Every Commonwealth entity's accountable authority is bound to do whatever is reasonable to stop, uncover and respond to fraud and corruption connected with the entity. Part of that minimum standard is a risk cycle: fraud and corruption risks are assessed on a regular schedule and again whenever the entity's structure, functions or activities change substantially; a control plan that treats those risks is developed, put into effect and brought up to date as soon as practicable after each assessment; and the effectiveness of the entity's fraud and corruption controls is reviewed from time to time.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.