An initial organisational assessment

1. Regulatory Concept & Core Standards

In this video we will consolidate a skill: produce an initial assessment with priorities and evidence of compliance. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. An integrity programme connects risks, behaviour, controls and reporting channels. The obligation to protect whistleblowers must be assessed under national law. The prevention measures used in the examples are good practice unless identified as a specific legal obligation applicable to the organisation.

An initial assessment compares applicable requirements with verifiable practice. It must distinguish missing documents, outdated documents and measures that exist but are not implemented. These situations require different responses. Priorities should reflect the risk, the unmet obligation and implementation capacity. An internal colour-coding system can organise the work, but it is not an official compliance assessment.

Apply the following rule: The Act covers reporting crime and other anti-social activity in an employment or analogous relationship. Section 2 includes relevant pre-contractual and ended relationships. Distinguish a report, a qualified report of serious anti-social activity and formal protected-whistleblower status. Status under section 4 or 6 does not arise automatically when a form is sent. Good faith is assessed against information available when reporting.

2. Practical Implementation & Procedure

Gather the entity's legal assessment, risk plan, code, training records and channel procedures. For each item, record evidence, the gap, the responsible person and a proposed completion date. Perform a practical check: for example, confirm that access to the channel works. Record what you observed and what you could not verify. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A fictional company has a recent risk plan, an old code and a channel link that no longer works. Training records exist but do not identify the audiences covered. The team prioritises restoring the channel, checks the code and assesses training coverage without declaring the programme complete. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Should the assessment produce a folder of documents or a plan of verifiable actions? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

A plan of verifiable actions supported by the documents reviewed. Each gap needs an owner, a priority and evidence that it has been resolved. Proposed dates are management commitments and do not change applicable statutory deadlines.

One mistake to avoid is: marking a requirement as met merely because someone says it has been dealt with.

Now apply the national rule to a second decision. The system automatically marks a report as protected because it contains the word corruption. What was not checked?

Assess facts, the relationship, good faith and statutory conditions. The form label does not determine a qualified report or formal protected status. Receiving information, examining it and granting specific protection are different tasks. Clarify missing facts securely and only as needed.