International Standards: Not Every ISO Standard Requires Costly Certification

ISO's whistleblowing guidance does not replace Australian whistleblower law. Check the two directly

Many boards assume any conversation about adopting an international standard automatically means a costly, months-long certification process. For governance specifically, this is not the case, and understanding which standards require formal certification and which are guidance frameworks an association can adopt freely changes the actual cost-benefit calculation considerably.

The Distinction Most Boards Do Not Know

ISO 37000, the international standard specifically addressing organisational governance, is explicitly not a certifiable standard. It is guidance, and an association can adopt its framework, structure governance documentation around it, and demonstrate conformance through performance reviews and stakeholder feedback, all without paying for or undergoing formal third-party certification. This stands in contrast to standards like ISO 9001, which is certifiable and sometimes required in government and corporate tenders. Certification involves audit fees and implementation time that vary with size and readiness, so obtain quotes from accredited certification bodies before committing.

The Specific Warning Worth Knowing Precisely

An important, specific caution applies to whistleblowing standards. ISO 37002, the international guidance on whistleblowing management systems, is a useful framework, but it does not replace the whistleblower protections in the Corporations Act (Part 9.4AAA) and the Taxation Administration Act. Which regime applies depends on your entity type: the Corporations Act protections cover companies, including companies limited by guarantee, while an incorporated association should check its coverage separately. A company limited by guarantee generally must also have a whistleblower policy, although ASIC has relieved not-for-profit companies limited by guarantee with annual revenue under $1 million. An association assuming that adopting ISO 37002 alone satisfies its Australian legal obligations, connecting directly to the whistleblower culture discussion earlier in this series, would be mistaken. Adopting an international standard's framework does not automatically mean an association has met its actual Australian legal obligations in the same area. The two need to be checked against each other specifically, not assumed to align.

Why Multiple Standards Fit Together More Easily Than Expected

Modern ISO management system standards, quality, anti-bribery, compliance, information security, increasingly share a common underlying structure, making it easier to integrate several standards together than to implement each one as an entirely separate system. An association considering both a certifiable standard for tendering purposes and a guidance framework for governance improvement should investigate this compatibility directly, since a combined approach can meaningfully reduce the administrative burden compared with treating each standard as an isolated project.

• Distinguish clearly between certifiable ISO standards requiring formal third-party audit and guidance-only standards like ISO 37000 that can be adopted and demonstrated without certification cost.
• Pursue certifiable standards specifically where a business case exists, such as government or corporate tendering requirements, rather than pursuing certification for its own sake.
• Never assume adopting an international guidance standard automatically satisfies a specific Australian legal obligation in the same area, particularly for whistleblowing, checking your policy against the regime that applies to your entity type.
• Investigate the compatibility of multiple standards before implementing them separately, given the efficiency the shared harmonised structure across modern ISO management standards can offer.
• Treat governance standard adoption as an improvement to actual practice, not a certificate to display, since the framework's real value lies in the discipline it encourages rather than the credential itself.

International standards can offer a useful structure for an association looking to formalise its governance, quality, or risk management practices. Understanding which standards require certification, which do not, and where a standard's guidance may fall short of Australia's own specific legal requirements is what separates a useful adoption from an expensive credential that adds less real substance than assumed. This is one of the practical governance topics built into our Association CEO course, alongside the papers, tools and frameworks that turn the principle into your board's actual practice. Explore the course →

Annie Gibbins

General education, not legal, financial, tax, clinical or governance advice. Confirm specifics at the relevant primary source or with your own qualified adviser. Nexus Leadership is operated by Lipstick Consulting Pty Ltd · ABN 15 619 120 482.