The operator maintains evidence sufficient to demonstrate the effective operation of its SMS and compliance with the standard, drawn from the information the SMS generates (monitoring, review, improvement, investigations, assurance) in any credible form; the nature, extent and form of evidence are proportionate to size, complexity and risk profile, no document types, formats or retention periods are required, and evidence serves to show outcomes rather than to document every activity or create parallel systems. The criteria: evidence is sufficient to show the SMS is implemented and operating effectively in practice, not merely documented; it reflects how the SMS works day to day, including how public risks are identified, managed, monitored and improved; it is used to inform safety decisions arising from monitoring, review, investigation and improvement; it shows that identified issues, deficiencies and opportunities are acted on and tracked to completion; it is accessible and understandable to those with safety responsibilities for assurance, oversight and accountability; and taken as a whole it supports reasonable confidence that the SMS functions as intended and manages public risk over time.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.