The organization documents an internal audit process and builds and runs an audit programme that spans the whole QMS by means of three audit types: of the QMS, of manufacturing processes and of products. The programme is prioritized by risk, by internal and external performance trends and by how critical each process is. Where the organization develops software, assessments of its software development capability form part of the programme. How often audits occur is reviewed and changed in response to process changes, nonconformities and customer complaints, and management review looks at whether the programme is effective.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.