The company must maintain a risk map: regularly updated documentation to identify, analyse and rank its exposure to external solicitations for corruption, notably by business sector and geography; the AFA reads it as covering influence peddling too (paragraph 117). The AFA expects a map built from an analysis of all managerial, operational and support processes that involve third parties, covering the whole controlled perimeter, through six steps: roles and responsibilities (governing body sponsors and validates, the compliance officer coordinates, process owners identify their risks); identification of risk scenarios through workshops and interviews with staff of all levels, taking account of countries, sectors, strategic transactions, third-party types, politically exposed persons, sales pressure, payment terms and past incidents; assessment of gross risk by impact, probability and aggravating factors using a homogeneous method; assessment of net risk after existing controls; ranking with a documented acceptability limit and an action plan with named owners and deadlines (paragraphs 116 to 150).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.