Policies

Named information-security, business-continuity, and risk-management policies for EthicsPortal.

• Risk register

  EthicsPortal's information-security risk register. Top risks assessed against the Service, current treatment, and residual position.

• Management review record

  ISO/IEC 27001 Clause 9.3 management review of EthicsPortal. No reportable security incident in the period; two risks re-assessed to a worse residual position after supplier assurances were found unverified. Inputs, conclusions, and the decisions taken.

• Internal audit record

  First internal audit of EthicsPortal against ISO/IEC 27001:2022 found no control failures. Six documentation defects were raised and all six were corrected before the audit closed. Programme, findings, and the limits of a self-performed audit.

• Information security policy

  EthicsPortal's information security policy. Scope, roles, control commitments, review cadence, and document control.

• Business continuity plan

  How EthicsPortal responds to outages, sub-processor failures, restore events, and operator incapacity. Activation triggers, decision authority, and customer-communication protocol.

• Anti-corruption and business ethics policy

  EthicsPortal's anti-corruption policy. Prohibited conduct, gifts and hospitality thresholds, conflicts of interest, referral fees, and the limits of a single-operator control environment.