Outsourcing arrangements are designed to keep the audit provider independent: an accounting firm that performs the external audit risks auditing its own work if it also performs internal audit, Sarbanes-Oxley prohibits registered firms from providing internal audit outsourcing to public audit clients, institutions of USD 500 million or more in assets must follow the SEC independence rules under section 36 of the FDI Act, and other institutions are encouraged to follow the same prohibition, using the same firm for both only in the circumstances the guidance allows.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.