In the audit phase an audit team of at least two auditors examines the development and lifecycle processes (FS.13 chapter 5.7); its lead auditor is the main point of contact both for the vendor and for the certification body. Where a valid audit already exists for the processes used, evidence of that audit alone is submitted. The audit and its report underpin everything that follows, so the vendor must prepare it with due diligence and support the audit team throughout. The audit follows the GSMA documents referenced in AIS-N1, any supplementary AIS-N1 material and ISO/IEC 27007, with an off-site review of process documentation and then an on-site audit at a site the applicant designates where the processes are implemented; the site must meet the AIS-N1 conditions for on-site audits. A remote audit is allowed only exceptionally, for repeat audits, once the certification body has been consulted and has approved, and only if the audit depth is sufficient. If an on-site audit cannot take place and the remote conditions are not met, the procedure is terminated, after the applicant is given the chance to withdraw and resubmit. The applicant and vendor must do nothing that might compromise the audit team's impartiality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.