The R10 risk assessment must be written down together with what it concluded and any measures adopted because of it to prevent backflow, and that documentation must be kept and given to the Regulator if asked for. The guideline notes that C68 requires the records to be maintained.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.