For every business process the organization has to analyse and decide what records will be created and captured, when that happens and how. The analysis has to be documented and authorized by top management. This is the appraisal step moved into the main text: it decides which activities leave evidence, which record is the authoritative one, what metadata it needs and at which point in the process it is captured. If this analysis is weak, every later control is working on the wrong records.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.