Due diligence on those who perform or will perform services for the organisation is proportionate and risk based: light for low-risk services, deeper for intermediaries in foreign markets, local agents imposed by local law and mergers or acquisitions, using direct enquiries, indirect investigation or research, verification of background and references, and continued monitoring of engaged persons (MoJ Principle 4, paras 4.1 to 4.5).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.