The organization carries out bribery risk assessments at planned intervals. Each assessment identifies the bribery risks it could reasonably foresee in light of the 4.1 factors, analyses, assesses and ranks them, and evaluates whether current controls are appropriate and effective in reducing them (4.5.1). The organization sets criteria for evaluating the level of bribery risk, taking its own policies and objectives into account (4.5.2). It reviews the assessment at planned intervals, with a timing and frequency it determines, and whenever its structure or activities change significantly (4.5.3). It keeps documented information showing that the assessment was carried out and was used to design or improve the system (4.5.4).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.