External auditors review general and application IT controls as part of their opinion on the financial statements, may review IT controls under an internal audit outsourcing engagement, and have the scope, objectives, resources, time frame and reports of their work, including the information systems work, defined in an engagement letter that examiners review to decide how far to rely on the external coverage.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.