The AML/CTF policies must provide for independent evaluations of the AML/CTF program at a frequency appropriate to the nature, size and complexity of the business and at least once every 3 years (s 26F(4)(f)). Rules 5-10 requires each evaluation to assess the steps taken in undertaking or reviewing the risk assessment and the design of the policies against the Act and Rules, to test compliance with the policies and whether the entity is appropriately identifying, assessing, managing and mitigating its risks, to produce a written independent evaluation report, and to deliver it to the governing body and the approving senior managers; the policies must say how the entity responds to the report.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.