Undertakings must have written policies covering, as a minimum, risk management, internal control and internal audit, plus outsourcing where they outsource, implement them, review them at least annually, have them approved in advance by the AMSB and adapt them after any significant change. Each policy must set out responsibilities, objectives, processes and reporting procedures consistent with the business strategy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.