For example , management approval was needed before individuals could share information about potentially sensitive incidents and vulnerabilities .
Management approval was not needed to submit a report