When top management delegates decisions whose bribery risk is above low, the organization sets up and keeps a decision process or controls ensuring that both the process and the decision-maker's level of authority are appropriate and that no actual or potential conflict of interest affects them. Top management has these processes reviewed periodically as part of its 5.3.1 responsibility. Delegating a decision does not take away the duties of top management or the governing body, and does not necessarily move legal liability to the delegate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.