Parallel to 68.59 for Program 3: when a 68.79(f) trigger applies the owner or operator must engage a third-party auditor, or a team led by one, meeting the competency criteria (knowledge of Part 68, experience with the source type, processes and RAGAGEP, audit training or certification) and independence criteria (impartiality, no financial interest in the outcome beyond fees with the retiree allowance, signed conflict of interest statements, no employment with the owner for two years after the final report) under written auditor policies; the auditor manages the audit, assigns roles, prepares and certifies the report with the prescribed statement and provides it to the owner; the report identifies team members and qualifications, describes the policies, evaluates whether the procedures and practices developed under the part are adequate and followed, documents findings and deficiencies and summarises significant draft-to-final revisions. Within 90 days of the final report the owner prepares a findings response report with responses, a deficiency schedule and a senior officer's certification, implements and documents the schedule, gives the documents immediately to the board audit committee or equivalent, and keeps the two most recent third-party audit reports, response reports and related records at the source.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.