Where a deviation or nonconformity arises, the organization should respond by acting to control and correct it and by handling what follows from it. It should then judge whether action is required to remove the cause, so the problem neither returns nor appears somewhere else, by examining and analysing what happened, finding the root causes, and establishing whether comparable cases exist or might arise; carry out whatever action is required; check that the corrective action worked; revise the opportunities and risks identified during planning where needed; and change the system where needed. Corrective action should be proportionate to the effects that were experienced. Documented information should be kept to show what the deviations and nonconformities were, what was done about them, and what the corrective action achieved.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.