The AFA expects the internal investigation procedure to be defined before any investigation (triggers and conduct), investigators designated by the governing body and bound by formal strict confidentiality, care over preserving evidence, regular checks on outsourced investigators, the governing body informed of the most sensitive investigations unless implicated, a written report recording facts and evidence for and against, the method and the conclusion, transmission to the governing body (or the control body if management is implicated) where suspicions are substantiated, disciplinary sanctions where a breach is shown, and lessons fed into the risk map, training, code and third-party evaluations (paragraphs 265 and 270 to 279).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.