All risks identified in Step 2 must go, continuously, to the senior manager accountable for due diligence. The company must adopt a risk management plan choosing to continue trading during measurable mitigation, suspend temporarily while mitigating, or disengage where mitigation is not feasible or acceptable; where it does not disengage, the plan must aim at progressive improvement within reasonable timescales with measurable outcomes, built through leverage over the actors best placed to act and through consultation with suppliers, local authorities, civil society and affected stakeholders; it must cover sanctions risks, including notifying them in the annual report and to customers, and be published with due regard to confidentiality. Precious group metal processors must also tighten controls: closer supplier engagement, traceability per input, physical security of shipments and contractual rights to unannounced spot-checks.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.