If a nonconformity arises, the organization shall respond to it and, where relevant, act to contain and fix it and to handle what it has caused. It shall judge whether action is needed to remove the underlying causes so the problem does not come back or appear somewhere else, by examining the nonconformity, finding out why it happened and checking whether comparable nonconformities already exist or might arise. It shall carry out whatever action is required, check whether the corrective action worked, and amend the PIMS where needed. Corrective action shall be proportionate to the impact of the nonconformity. The organization shall keep documented evidence of what each nonconformity was, what was done about it afterwards, and the outcome of the corrective action.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.