Where due diligence on a particular transaction, project or activity, or on a particular business associate relationship, shows that current controls cannot handle the bribery risk, and the organization either cannot or chooses not to add or reinforce controls or restructure the arrangement so that the risk becomes manageable, it must act in proportion to the risk: if the matter is already in progress, it ends, stops, suspends or pulls out of it as soon as it practicably can; if the matter is only proposed, it defers it or declines to go ahead.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.