A company's primary obligation upon receiving a report of a violation is to preserve the report itself. This action creates an official, auditable record that the company was notified of a potential issue. Preserving the report is a fundamental element of due diligence and corporate governance, forming the basis for any subsequent investigation, assessment, or legal action. It ensures accountability and demonstrates that the company has a formal process for handling such communications, which is a core principle in frameworks governing internal controls and compliance management systems.

A. The obligation is to preserve relevant evidence, not "all evidence." The scope of what is relevant is determined during the investigation, making this statement overly broad.

C. Companies have significant legal, regulatory, and ethical obligations when receiving violation reports; therefore, this option is incorrect.

1. ISO 37002:2021, Whistleblowing management systems — Guidelines. Clause 8.4, "Records," specifies that the organization should maintain records to demonstrate the effective operation of its whistleblowing management system. This inherently includes the initial reports of wrongdoing, stating, "Records to be maintained should include... a) reports of wrongdoing received." This establishes the preservation of the report as a foundational requirement.

2. The Committee of Sponsoring Organizations of the Treadway Commission (COSO), "Internal Control – Integrated Framework: Executive Summary" (May 2013). The "Information and Communication" component (pages 5, 14) emphasizes that an organization must obtain or generate and use relevant, quality information. A report of a violation is a critical piece of information that must be captured and processed through established communication channels to enable the entity to carry out its internal control responsibilities.

3. Sent-Grau, S., & Cifuntes, R. (2021). "The relevance of the ISO 37002 standard on whistleblowing management systems for organizations." The Routledge Companion to Trust. In discussing the implementation of whistleblowing systems like ISO 37002, the authors highlight that the initial and most crucial step after receipt of a report is its formal logging and preservation to trigger the established internal procedures. This underscores that preserving the report precedes and enables all other actions. (DOI not available for book chapter, but concept is central to the standard's implementation).