If the code of conduct provides for a contributor to use discretion in contributing input data, it shall require the contributor to establish policies on the use of discretion that specify at least the following:
the circumstances in which the contributor may exercise discretion;
the individuals within the contributor's organisation who are permitted to exercise discretion;
the internal controls that regulate the exercise of the contributor's discretion in accordance with its policies;
the individuals within the contributor's organisation who are authorised to conduct an ex post evaluation of the exercise of discretion.