Through procedures, the organization requires each organization it controls to put in place, so far as reasonable and in proportion to the bribery risks it faces under the 4.5 assessment, either the organization's own anti-bribery system or anti-bribery controls of its own (8.5.1). For business associates outside its control that the risk assessment or due diligence identifies as presenting a bribery risk above low, and where controls on their side would help, the organization finds out whether they operate controls that manage that risk. If they have none, or this cannot be confirmed, it requires them, where practicable, to put controls in place for the relevant transaction, project or activity; where that is not practicable, the gap is weighed in assessing the relationship's risk (4.5, 8.2) and in deciding how to manage it under 8.3 to 8.5 (8.5.2).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.