The assessor explains the sampling methodology used, its advantages and disadvantages and why it was chosen. The CAF names the principles (level of standardisation, representativeness including historical evidence, ease of data collection with entity-approved tools, confirmation of unexpected results) and example methods (random, stratified, risk-based informed by threat modelling, systematic), and allows methods from the AUASB auditing standard ASA 530 Audit Sampling.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.