How resources for the compliance management system are allocated. It is rated on two dimensions, each against the five-level scale in 5.2. Policy and procedures with conduct and culture: level 1, no procedures; level 2, incomplete procedures not implemented or implemented inconsistently; level 3, comprehensive procedures established that specify which resources, of what kind and how much, the system needs to be set up, developed, run, kept going and improved, the authority and responsibility for providing them, the approval process, the review of allocation, and the process for requesting and justifying additional or special resources, implemented in some business activities with documented information created and maintained; level 4, the level 3 procedures adjusted on past practice and implemented across the relevant business with documented information maintained and updated; level 5, the level 3 procedures fully embedded in organizational processes, continually monitored, evaluated, improved and adapted to changes in the internal and external context, with the procedures implemented in all relevant functions and documented information updated as allocation changes with need. Results and impacts: level 1, none; level 2, inconsistent; level 3, partial or loosely aligned to the organization's size, nature, complexity, context and compliance obligations; level 4, aligned and proactively managed; level 5, resource planning takes account of the results of compliance risk assessment, monitoring, internal audit and corrective action, resources are understood broadly to include personnel, technical support, external legal advice and information collection and communication, the resources for compliance management and its improvement are judged sufficient and appropriate, and adjustments to changing needs are justified and evidenced in documented information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.