When a 68.58(f) trigger applies, the owner or operator must engage a third-party auditor, or a team led by one, meeting competency criteria (knowledge of Part 68, experience with the source type and processes and RAGAGEP, training or certification in auditing) and independence criteria (impartiality; no financial benefit from the outcome beyond the audit fee, with a narrow allowance for retirees; signed and dated conflict of interest statements from all third-party personnel; no employment with the owner or operator for at least two years after the final report), the auditor having written policies to ensure this. The auditor must manage the audit, assign team roles, prepare and certify the report (documenting the team's views) and give it to the owner. The report must identify all team members with their qualifications, describe the policies, evaluate whether procedures and practices are adequate and followed, document findings and deficiencies, summarise significant draft-to-final revisions and carry the prescribed auditor certification. Within 90 days of receiving the final report the owner must prepare a findings response report with the audit report, a response to each finding, a schedule for promptly addressing deficiencies and a certification by a senior corporate officer; implement the schedule and document each action and completion date; immediately give these documents to the board audit committee or equivalent; and keep the two most recent third-party audit reports, response reports and related records (up to five years).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.