The company must report annually on its due diligence (or integrate it into its sustainability report), covering its policy and that it has been assessed, the management structure, the system for gathering red flag information and how it strengthened due diligence, record keeping and disclosure to downstream actors; where Annex II assessment was needed, also its chain of custody and traceability system, the risk assessment methodology and results and risk management plan, the on-the-ground assessment methods and findings, the steps taken to manage risks with stakeholder involvement and training, and monitoring efforts; it must publish the audit firm's name and, directly or through RMI, a summary audit report, all with due regard to confidentiality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.