Have a documented process for receiving and evaluating complaints and making decisions on them, and describe it to any interested party that asks. When a complaint arrives, confirm whether it concerns activities the laboratory is responsible for and, if so, handle it, remaining responsible for every decision at every level. The process shall cover receiving and validating the complaint, investigating it and deciding what to do, tracking and recording complaints and the actions taken, and making sure suitable action follows. Collect and verify the information needed to validate the complaint. Wherever possible, acknowledge the complaint and tell the complainant how it is progressing and what the outcome is. The outcome shall be decided, or reviewed and approved, by people who had no part in the activities complained about. Wherever possible, tell the complainant formally when handling of the complaint has ended.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.