How the organization reacts when a nonconformity or noncompliance occurs, including correcting it. It is rated on two dimensions, each against the five-level scale in 5.2. Policy and procedures with conduct and culture: level 1, no procedures; level 2, incomplete procedures not implemented or implemented inconsistently; level 3, comprehensive procedures established that specify review of every nonconformity and noncompliance, determination of causes and of the likelihood of recurrence or occurrence in other functions, development and implementation of controls and corrective actions, and review of their effectiveness, with actions actively managed and documented, implemented in some business activities with documented information created and maintained; level 4, the level 3 procedures adjusted on past practice and implemented across the relevant business with documented information maintained and updated; level 5, the level 3 procedures fully embedded in organizational processes, continually monitored, evaluated, improved and adapted to changes in the internal and external context, with corrective measures of a similar level applied organization-wide to nonconformities and noncompliance of similar nature, type and consequence. Results and impacts: level 1, none; level 2, inconsistent; level 3, partial or loosely aligned to the organization's size, nature, complexity, context and compliance obligations; level 4, aligned and proactively managed; level 5, nonconformities and noncompliance are identified soon after they occur, proactive measures prevent recurrence or occurrence elsewhere, and where the governing body and top management oversee business areas in which noncompliance occurred, appropriate monitoring procedures implement the controls and corrective measures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.