As the sexual abuse scandal surrounding Cardinal Theodore McCarrick continued to spread in the past week, Cardinal Sean O’Malley, who heads the Catholic Church’s Pontifical Commission for the Protection of Minors, acknowledged that “a major gap still exists in the church’s policies on sexual conduct and sexual abuse.”

O’Malley, who is also the archbishop of Boston, noted that while the church has a zero-tolerance policy for the sexual abuse of minors by priests, there is a need for clearer norms and procedures for investigating and judging bishops. But O’Malley’s statement raises further questions.

Who will set the norms for bishops?

Under canon law today, only the pope has authority over bishops and cardinals, although there were examples of bishops being tried by provincial councils in the ancient church. That is why only priests and deacons are subject to the norms and procedures set by U.S. Catholic bishops for dealing with accusations of sexual abuse. The bishops conference does not have the authority to set norms for their own bishops.

The pope needs to publish norms making clear that there will be zero tolerance for bishops who abuse children or allow abusive priests to continue in ministry. The McCarrick case also shows the need for zero tolerance for a bishop who has sex with his seminarians or priests. Any bishop involved in these activities should lose his office. Any cardinal should lose his red hat. There is no reason the pope could not publish these norms immediately.

Who will investigate allegations against a bishop?

The church needs better ways of investigating allegations against bishops. True, Archbishop Charles J. Scicluna of Malta has done an excellent job investigating cases for the Vatican, but there are few other clerics up to the task. A degree in canon law does not equip a person to handle such cases.

Smart American bishops use laypersons with expertise in investigating sex crimes — for example, detectives and retired police officers. The Vatican should do likewise.

Local police and courts should, of course, deal with criminal cases, even for bishops. When McCarrick was accused of abusing a minor in New York, it was reported to the police.

Pope Francis also empowered the Archdiocese of New York to conduct its own investigation, treating McCarrick like any other priest. The archdiocese hired an independent forensic agency, whose findings were given to the archdiocesan review board, which found the accusations “credible and substantiated.” That conclusion was then sent on to the Vatican.

This process worked, however, because McCarrick was already retired. A sitting diocesan bishop would be investigated by his own investigators and reviewed by his own review board, whose findings would not be credible. Someone outside the diocese, normally the Vatican, must do the investigation.

Who will judge an accused bishop?

Because only the pope can judge a bishop, O’Malley’s commission recommended in June 2015 that a new Vatican tribunal be established to investigate accused bishops and give its conclusions to the pope. Francis at first agreed to this recommendation, but Vatican officials talked him out of it. The actions of bishops continue to be handled by the traditional Vatican offices, such as the Congregation for Doctrine of the Faith, the Congregation for Bishops and the Congregation for Evangelization of Peoples for missionary territories.

Critics have complained that the latter two offices are involved in the appointment of bishops and therefore may be reluctant to find guilt in a bishop they appointed in the first place.

The pontifical commission’s recommendation was correct. There is need for a Vatican entity to deal with bishops who have been accused of abuse or of not stopping abusive priests; the problem is common enough that a permanent Vatican agency is required.

In short, the church, which has never been very good at HR, needs to get its act together on sex in the workplace. It can learn from secular organizations that have had to develop best practices. It can adapt policies and procedures developed by psychologists and counselors to design its own ways of dealing with inappropriate sexual activity between priests and parishioners.

In his July 24 statement, O’Malley called for three actions: “First, a fair and rapid adjudication of these accusations; second, an assessment of the adequacy of our standards and policies in the church at every level, and especially in the case of bishops; and third, communicating more clearly to the Catholic faithful and to all victims the process for reporting allegations against bishops and cardinals.”

While the cardinal’s recommendations make eminent sense and should carry weight with the pope, who trusts him, there is a need for greater specificity in these recommendations.

What would an “assessment of the adequacy of our standards” involve and how long is it going to take? Who will do it? What does he mean by “transparent and consistent protocols”? What might we get from the church that we don’t already have now?

O’Malley’s commission has already worked on these questions. It needs to continue this work expeditiously, and the pope needs to listen to it.