Audits in a body's programme may be done by the body's compliance or audit team, consultants it engages, consultants the provider engages where the body is satisfied of their independence and expertise, or an industry funded organisation meeting the same test. An auditor is independent only if not a director, employee or significant financial interest holder of the provider now or in the past 12 months, with functional independence arrangements where employed by the body or an industry funded organisation, and no other association now or in the past 12 months that would impair perceived independence. The body must take reasonable steps to ensure auditors have knowledge of Part IIIA, the Regulations and the Code, audit methodology and experience, and credit reporting system experience, and that its oversight and reporting arrangements let it form a view on each provider's compliance. A provider must give the auditor reasonable access to records and take reasonable steps to rectify audit findings. The body must give the Commissioner a list of providers audited by 31 August each year and the auditor's reports on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.