Certification has to be carried out impartially, and the body carries responsibility for keeping it that way against commercial, financial or other pressure. It must look for risks to impartiality as its activities and relationships change, including the relationships of its people. A relationship is not automatically a risk, but it has to be considered. Where a risk is found, the body must be able to demonstrate how it removed or reduced it, and that demonstration goes to the impartiality mechanism. Top management must show commitment. The body, together with any part of its legal person and any entity it controls, must not design, make, install, distribute or maintain the certified product, design or run the certified process, design or provide the certified service, or offer consultancy to its clients. Where the scheme evaluates a management system, management system consultancy and internal audit are also barred. Separate legal entities with which the body has a relationship must not compromise its impartiality, and where such an entity produces the product or offers consultancy, the people who manage, review or decide certification must stay out of that entity's work. Marketing must not link certification to a consultancy in a way that suggests the certificate is easier or cheaper with that consultancy. A person who has consulted for a client cannot review or decide that client's certification until a defined period has passed. The body must respond to risks created by other parties, and everyone who can influence certification must act impartially.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.