The entity has its annual financial report audited under Division 3 and obtains an auditor's report (s 301). Exceptions: a small proprietary company reporting only under a shareholder direction or with crowd-sourced funding below the audit threshold need not be audited unless the direction asks; a company limited by guarantee below $1 million revenue (not a Commonwealth company) may have a review instead. An entity required to prepare a sustainability report has it audited and obtains an auditor's report, with the scope of assurance phased in to financial years starting 1 July 2030 (s 301A).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.