Agreed-upon procedures (AUP), used when intended users want the results of evidence-gathering without a verifier's opinion, are used within accredited validation and verification only if ISO/IEC 17029 is applied; the procedures were fixed beforehand and agreed with the client or the responsible party; the report of factual findings is independently reviewed and approved before issue in line with ISO/IEC 17029 clauses 9.6 and 9.7; the report clearly states restrictions on its use and distribution, and may confine the report to the organisation and the intended users; and it sets out plainly which procedures were carried out and what they found. A programme may itself specify AUP, and a mixed engagement may use AUP for statements whose data trails or controls the verifier cannot establish, such as third-party supplier information. The time allocated to the engagement is justified from the review of the information provided and recorded.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.