The company must implement and monitor the plan (with authorities, upstream companies, international and civil society organisations and affected parties as appropriate), consider community monitoring networks, report progress to senior management who confirm or revise the strategy, and implement the sanctions part of the plan; immediate disengagement is expected for serious human rights abuses and support to non-state armed groups, other risks should show significant measurable improvement within six months, and failed mitigation leads to disengagement for at least three months; suspicious transactions and criminal behaviour are reported to law enforcement. Information gathering and risk assessment (Steps 2B and 2C) must be repeated after mitigation and whenever circumstances change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.