Which of these is not a requirement of internal mechanisms for reporting wrongdoing within an organization?

A. They must be effective.
B. They must allow anonymity.
C. They must report to legal authorities.
D. They must protect the rights of the accused.