Every audit includes management and worker interviews and worker file reviews in the numbers set by Table A.2 (halved for surveillance), with interviewees chosen to represent the site by gender, age, service length, job, origin, vulnerable and less skilled groups, permanent, temporary and external workers, and all shifts across the cycle. Interviews, roughly a third of audit time, are held individually and in groups, in private without managers, in a language the workers understand, with an independent CB-appointed interpreter (adding at least 20 percent to the time) when needed. Each individually interviewed worker's file is reviewed over at least three months of the past year, confidentiality is explained to every participant, and what people say is reported without attribution.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.