Templates and records · ISO 37301 · Clause 8.3
Whistleblowing register: ISO 37301 and Law 2/2023
The record of every report received through the channel and the investigation it triggers, with the statutory deadlines in view and confidentiality guaranteed.
In one sentence
The whistleblowing register records the reports received and the internal investigations they trigger, with the dates of acknowledgement and response; it is required by art. 26 of Law 2/2023, which caps retention at ten years, and it is also the activity record that demonstrates the ISO 37301 clause 8.3 process for raising concerns.
- Where the standard requires it
- ISO 37301 · Clause 8.3 Clauses follow ISO 37301:2021, the current edition, which replaced the ISO 19600 guidance standard.
- Type of information
- Mandatory record Art. 26 of Law 2/2023; ISO 37301 activity record (8.3 and 9.1.5)
- Who fills it in
- System Officer Appointed by the board of directors; access to the register is restricted
- When
- On receipt of each report Completed as the case progresses until it is closed
- How long it is kept
- Maximum 10 years Art. 26.2 of Law 2/2023; erasure after three months if no investigation has been opened, except as evidence that the system works (art. 32.4)
What the standard requires
What ISO 37301 demands and what it leaves to your judgement
ISO 37301 asks for a process that encourages and enables the reporting of attempted, suspected or actual breaches of the policy or of obligations, with confidentiality, the option of anonymity and protection against retaliation. The standard does not by itself require a register, but it does require accurate, up-to-date records of compliance activities (9.1.5).
In Spain, Law 2/2023 makes it mandatory for private companies with fifty or more employees and for the whole public sector: a register must be kept of the reports received and of the investigations, which is not public and whose data cannot be kept for more than ten years.
The statutory deadlines dictate the fields: acknowledgement within seven calendar days and a response within three months at most, extendable by another three in complex cases. If no investigation has been opened within three months, personal data are erased except where needed to evidence that the system works.
Structure
Fields the template should include
- Report code and date received
- Channel used and whether it is anonymous
- Subject and area: criminal, administrative, employment, code of ethics
- Acknowledgement date (limit: 7 calendar days)
- Admission or rejection, with reasons
- Investigation opened, investigator and case reference
- Date of response to the reporting person (limit: 3 months, extendable)
- Conclusion and measures taken
- Closing date and data erasure date
Example
Example: anonymous report about invitations to buyers
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Code and date | COM-2026-007 · 2 April 2026 |
| Channel | Channel web form · anonymous |
| Subject | Possible bribery of a hospital’s procurement staff · criminal |
| Acknowledgement | 3 April, in the channel’s secure mailbox |
| Admission | Admitted: specific and credible facts |
| Investigation | INV-2026-003 · external investigator |
| Response | 24 June · within the three-month deadline |
| Conclusion | Facts partly substantiated · see investigation report |
At the audit
Mistakes auditors commonly flag
- Late acknowledgements, or no date to prove they were on time.
- Anonymous reports dismissed simply because they are anonymous.
- Register open to HR or management without restriction.
- Data kept indefinitely or, conversely, deleted without leaving evidence that the channel works.
In Kimobox
How this record is kept in Kimobox
- 1Only the System Officer and the people they authorise can access the reports and their content.
- 2The system sends a reminder before the seven-day acknowledgement and three-month response deadlines expire.
- 3Reports received and the investigations they trigger are recorded for the register, with each case traced through to closure.
Frequently asked questions
What people ask us before getting started
Who has to keep the register?
The entities required by Law 2/2023 to have an internal reporting system: private companies with fifty or more employees, those in the sectors listed in art. 10.1.b) and c) regardless of headcount, and the whole public sector.
Is the register public?
No. Its content can only be accessed, in whole or in part, at the reasoned request of the competent judicial authority, within judicial proceedings and under its supervision.
Keep your ISO 37301 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
A whistleblowing channel that protects the people who speak up
Whistleblowing channel for employers with 50+ workers: restricted receipt, acknowledgement in seven days, a…
UNE 19602 tax incidents register template
How to record tax incidents under UNE 19602: errors, tax authority requests and channel reports, with root…
Support
Support in compliance rests on two pillars: staff knowing their obligations, and a whistleblowing channel…
ISO 37301 compliance obligations register template
How to document the compliance obligations ISO 37301 asks for: mandatory requirements and voluntary…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- Law 2/2023 on the protection of persons who report regulatory breaches and on the fight against corruption BOE-A-2023-4513 · 21 February 2023
- ISO 37301:2021 — Compliance management systems. Requirements with guidance for use ISO · April 2021