This is a great point and it would be good to outline before work begins what types of actions would be taken in different scenarios.

Who would access the severity 9f the risks. Etc. If you find something how is it communicated to the community.?