The report is addressed as the engagement requires: ordinarily to management of the service organisation, or to the user entities or board that engaged the auditor. (AT-C 205 .63, Guide Table 4-5)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.