The company must have procedures to evaluate the situation of its clients, first-tier suppliers and intermediaries in light of the risk map; the AFA recommends also covering acquisition targets and sponsorship or patronage beneficiaries. Depth follows homogeneous risk groups drawn from the map (none or simplified for low-risk groups, in-depth for high-risk), with each third party in a group evaluated individually. The formalised procedure collects identity data, shareholders and beneficial owners, sanctions and debarment list checks, open-source and database searches, adverse information on the third party and its managers, qualifications and experience, interactions with public officials and PEPs, and assesses risk factors (success fees, pay inconsistent with market price, unjustified use of intermediaries, third parties recommended by a client, bank accounts in non-cooperative jurisdictions, cash or cross-border payments, country risk, refusal to provide information). Staff decide low-risk cases, compliance supports the riskier ones and the governing body decides the highest-risk ones; the decision (approve, approve with enhanced vigilance, refuse or end, postpone) and its authors are recorded (paragraphs 201 to 240).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.