Assurance must follow the limited assurance standards the Commission adopts by delegated act (due by 1 July 2027) or, until then, national standards notified to the Commission. For consolidated reporting the group auditor bears full responsibility, evaluates and reviews the work of component providers, documents it and obtains access to their documentation, takes further measures and informs the authority if it cannot. The written assurance report identifies the entity, the reporting and period covered and the framework applied, describes the scope and the assurance standards used, contains the opinion, is signed and dated by the responsible auditors (joint reports state any disagreement) and may form a separate section of the audit report.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.