The assessment covers country, sectoral, transaction, business opportunity and business partnership risks (such as intermediaries dealing with foreign officials, consortia, joint ventures and politically exposed persons) and internal factors that add risk: weak training and knowledge, bonus cultures rewarding excessive risk, unclear hospitality and donation rules, weak financial controls and a missing message from the top (MoJ Principle 3, paras 3.5 and 3.6).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.