The Stage One audit confirms that a practice statement exists under Clause 5, assesses it and its supporting documents against the five core characteristics and decides readiness for Stage Two. It verifies the statement is complete, up to date, approved and either public or publicly summarised; reviews governance, authority and record keeping; confirms the declared boundaries, contexts, data dependencies, assumptions and exclusions; reviews configuration management including who controls settings, change control for minor and major changes, and the credibility of external evidence. It confirms the client is a lawfully constituted entity, free of restrictions on operating, holds current regulatory approvals and licences, and has disclosed enforcement actions, sanctions or investigations; that no consultancy relationship exists between the conformity assessment body and the client and the client has disclosed conflicts of interest; that the statement addresses data protection obligations in the jurisdictions of use, the item adheres to recognised privacy frameworks (ISO/IEC 27701, 29100, GDPR or equivalent) and data subject rights can be exercised; that risks including misuse and harm to individuals are considered, assumptions and exclusions are risk-based, and the declared attack vectors are mitigated; whether recognised management systems are held and accredited, weighted under Clause 5.9; and that processes exist for ongoing monitoring, internal review and improvement, and timely notification of major changes. Nonconformities are closed before Stage Two, and the Stage One report records findings and the readiness determination.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.