A compliance engagement is accepted or continued only where the ASAE 3000 preconditions are met, unless the law requires acceptance. The practitioner must decide whether the compliance activities to be evaluated suit the needs of users, meaning that carrying them out determines whether the compliance requirements are met; if not, the engagement is declined, or if discovered later, the practitioner withdraws or modifies the conclusion. The practitioner must also decide whether the criteria, whether supplied by the engaging party or selected in a direct engagement, are suitable under ASAE 3000.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.