At the assessment stage the organization should weigh the risk that the whistleblower or others involved will suffer detriment and put preventive measures in place before harm occurs, rather than waiting for retaliation to be reported. The questions include how difficult keeping the whistleblower's identity confidential will be, who besides the whistleblower is aware of the wrongdoing, whether the whistleblower took part in the wrongdoing or is its target, who might retaliate and whether the whistleblower expects retaliation and from whom, how the whistleblower and the reported person are connected, and whether the whistleblower is in a vulnerable position (for example a young person, a migrant worker, a person with a disability or another characteristic or status); the answers decide the proactive and reactive protection needed (5.3.2: comprehensive assessment of the risks of detriment). The substance comes from the convenor's guidance and the SUSA items built on the standard (triage that includes a retaliation risk assessment; assessment of groups particularly vulnerable to reprisal); the clause text is not held.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.