The org self-audit
Your ethicist might be ready. Is the organisation around them?
Eight statements about mandate, escalation, and evidence, not about any one person's competence, because a brilliant ethicist with no authority is just a very qualified person talking to a wall. Answered honestly, it takes about five minutes.
What this is, and is not. A self-audit we wrote ourselves, not a certification and not a regulator's checklist, and we will tell you plainly where it stops.