For reasonable assurance, testing and evaluation includes enquiries, observation and re-performance, selectively, of the compliance activities, or other examination and follow-up of how activities were applied. Exception reporting and monitoring results may reduce but never eliminate direct testing. The practitioner uses judgement on nature, timing and extent, and when setting the extent considers the population: the nature and frequency of the activity (daily, monthly, several times a day) and the expected rate of non-compliance, with testing across a period long enough to conclude.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.