The practitioner must prepare documentation as ASAE 3000 requires and, for the procedures performed (their nature, timing and extent), record what identifies each compliance activity tested, who did the work and when it was finished, and who reviewed it with the date and extent of the review. Where particular internal audit work is relied on, the practitioner documents the evaluation of its adequacy and the procedures performed on it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.