The organization has procedures which: call for every bribery case, or breach of the policy or system, that is reported, detected or reasonably suspected to be assessed and, where warranted, investigated; call for fitting action when an investigation establishes bribery or a breach; give investigators the power and means to do their work; oblige relevant personnel to cooperate; keep the anti-bribery function informed, along with other compliance functions where fitting, of where each investigation stands and what it found; and oblige investigations and what they produce to be kept confidential. Investigations are conducted by, and reported to, people independent of whichever role or function is being looked into, or by a business associate appointed to report to such people. Where the law forbids the confidentiality requirement, the organization documents that it cannot meet it; ISO/TS 37008 offers more guidance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.