Every registered provider must implement and maintain a whistleblower system that supports Part 5 of Chapter 7, lets individuals disclose to the provider, a responsible person or a worker, orally, in writing and anonymously, and is reviewed at least annually (Rules 165-45); document it, give it to workers and responsible persons, train them (including on the penalty for revealing a discloser's identity) at induction, on change and at least annually, and say at least monthly that disclosures are welcome (165-50); and keep and publish a whistleblower policy explaining the protections, where and how disclosures may be made (including to the Commission, the Department, police and advocates), how the provider manages and investigates them, supports disclosers and treats those named fairly, how it meets section 553, and what a discloser can do if victimised, given and explained to individuals, supporters and anyone who asks, translated where needed (165-55). Each qualifying disclosure is managed through the system with prompt appropriate action, support for the discloser and associated persons, and fair treatment of workers named (165-60); a discloser may elect to have it handled as a complaint instead (165-35(3) and (4)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.