Institutions manage the audit control of their key technology service providers by auditing the provider directly, engaging external auditors to evaluate it, or obtaining and reviewing sufficiently detailed independent audit reports on it; where third-party reviews are used the institution confirms the auditor is qualified, the scope meets its own audit objectives and reported deficiencies are corrected, and understands the difference between attestation reviews under AICPA standards (SOC 1 and SOC 2 reports) and non-attestation reviews and the assurance each gives.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.