Regulated firms must neither give nor take, directly or through others, anything capable of being a bribe; must have plans to comply with applicable anti-bribery and corruption laws and see that they are followed; must report activity suggesting anti-corruption laws will be breached (recording it where no local law applies); must carry out periodic written risk evaluations, with due diligence, of risks that could lead to facilitating bribery or corruption; and must document and retain how they meet the standard for later verification. (Recommended: an annually reviewed written policy and risk assessment, proportionate governance, a register of gifts, hospitality, travel, political and charitable payments and conflicts, staff guidance banning facilitation payments without head-office approval, bribes, price-fixing and undeclared conflicts, a compliance contact or champion, a code of conduct, and supplier due diligence.)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.