How top management reviews the compliance management system. It is rated on two dimensions, each against the five-level scale in 5.2. Policy and procedures with conduct and culture: level 1, no procedures; level 2, incomplete procedures not implemented or implemented inconsistently; level 3, comprehensive procedures established that specify frequency and responsibilities, method, process and planning, and the content required by ISO 37301, with reviews in all business areas and documented results and corrective measures, implemented in some business activities with documented information created and maintained; level 4, the level 3 procedures adjusted on past practice and implemented across the relevant business with documented information maintained and updated; level 5, the level 3 procedures fully embedded in organizational processes, continually monitored, evaluated, improved and adapted to changes in the internal and external context, with information from reviews analysed to trace root causes, identify weaknesses and gaps, and propose corrective measures, all documented. Results and impacts: level 1, none; level 2, inconsistent; level 3, partial or loosely aligned to the organization's size, nature, complexity, context and compliance obligations; level 4, aligned and proactively managed; level 5, review inputs are supported by data, review outputs show continual improvement of compliance performance or propose corrective measures to raise the system's effectiveness, the governing body and top management make a verifiable assessment of the system's effectiveness on the information received, opportunities for continual improvement and sustainability are recorded and their implementation regularly reviewed, and review results are shared with interested parties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.