If the code of conduct provides for a contributor to use discretion in contributing input data, it shall require the contributor to establish policies on the use of discretion that specify at least the following:
((a))
the circumstances in which the contributor may exercise discretion;
((b))
the individuals within the contributor's organisation who are permitted to exercise discretion;
((c))
the internal controls that regulate the exercise of the contributor's discretion in accordance with its policies;
((d))
the individuals within the contributor's organisation who are authorised to conduct an ex post evaluation of the exercise of discretion.