Where top management delegates decisions that carry a bribery risk above low, the organization establishes and maintains controls, or a process for making such decisions, which ensure that the process and the authority level of the person deciding are suitable and that no actual or potential conflict of interest is present. As part of its responsibility under 5.3.1, top management has these processes re-examined on a planned schedule. Handing decisions down leaves the leadership and role duties of the board-level body and of top management where they were, and it does not necessarily move legal liability onto the person who now decides.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.