The company must have a system to control and evaluate internally the measures it has implemented. The AFA expects first-level controls (formalised and documented, by operational staff before decisions), a formal second-level control plan drawn up by the compliance officer covering the whole programme (object, scope, owners, method, sampling, frequency, reporting, evidence retention), and third-level internal audits by independent auditors mandated by and reporting to the governing body, producing documented reports with corrective measures, for each of the Article 17 measures (risk map, code, training, third parties, alerts, accounting controls, disciplinary regime), and for any additional measures the company has adopted (paragraphs 61 to 68 and 317 to 337).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.