The practice statement may cite other certifications, accreditations or component test results, such as management system certification (ISO 9001, ISO/IEC 27001, 27701, 42001), product certifications under ISO/IEC 17065 schemes such as ISO/IEC 30107 presentation attack detection, assessments by accredited bodies and other audit or test reports. The auditor assesses their relevance, credibility and applicability and applies the weighting policy: substantial weight for an ILAC, IAF or EA member-accredited body acting within its accreditation scope (certificate validity, standards and mapping confirmed), significant weight for such a body acting outside scope (impartiality and competence verified, methods clarified), limited weight for non-member-accredited bodies (full reports reviewed, further testing decided), and treatment as internal audit evidence for consultant reports, SOC 2 and similar second-party sources. External evidence never confers automatic conformity; it counts only where mapped to ISO/IEC 27566-1 and the scheme rules. Where the statement relies on external certification, the client has 14 days to tell the conformity assessment body if it is suspended, reduced, withdrawn or expired, subject to regulatory action or adverse findings, or changed so that it no longer covers the declared functions; this is a major change and may trigger an intervening audit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.