ISO 37000:2021 is the first international standard offering guidance on the governance of organizations. It sets out principles that help a governing body direct, oversee, and hold an organization accountable so it fulfils its purpose, generates value, and remains viable over time. It applies to every organization, regardless of type, size, or sector.
What ISO 37000 governance actually is
Published in September 2021 by ISO technical committee TC 309, ISO 37000 was the first genuinely global reference point for organizational governance. Before it existed, boards leaned on a patchwork of national codes, listing rules, and sector conventions that rarely agreed on definitions. ISO 37000 gives that fragmented landscape a shared vocabulary and a coherent, principles-based model that any governing body can adopt.
The standard draws a firm line between governance and management. Management runs the organization day to day; governance is the system by which the governing body sets direction, ensures that direction is pursued responsibly, and answers for the outcomes. ISO 37000 keeps its focus squarely on that governing layer, describing what good governance looks like rather than prescribing rigid procedures. This matters because governance failure is common and expensive. In PwC's 2024 board effectiveness survey, only 35 percent of executives rated their own board's effectiveness as excellent or good.
Only 35% of executives rated their board's effectiveness as excellent or good, according to PwC's 2024 Board Effectiveness Survey (published 2024) — leaving roughly two-thirds of boards with meaningful room to improve.
The ISO 37000 governance principles
ISO 37000 organizes its guidance around eleven interdependent governance principles, grouped into three tiers. Purpose sits at the centre as the primary principle. Value generation, strategy, oversight, and accountability form the foundational layer built directly on that purpose. The remaining enabling principles describe the behaviours and disciplines that make the whole system work in practice.
- Purpose — the primary principle that anchors every governance decision to why the organization exists
- Value generation — governing so the organization creates and preserves value for stakeholders over time
- Strategy — setting clear direction that translates purpose into achievable outcomes
- Oversight — monitoring performance and conduct against strategy and expectations
- Accountability — assigning clear responsibility and answering for decisions and results
- Stakeholder engagement — identifying and responding to the needs of those who affect or are affected by the organization
- Leadership — establishing ethical, effective leadership arrangements throughout the organization
- Data and decisions — ensuring the governing body has the information it needs to decide well
- Risk governance — governing the effect of uncertainty on purpose and strategic outcomes
- Social responsibility — making transparent decisions aligned with broader societal expectations
- Viability and performance over time — remaining viable without compromising future generations
These principles are deliberately interlocking. Risk governance, for example, only works when leadership sets the right tone and the board receives sound data; accountability is meaningless without clear oversight. ISO 37000 therefore discourages treating the list as a checklist and encourages boards to see it as a connected system where a weakness in one principle erodes the others.
Is ISO 37000 certifiable?
No — and this is the point that trips up newcomers most often. ISO 37000 is a guidance standard, not a management-system standard written for certification. It uses the language of should rather than shall, and there is no accredited certification scheme behind it in the way there is for ISO 9001 or ISO 27001. You cannot hang an accredited ISO 37000 certificate on the boardroom wall.
That does not make it toothless. Organizations demonstrate alignment through governance documentation, independent governance reviews, board evaluations, stakeholder feedback, and audits benchmarked against the eleven principles. Some certification bodies offer conformance assessments or attestations against ISO 37000, but these are voluntary validations rather than accredited certifications. The value lies in the discipline of measuring your governance against a credible global benchmark, not in a badge.
How ISO 37000 relates to other standards
ISO 37000 is often confused with ISO 37001, but they solve different problems. ISO 37001 is a certifiable anti-bribery management system focused narrowly on preventing, detecting, and addressing bribery. ISO 37000 sits above it, describing the overall governance system within which anti-bribery controls — and every other management system — should operate. Think of ISO 37000 as the umbrella that gives coherence to risk, compliance, information security, and sustainability standards an organization may already run.
Because it is purpose-led and outcome-focused, ISO 37000 also complements frameworks such as ISO 31000 for risk management and ISO 26000 for social responsibility. Boards that already use those standards will recognise the shared DNA and can position ISO 37000 as the connective tissue that ties their separate initiatives back to a single organizational purpose.
Putting ISO 37000 to work
A practical starting point is a governance gap assessment: map current board practices, delegations, and reporting against the eleven principles, then identify where purpose is unclear, oversight is thin, or the board lacks the data to decide. From there, boards typically refine their charter, sharpen accountability lines, strengthen stakeholder engagement, and embed risk governance into strategy rather than treating it as a separate compliance chore. Done well, ISO 37000 turns governance from a defensive, box-ticking exercise into an active driver of trust, resilience, and long-term value.