In addition to ASAE 3000 representations, the practitioner must request the responsible party or relevant people to confirm in writing: for attestation, the statement on the evaluation outcome; that they own the compliance activity, which means identifying the risks, and designing and maintaining controls against them, fraud risk included; that agreed information and access were provided; and any instances of non-compliance and events after the period or date up to the report date that could significantly affect the conclusion.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.