More mature firms have phased in formal protocols, with ethics officers, risk committees, and other structures that oversee how data are collected and used, though not always successfully (indeed, they often depend on trial and error). Small new companies may have neither such protocols nor the people – for example, independent board members – to impose them.