Decisions across the organization should rest on suitable delegation (4.2.2) made formal through assurance processes. The governing body should make sure that authority is in line with the responsibility carried for each decision, that the limits on decision-making authority reflect the risk involved, especially where decisions are automated, and that information arrangements (access to information, monitoring, and the ability to correct wrong decisions) are adequate to keep the organization within its own requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.