Management should ensure involvement of legal counsel in resolution of legal issues, and provide for retention of reported information for the times specified by law and best practice standards. This mechanism must provide the ability to remove implicated parties, their peers and subordinates from the review process.

If a violation of law has been detected, the entity must take reasonable steps to respond appropriately and to prevent further similar violations, including making any necessary modifications to the entity's program. Mitigation of penalties under U.S. Federal Sentencing Guidelines is not available if an organization unreasonably delays reporting the offense to appropriate governmental authorities. The issue management system should provide a process to determine whether such a report will be made and to allow the organization to do so in a timely fashion.