Policies
Read EthicsPortal policies on information security, business continuity and risk management, with links to internal audit and management review records.
Last updated: 2026-09-24.
Named policy documents that codify how EthicsPortal operates. Each is dated, signed, and reviewed annually.
The full document catalog — including these policies alongside contractual and operational documents — is on /trust/.
Risk register
EthicsPortal's information-security risk register. Top risks assessed against the Service, current treatment, and residual position.
Management review record
ISO/IEC 27001 Clause 9.3 management review of EthicsPortal. No reportable security incident in the period; two risks re-assessed to a worse residual position after supplier assurances were found unverified. Inputs, conclusions, and the decisions taken.
Internal audit record
First internal audit of EthicsPortal against ISO/IEC 27001:2022 found no control failures. Six documentation defects were raised and all six were corrected before the audit closed. Programme, findings, and the limits of a self-performed audit.
Information security policy
EthicsPortal's information security policy. Scope, roles, control commitments, review cadence, and document control.
Business continuity plan
How EthicsPortal responds to outages, sub-processor failures, restore events, and operator incapacity. Activation triggers, decision authority, and customer-communication protocol.
Anti-corruption and business ethics policy
EthicsPortal's anti-corruption policy. Prohibited conduct, gifts and hospitality thresholds, conflicts of interest, referral fees, and the limits of a single-operator control environment.