Reporting Channel and Reporting Mechanism Standard

Organization: Igzibo Engineering Solutions, Inc.
Version: 1.0
Status: Living standard
Effective Date: September 16, 2026
Owner: Igzibo Engineering Solutions, Inc.
Review Cycle: At least annually and after material changes to reporting channels, organizational structure, technology, applicable law, or reporting requirements.

1. Purpose

This standard establishes requirements for maintaining a designated mechanism through which employees, contractors, candidates, suppliers, clients, recruiting partners, and other relevant parties can submit concerns to Igzibo.

It supports the Ethics and Compliance Reporting Procedure by defining minimum requirements for the reporting channel without making a particular vendor or communication platform mandatory.

2. Scope

This standard applies to the organizational reporting mechanism used for:

• Ethics concerns.
• Compliance concerns.
• Suspected policy violations.
• Retaliation concerns.
• Recruiting concerns.
• Supplier or partner concerns.
• Privacy concerns where the reporting mechanism is appropriate.
• Other matters designated for organizational reporting.

Specialized reporting mechanisms may exist for security incidents, privacy rights requests, client incidents, or other matters.

Definitions

• Designated Reporting Channel: The officially maintained method through which concerns may be submitted to Igzibo.
• Igzibo: Igzibo Engineering Solutions, Inc.
• Reporting Mechanism: The technical, administrative, or communication process used to receive and route reports.
• Reporter: A person who submits a concern.
• Sensitive Report: A report involving allegations, personal information, confidential information, security information, or other information requiring controlled access.

4. Channel Requirements

Igzibo must maintain at least one designated reporting channel.

The channel should be:

• Published to relevant stakeholders.
• Reasonably accessible to intended reporters.
• Monitored by an authorized person or process.
• Protected against unauthorized access.
• Capable of recording or preserving submitted reports.
• Supported by an escalation mechanism.
• Reviewed periodically for availability and effectiveness.

5. Channel Ownership

The reporting channel must have an identified owner responsible for:

• Maintaining the channel.
• Monitoring submissions.
• Controlling access.
• Routing reports.
• Maintaining appropriate records.
• Escalating material concerns.
• Coordinating alternate intake when the channel is unavailable.

The channel owner must not use channel access to investigate or influence a report when doing so creates a material conflict of interest.

6. Access Control

Access to submitted reports must be limited to authorized persons with a legitimate need to know.

The reporting mechanism should use:

• Individual accounts where applicable.
• Appropriate authentication.
• Access controls.
• Logging where supported and appropriate.
• Secure transmission and storage.
• Periodic access review.

Sensitive reports should not be forwarded broadly through ordinary communication channels.

7. Submission Information

The reporting mechanism should permit a reporter to provide, when available:

• Description of the concern.
• Date or period.
• People or organizations involved.
• Relevant project, client, system, or contract.
• Supporting information.
• Contact information, if the reporter chooses to provide it.
• Information concerning immediate risks.

The mechanism should not require information that is unnecessary to receive a report.

8. Anonymous Reporting

Where operationally feasible and legally appropriate, the designated mechanism may support anonymous reporting.

If anonymous reporting is supported, the mechanism should provide a reasonable means to preserve the report and, where technically possible, permit follow-up without requiring the reporter to disclose identity.

9. Alternate Reporting

A person should have an alternate reporting route when the designated channel is unavailable or when the person reasonably believes the channel owner is involved in the concern.

Alternate routes may include:

• A designated executive.
• Another authorized compliance contact.
• Legal counsel.
• A client-specific reporting channel.
• A government or regulatory authority where permitted or required by law.

10. Availability and Continuity

The reporting mechanism should have reasonable availability and continuity controls appropriate to its importance.

If the primary mechanism becomes unavailable, the channel owner should provide or activate an alternate method.

Reports must not be intentionally delayed because the primary technical mechanism is unavailable.

11. Privacy and Confidentiality

The reporting mechanism must be operated consistently with:

• Privacy Notice.
• Employee and Contractor Privacy Notice.
• Candidate and Applicant Privacy Notice.
• Data Classification and Handling Standard.
• Records Retention and Disposal Standard.

The mechanism should collect and expose the minimum information reasonably necessary for intake and handling.

Confidentiality should be protected but cannot be guaranteed where disclosure is required by law or necessary for an authorized investigation.

12. Security Incidents

If a report identifies a suspected security incident, unauthorized access, data exposure, credential compromise, or similar event, the matter must be routed to the Security Incident Response Procedure as appropriate.

The reporting channel must not become a substitute for an emergency or security incident process when immediate action is required.

13. Monitoring and Review

The channel owner should periodically verify:

• The channel remains accessible.
• Submissions are being received.
• Authorized personnel can access reports.
• Alternate routing remains available.
• Access remains appropriate.
• Published contact information remains current.
• Records are being handled according to retention requirements.

Testing should avoid creating unnecessary false reports or exposing real sensitive information.

14. Records

Reporting-channel records must be retained and disposed of according to the Records Retention and Disposal Standard.

Access logs and administrative records should be retained when needed to demonstrate appropriate operation or investigate misuse.

15. Changes to the Reporting Mechanism

Material changes to the reporting mechanism should be reviewed before implementation.

Changes should consider:

• Security.
• Privacy.
• Availability.
• Access control.
• Record preservation.
• Reporter accessibility.
• Integration with the Ethics and Compliance Reporting Procedure.
• Applicable contractual or legal requirements.

16. Roles and Responsibilities

Channel Owner

Maintains the reporting mechanism and ensures reports are routed appropriately.

Technology or Service Owner

Maintains technical security, availability, and access controls where a technology service supports the mechanism.

Compliance or Ethics Owner

Maintains the operational reporting process and coordinates intake and escalation.

Personnel

Use the designated channel or an appropriate alternate route to report concerns.

17. Exceptions

Exceptions require documented authorization and must not impair legally protected reporting rights or violate applicable law.

18. Relationship to Other Governance Documents

This standard supports:

1. Ethics and Compliance Reporting Procedure.
2. Code of Business Conduct and Ethics.
3. Privacy Notice.
4. Employee and Contractor Privacy Notice.
5. Candidate and Applicant Privacy Notice.
6. Data Classification and Handling Standard.
7. Records Retention and Disposal Standard.
8. Security Incident Response Procedure.
9. Technology and Third-Party Service Security Standard.
10. Technology and Third-Party Service Approval Procedure.

Version History