For all personnel, procedures ensure that: employment terms oblige compliance with the fraud control policy and system and allow discipline for failing to comply; new personnel receive the policy, or access to it, and training on it within a reasonable time of starting; disciplinary action can be taken against those who breach the policy or system; nobody faces retaliation, discrimination or discipline (such as threats, being isolated or demoted, having promotion blocked, being moved or dismissed, being bullied or victimized, or any other harassment) for refusing an activity they reasonably judge to carry an unmitigated fraud risk, or for raising in good faith or on reasonable belief attempted, actual or suspected fraud or breaches, unless they took part; and personnel know they must report actual and potential conflicts of interest. For positions exposed to more than a low fraud risk and for the fraud control function, procedures add: screening before hiring, transfer or promotion (8.2.7); review at planned intervals of bonuses, targets and other incentives for safeguards against encouraging fraud (8.2.6); and declarations confirming compliance with the policy and the system, from the people in those positions, from top management and from the governing body, at intervals proportionate to the risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.