Where the risk assessment has identified a bribery risk above low for particular categories of transactions, projects or activities, for planned or current business associate relationships, or for personnel in particular positions (7.2.2.2), the organization evaluates how serious and how widespread the bribery risk is for the individual cases in those categories, carrying out whatever due diligence is required to obtain sufficient information. It repeats that due diligence as often as it has decided, so that fresh information and changes are picked up. The organization may decide that due diligence on some kinds of personnel or business associates would be unnecessary, unreasonable or out of proportion; the factors listed are examples, not a complete list (Annex A.10).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.