Weaknesses found through controls and audits are analysed to identify their origin and give rise to corrective measures in action plans that restate the weakness, detail the actions, name those responsible and set deadlines; progress is monitored regularly and reported to the governing body (paragraphs 75 to 77 and 338). The July 2026 sanctions decision assessed breaches at the date of the AFA audit report, so remediation after an audit does not erase them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.