A process audit concludes positively only when the auditors, and the certification body too, judge the vendor's measures and processes for meeting the FS.16 security measures complete, correct and technically sufficient. A security requirement still not complied with after any improvements yields a negative result, and the procedure then ends with a negative notice and no certificate. Where the audit finds that the measures and processes do not meet all FS.16 requirements, the vendor and the audit team, in consultation with the certification body, may opt for a re-audit after the vendor has made the required improvements, but only if the original audit and the additional audit together do not exceed three months. After the audit the audit report with its attachments and an audit summary are produced, the summary for later publication on successful certification; the vendor reviews the report for quality assurance and comments, and the audit team finalises it after the certification body's comments.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.