1 to entry: In some cases, a member stakeholder (3.3.2) can also be a reference stakeholder.
3.3.4
governing body
person or group of people who have ultimate accountability (3.2.2) for the whole organization (3.1.3)
Note 1 to entry: Every organizational entity (3.1.4) has one governing body, whether or not it is explicitly established. When the organization is not an organizational entity, the term governing group (3.3.5) is applicable where “governing body” is used throughout this document.
Note 2 to entry: A governing body can be explicitly established in a number of formats including, but not limited to, a board of directors, supervisory board, sole director, joint and several directors, or trustees.
Note 3 to entry: ISO management system standards make reference to the term “top management” to describe a role that, depending on the standard and organizational context, reports to, and is held accountable by, the governing body.
3.3.5
governing group
person or group of people who govern an organization (3.1.3)
Note 1 to entry: In some cases, the governing group can include executive managers or persons who have a top management role, while keeping management and governance roles distinct.
Note 2 to entry: In some cases, the governing group can include a person or group of people representing an organizational entity (3.1.4).
Note 3 to entry: Where an organization spans multiple organizational entities, it is governed by a governing group. Additionally, where an organization exists wholly within an organizational entity (e.g. a subsidiary company or department), it has a governing group that is responsible for maintaining the organizational entity’s integrated governance.
Note 4 to entry: ISO management system standards make reference to the term “top management” to describe a role that, depending on the standard and organizational context, reports to, and is held accountable by, a governing group.
3.3.6
personnel
organization’s (3.1.3) directors, officers, employees, temporary staff or workers, and volunteers
[SOURCE: ISO 37001:2016, 3.25, modified — Notes 1 and 2 to entry have been deleted.]
30mm
10mm
15mm
15mm
10mm
17mm

Bibliography
[1]
ISO 14001, Environmental management systems — Requirements with guidance for use
[2]
ISO 26000:2010, Guidance on social responsibility
[3]
ISO 31000:2018, Risk management — Guidelines
[4]
ISO 37001:2016, Anti-bribery management systems — Requirements with guidance for use
[5]
ISO 37002, Whistleblowing management systems — Guidelines
[6]
ISO 37301:2021, Compliance management systems — Requirements with guidance for use
[7]
ISO Guide 73:2009, Risk management — Vocabulary
[8]
ISO Guide 82:2019, Guidelines for addressing sustainability in standards
[9]
ISO/IEC 27001, Information technology — Security techniques — Information security management systems — Requirements
[10]
ISO/IEC 38500:2015, Information technology — Governance of IT for the organization
[11]
ISO/IEC 38505 (all parts), Information technology — Governance of IT — Governance of data
[12]
ISO/IEC 38507,2 Information technology — Governance of IT — Governance implications of the use of artificial intelligence by organizations
[13]
IEC 31010, Risk management — Risk assessment techniques
[14]
BS 13500:2013, Code of practice for delivering effective governance of organizations
[15]
United Nations Sustainable Development Goals. Available from: https://www.un.org/sustainabledevelopment/sustainable-development-goals/
[16]
Information on the governance of organizations is available from: https://committee.iso.org/home/tc309
30mm
10mm
15mm
15mm
10mm
17mm
ICS 03.100.02
Price based on 36 pages
iso.org

2 Under preparation. Stage at the time of publication: ISO/IEC/DIS 38507:2021.