The company must have an internal alert system to collect reports from employees about conduct or situations contrary to its code of conduct. The AFA recommends a single technical reporting channel for all legal alert regimes, open to external and occasional staff, deployed across all controlled entities, presented to new joiners and in the code, secured with access limited to authorised handlers, allowing anonymous reports with continued dialogue, naming the referent who receives and the one who treats reports, guaranteeing confidentiality with disciplinary consequences for breaches, acknowledging receipt promptly, informing the reporter of closure, and reporting indicators (reports received, closed, handled, time taken) to the governing body; outsourced handling is allowed with regular checks (paragraphs 251 to 269 and 280).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.