The audit rests on close cooperation between the applicant, the auditors and the certifier. Communication is in text form or, for status and minor non-confidential technical points, by telephone or web conference, and every email between vendor, audit team and certification body must be OpenPGP-encrypted with the public process keys exchanged beforehand. All parties must keep to the timetable agreed when the process begins. Evidence goes to the audit team, usually through the lead auditor, and the process documentation should be prepared well enough for the audit to fit the schedule. During document review the vendor must clarify and correct supplementary documents, errors and inconsistencies in its information, and must therefore provide resources and contacts who know the subject matter and are authorised to decide; it must make sure every necessary document, piece of information and item of evidence is available and that meetings on site can be arranged. The certifier may take part in the audit, including on site. The general framework conditions (VB-Produkte.PD chapter 5.3) apply, including rejection or a negative decision for breach of impartiality or failure to meet obligations, for instance evidence missing or the application or certification object significantly changed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.