When an organization decides to exclude an individual from participation in its operations following a compliance violation, it must first check the: