Templates and records · ISO 37301 · Clause 8.4
ISO 37301 internal investigation report template
The file for each investigation: what was investigated, how, with what safeguards, what was concluded and which measures were taken.
In one sentence
The internal investigation report documents the facts investigated, the inquiries carried out, the safeguards respected, the conclusions and the measures taken; ISO 37301 requires processes to assess, investigate and close cases of noncompliance, and documentation of each investigation to be retained (8.4).
- Where the standard requires it
- ISO 37301 · Clause 8.4 Clauses follow ISO 37301:2021, the current edition, which replaced the ISO 19600 guidance standard.
- Type of information
- Mandatory record Documented information to be retained (8.4)
- Who fills it in
- Appointed investigator With no conflict of interest in the case; may be internal or external
- When
- During the investigation The final report is issued before the response to the reporting person
- How long it is kept
- Set by the organisation ISO 37301 sets no periods. In Spain it is wise to take into account the limitation periods of the offences the system aims to prevent, because the record is your evidence of due diligence.
What the standard requires
What ISO 37301 demands and what it leaves to your judgement
The standard asks for processes to assess, investigate and close reports of suspected or actual noncompliance, so that investigations are fair and impartial, carried out by competent people with no conflict of interest, and their results passed on to whoever needs them. Documentation of each investigation must be retained.
In Spain, if the investigation stems from a report through the channel, Law 2/2023 adds safeguards: confidentiality of the reporting person’s identity, the right of the person concerned to be informed and heard, and respect for the presumption of innocence.
It is not a nonconformity report: it investigates people’s conduct, with possible disciplinary or criminal consequences. If it reveals a failure of the system, that failure is then handled as a nonconformity with its corrective action (10.2).
Structure
Fields the template should include
- Case reference and originating report
- Facts under investigation
- Investigator and declaration of no conflict of interest
- Inquiries carried out: interviews, documents, records reviewed
- Notice to, and hearing of, the person investigated
- Facts substantiated and not substantiated
- Conclusion and proposed measures
- System failures found and corrective actions
- Closing date and communication to the relevant parties
Example
Example: investigation into invitations to buyers
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Case | INV-2026-003 · originating report COM-2026-007 |
| Facts | Possible invitations to a hospital’s procurement staff during a tender |
| Investigator | External lawyer (fictitious) · no ties to the sales area |
| Inquiries | Review of 14 months of entertainment expenses · 5 interviews |
| Hearing | The sales representative concerned was informed and submitted a response on 30 May |
| Substantiated | Two dinners above the limit in the industry code of ethics, not linked to the contract award |
| Measures | Written warning · mandatory training |
| System failure | No hospitality register existed · corrective action AC-2026-011 |
At the audit
Mistakes auditors commonly flag
- The investigator reports to the person under investigation.
- No record that the person concerned was informed or heard.
- Conclusions without facts to support them, or facts without a conclusion.
- The investigation neither updates the risk matrix nor opens a corrective action.
In Kimobox
How this record is kept in Kimobox
- 1Each investigation of a report is managed with its conclusion and associated action.
- 2Access to the case file is restricted to the System Officer and whoever they authorise.
- 3The corrective action for each breach is recorded with owner and date, and the compliance risk map is updated after every significant case.
Frequently asked questions
What people ask us before getting started
Can HR carry out the investigation?
It can take part, but the standard requires impartiality and no conflict of interest. Where senior managers or the people function itself are involved, an external investigator is the prudent choice.
What is the reporting person told?
Law 2/2023 requires them to be given a response on the action taken within three months at most. There is no need to give them the full report, which may contain third-party data.
Keep your ISO 37301 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
A whistleblowing channel that protects the people who speak up
Whistleblowing channel for employers with 50+ workers: restricted receipt, acknowledgement in seven days, a…
ISO 9001 nonconformity report template
What an ISO 9001 nonconformity report (10.2) must record: description, correction, root cause, corrective…
Improvement
The final clause closes the loop: how a report gets investigated, and how that investigation improves the…
ISO 37301 compliance obligations register template
How to document the compliance obligations ISO 37301 asks for: mandatory requirements and voluntary…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 37301:2021 — Compliance management systems. Requirements with guidance for use ISO · April 2021
- Law 2/2023 on the protection of persons who report regulatory breaches and on the fight against corruption BOE-A-2023-4513 · 21 February 2023