Draft a Do-No-Harm Protocol
Draft a do-no-harm risk identification and mitigation protocol for an evaluation or research activity.
Draft: Draft a Do-No-Harm Protocol
Fill In Your Details (5 Blanks)
Your Prompt (With Your Details)
This is the complete prompt, ready to copy and paste.
Evidence and applicability: use only supplied or verifiable evidence for historical facts, values, quotations, completed activities and approvals. Preserve conflicting sources with their provenance; do not choose a preferred value without adjudication. Mark missing evidence as unknown or not evidenced, not as proof an activity never occurred. Keep proposed plans and illustrative examples separate from findings. Never invent a baseline, quote, pilot, validation or sign-off to complete a template. Match methods to the purpose and population; a suitable single-method design is valid. Distinguish descriptive change from causal attribution. Check obligations in the applicable funding agreement rather than assuming a universal donor rule.
You are an expert in research ethics and do-no-harm protocol design. Draft a do-no-harm risk identification and mitigation protocol for a program or research activity. Tailor risks and mitigations to the population, context, and data collection methods involved.
Draft Requirements:
- Risk identification breadth. Identify physical, psychological, social, and economic risks separately for participants, communities, and data collection teams. Do not default to a single risk type.
- Context-specific risks. Name risks particular to the operating context (conflict, marginalization, surveillance, displacement) rather than relying on generic risk language.
- Mitigation specificity. For each identified risk, name a concrete mitigation step so the protocol is operationally usable.
- Escalation and response. Specify procedures for incident response and escalation, including who is contacted, on what timeline, and what immediate action is taken.
- Monitoring of risks. Build risk re-assessment into the activity timeline so emerging or changing risks are caught during implementation, not only at design.
Output Format:
Produce:
- A 1-paragraph context statement summarizing the activity and the highest-stakes risk categories.
- A risk register table: risk ID, risk type (physical/psychological/social/economic), affected party (participants/community/team), description, likelihood, severity, mitigation step, monitoring trigger, responsible person.
- An escalation and response protocol with named roles, contact procedures, and timelines for each incident type.
- A risk monitoring schedule tied to the activity timeline (pre-deployment, weekly during data collection, post-collection debrief).
- A 'stop-collection' decision rule identifying the conditions under which data collection is suspended.
This prompt involves designing protections for sensitive populations or sensitive data. Do not include identifying details of real respondents in your AI inputs.
Check: Score It with the Do No Harm Protocol Rubric
The Review Prompt
Paste the draft at the bottom of this prompt and run it. It scores each criterion from 1 to 5 and says why.
Use source evidence; retain unknowns/conflicts. N/A or missing evidence means no total. Critical ethics/validity failures block use at any score. Scores never authorize fielding or compliance.
You are an expert in research ethics and do-no-harm protocol design. Score the do-no-harm or risk identification and mitigation protocol I will provide using the rubric below. The document may be a standalone safeguarding protocol or a do-no-harm section embedded in a methodology, inception report, or MEL plan.
SCORING RUBRIC - Do No Harm Protocol Rate each dimension 1-5:
DIMENSION 1: Risk Identification Breadth
- Score 5: All four risk types are considered. Physical risks named (injury, exposure to violence, transport hazards, communicable disease, exhaustion). Psychological risks named (re-traumatization, distress from sensitive topics, stigma triggered by participation). Social risks named (community backlash, family conflict, loss of standing, retaliation from authorities or armed actors). Economic risks named (opportunity cost of time, loss of livelihood access, perceived favoritism that affects future aid). Risks named separately for participants, communities, and data collection teams.
- Score 4: At least three risk types considered. Participant-side coverage strong; team-side or community-side risks partial.
- Score 3: Two risk types addressed (commonly physical and psychological). Social or economic risks absent.
- Score 2: One risk type addressed in detail; others not named.
- Score 1: No risk identification across types.
DIMENSION 2: Context-Specific Risks
- Score 5: Risks particular to the operating context are named with specificity (active conflict, post-conflict transition, surveillance environments, refugee or IDP contexts, gender-based violence settings, repressive political environments, contested ethnic or religious settings). The protocol names how each context-specific risk applies to this activity. Local actors and dynamics that elevate risk are identified (armed groups, hostile authorities, gatekeepers, dominant clan or caste structures). Risks specific to marginalized identities in this context are addressed.
- Score 4: At least three context elements addressed. Conflict, marginalization, or surveillance considered; local actor mapping or identity-specific risks partial.
- Score 3: Context referenced but risks remain generic. Local actors not named.
- Score 2: Context mentioned in passing. No risk implications drawn.
- Score 1: No context-specific risk consideration.
DIMENSION 3: Mitigation Specificity
- Score 5: Each identified risk has a named mitigation step that is concrete and operational (not a principle). Mitigation is matched to risk severity and likelihood (greater risk receives stronger mitigation). Mitigation includes preventive measures (interviewer matching, neutral location, omission of high-risk questions) and reactive measures (referral pathway, support contact, withdrawal). Mitigation responsibilities are named (who does what). Mitigation steps are feasible given the team, budget, and context.
- Score 4: At least four elements present. Mitigation specific and matched to risk; responsibility assignment or feasibility partial.
- Score 3: Generic mitigation language. Some risks have a concrete step; others have a principle.
- Score 2: Mitigation listed as a principle ("we will minimize harm"). No concrete steps tied to risks.
- Score 1: No mitigation specified.
DIMENSION 4: Escalation and Response
- Score 5: Incident categories are defined (what counts as a safeguarding incident, a security incident, a participant distress event). For each category, escalation steps are specified (who is contacted, on what timeline, by what channel). Immediate-response steps are specified (what the team does in the first hour, before escalation completes). A confidential reporting channel exists (so that team members and participants can raise concerns without retaliation). Documentation of incidents is required, with named responsibility for follow-up.
- Score 4: At least four elements present. Escalation paths and immediate response clear; reporting channel or documentation partial.
- Score 3: Escalation mentioned but timelines or contacts unclear. Immediate response not specified.
- Score 2: General "report incidents to manager" language. No timelines, no immediate response, no confidential channel.
- Score 1: No escalation or response procedures.
DIMENSION 5: Monitoring of Risks
- Score 5: Risk re-assessment is scheduled at named points in the activity timeline (pre-fielding security check, mid-activity review, after-incident review, post-activity debrief). Triggers for ad-hoc re-assessment are named (security incident, contextual change, participant complaint). The team has a named role responsible for risk monitoring through the activity. Findings from re-assessment feed back into the protocol (the protocol is updated, not just reviewed). Risk monitoring is documented.
- Score 4: At least four elements present. Scheduled re-assessment and triggers in place; role assignment or documentation partial.
- Score 3: Risk monitoring stated as intention. No schedule, no triggers, no named role.
- Score 2: Risk treated as a one-time design step. No monitoring through implementation.
- Score 1: No risk monitoring.
OUTPUT FORMAT: Return your assessment as a table followed by a summary:
| Dimension | Score (1-5) | Evidence | Priority Revision |
|---|---|---|---|
| Risk Identification Breadth | |||
| Context-Specific Risks | |||
| Mitigation Specificity | |||
| Escalation and Response | |||
| Monitoring of Risks |
Total: X/25 Band: Strong (22-25) / Adequate (17-21) / Needs Revision (11-16) / Substantial Revision (5-10) Single Most Important Revision: [One specific sentence]
For any dimension scored 1 or 2, add a brief explanation and a concrete revision example.
PROTOCOL TO SCORE: [Paste your do-no-harm protocol here]
Fix: Revise What Scored Low
The Revise Prompt
Paste the draft and its scores at the bottom of this prompt. It revises the parts that scored below 4.
Use source evidence; retain unknowns/conflicts. N/A or missing evidence means no total. Critical ethics/validity failures block use at any score. Scores never authorize fielding or compliance.
You are an expert in research ethics and do-no-harm protocol design. Review the protocol I will provide and fix every problem that falls below the Good (4) threshold on the Do No Harm Protocol rubric.
WHAT TO LOOK FOR AND FIX:
Risk identification problems: Single risk type considered (often physical only). Team-side or community-side risks missing. Generic risk language not specific to the activity.
Context-specific risk problems: Generic risk treatment with no context. Local actors not named. Risks specific to marginalized identities absent.
Mitigation problems: Mitigation stated as a principle, not an operational step. Severity-to-mitigation match missing. Preventive or reactive measures missing. No responsibility assignment. Mitigation not feasible.
Escalation problems: Incident categories undefined. Timelines absent. Immediate-response steps absent. No confidential channel. No documentation requirement.
Monitoring problems: Risk treated as one-time design step. No re-assessment schedule. No triggers. No named role. No feedback loop.
OUTPUT FORMAT: For each problem found:
- Dimension: [which dimension]
- Location: [which section of the protocol]
- Problem: [one sentence describing what is wrong]
- Revised version: [the corrected text]
Then provide the complete revised do-no-harm protocol incorporating all corrections.
PROTOCOL DRAFT TO REVISE: [Paste your protocol draft here]