The Stage Two audit at minimum cross-checks reported results against raw data, logs and configuration records and replicates tests by spot-check where feasible; observes the item operating in a representative environment and validates that outputs match the practice statement; samples user logs, audit trails, monitoring output and error-handling records and confirms audit data is retained, intact and accessible; interviews technical leads, privacy officers and administrators and walks through configuration, data flows and fallback mechanisms; and examines the interfaces with intermediaries, relying parties and external data sources and the controls on data exchange and integrity. The client makes available full test reports and raw data, configuration records and change logs, operational logs showing real-world performance, monitoring outputs including automated monitoring, records of privacy and security incidents, of breaches and of complaints in the cycle, documentation of fallback and error handling, and training and competence records of relevant staff.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.