An internal audit programme is planned and maintained, with frequency, method, responsibilities, planning and reporting set by the welfare risk of each process, customer feedback, changes at the site and the findings of earlier internal and external audits. Each audit follows its stated criteria and scope, is done by competent auditors who are objective and impartial, is reported to the relevant managers, leads to timely corrective action, and leaves records of the programme and results.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.