A firm ensures that how it exercises its access and audit rights, for example how often it audits and which areas and services it covers, reflects whether the function is critical or important and how large the arrangement's risks and impact on the firm are.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.