ISO 37001 for the CHRO: designing integrity training, whistleblowing and discipline

Who should receive integrity and anti-bribery training, and what records should we keep?

Article 22 of the Ethical Corporate Management Best Practice Principles for TWSE/TPEx Listed Companies requires regular training and awareness for directors, supervisors, managers, employees, mandataries and persons with substantial control; the chairman, the CEO or senior management should also regularly communicate the importance of integrity.

In practice, tier training by bribery risk. An ISO 37001 bribery risk assessment covers scenarios such as business entertainment, commissions, agents and dealings with government, so sales, procurement and overseas staff in those areas need deeper training than other employees.

Records to keep:

• The list of people to be trained and the completion rate
• Material versions and dates
• Attendance or online completion records, and tests or sign-offs

The service page notes that a management system built on ISO 37001 produces training and audit evidence that supports disclosure and evaluations. These principles are for listed companies; companies that are not public companies are not covered and can use them voluntarily.

How do we build integrity into performance appraisal and the rewards and penalties system?

The wording of Article 22 is: combine the ethical corporate management policy with employee performance appraisal and human resources policy, and set up a clear and effective system of rewards and penalties.

HR can connect it in three places:

Penalty types and procedures must be consistent with work rules and employment contracts; whether they are lawful and effective is for legal counsel to judge case by case.

What due diligence should HR do before hiring or promoting someone into a high-risk role? How do we manage conflicts of interest?

Among the ISO 37001 criteria listed on the service page, due diligence (clause 8.2) covers projects, business associates and personnel, graded by risk with a decision on how deep to go. One of the main changes in ISO 37001:2025 is the handling of conflicts of interest.

HR can divide the work like this:

• Define high-risk roles: based on the bribery risk assessment, for example roles handling entertainment and gifts, commissions, agents, government dealings or procurement approval
• Before appointment: carry out due diligence on people for these roles and keep the records
• On joining and every year: ask the relevant people to declare conflicts of interest, and update when anything changes
• Align with financial controls: use one set of definitions for the entertainment and gift control points (clauses 8.3, 8.4 and 8.7) and HR rules

What information due diligence may ask for is also limited by Article 5 of Taiwan's Employment Service Act on "private information not needed for employment"; legal counsel should confirm the scope.

How should HR handle a whistleblowing report, and how do we protect the whistleblower?

Article 23 of the principles requires a concrete whistleblowing system, including:

• Reports involving directors or senior management go to the independent directors or supervisors
• Confidentiality of the whistleblower's identity and the report, with anonymous reports allowed
• Measures to protect whistleblowers from improper treatment because of the report

ISO 37001 also requires a channel for raising concerns (clause 8.9) and an investigation procedure (clause 8.10), and you need to explain how reporters are protected, who investigates and how conflicts of interest are avoided.

HR's usual role is the personnel action after an investigation, so write down in advance: who can see the whistleblower's identity, how investigators step aside when they are connected to the person reported, and how later transfers or appraisals avoid being seen as retaliation. ESG evaluation item S-9 also checks whether the company website discloses the whistleblowing system for internal and external people in detail; the evaluation covers listed companies, and companies that are not public companies are not covered and can use it voluntarily.

Do we have to announce discipline for integrity breaches? How are appeals handled?

Article 24 of the principles requires two things:

• Clearly set and publish the discipline and appeal system for breaches of the ethical corporate management rules
• Promptly disclose on the company intranet the violator's title, name, date and content of the breach and how it was handled

What HR needs to prepare:

1. Discipline and appeal procedure: who decides, how the person concerned states their case and appeals, and who handles appeals
2. Disclosure template: the format and approval flow for intranet disclosure
3. Privacy and labour law boundaries: disclosing a name is processing personal data, so legal or outside counsel should confirm the scope and basis before disclosure

These principles are for listed companies; companies that are not public companies are not covered and can use them voluntarily.

The board, the annual report and the ESG evaluation look at ethical management. What evidence does HR provide, and is our certificate still valid?

• ESG evaluation (covers listed companies): item S-7 (2027 wording) asks for disclosure of a board-approved ethical management policy, a full- or part-time unit promoting it, how it is carried out, and a report to the board at least once a year; in the 2026 evaluation this is split into S-7 and S-8. Item S-9 checks the whistleblowing system disclosed on the website.
• Annual report: a public company's corporate governance report must disclose how it practises ethical management and any differences from the Ethical Corporate Management Best Practice Principles and the reasons (Article 10 of the annual report regulations).
• Implementation evidence HR can provide: training completion records, conflict of interest declarations, statistics on reports received and handled, and discipline and appeal records. These can go into the annual report to the board by the dedicated unit under Article 17 of the principles.
• Certificate version: the current version is ISO 37001:2025; certified organisations must transition by 28 February 2027, after which 2016 certificates are no longer valid.

Companies that are not public companies are not covered by the annual report and evaluation rules above and can use them voluntarily.

How does Winners Consulting help a CHRO with ISO 37001?

This is Winners Consulting's own description; hold us to the questions above.

• Who leads: Winners Consulting is a consultant and does not issue certificates; vice-president and director-level consultants personally lead the work end to end, never outsourced, and certificates are issued by a separate certification body
• One set of documents: we implement with ERM risk language as the backbone and share one document system with your existing internal controls, avoiding duplication
• Processes HR can run: a typical implementation covers bribery risk assessment, third-party due diligence, financial controls and approval design, reporting channels and investigation procedures, and management commitment and the anti-bribery function
• No disruption to operations: interviews and workshops fit into your existing meeting rhythm
• Timeline (as listed on the service page): the system build and internal audit typically take one to two quarters before certification
• First step: the first mechanism diagnosis is free

More: ISO 37001 anti-bribery management system, Choosing an ISO 37001 consultant, ERM consulting, CRO role page