The policies must require each independent evaluation to assess the steps taken to undertake or review the ML/TF risk assessment and the design of the AML/CTF policies against the Act, regulations and Rules; to test compliance with the policies; and to test whether the entity is appropriately identifying, assessing, managing and mitigating its ML/TF/PF risks. The evaluator must produce a written independent evaluation report with findings on each matter, delivered to the governing body and to any senior manager responsible for program approvals, and the policies must say how the entity will respond to the report.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.