This process group covers the control environment and how compliance with it is demonstrated. Establishment covers the board and audit committee, the code of ethics, assigning control responsibilities, defining process objectives and risks and setting unit risk tolerances. Operation covers monitoring whether controls work and remediating the deficiencies found. Reporting covers what is told to external auditors, regulators, shareholders and exchanges, third parties and internal management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.