So that the audits required by sections 20N and 20Q of the Act focus on the providers presenting the greatest risk of non-compliance, a body must establish a documented, risk-based programme to monitor providers' compliance with the Part IIIA obligations incorporated in their agreements: that the credit information they disclose is accurate, up to date and complete; that the credit reporting information the body discloses to them is protected from misuse, interference, loss and unauthorised access, modification or disclosure; and that they take the required steps on correction requests. The programme must identify and evaluate indicators of non-compliance risk, assess the risk of significant non-compliance using those indicators and available information including correction requests and complaints, use a reasonable range of monitoring techniques to validate and update the assessments over time, and include a programme for auditing providers against those obligations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.