Internal audit has to sit apart from management so that its judgements stay objective and people can trust what it reports. Three things protect that position: the function answers to the governing body; it can reach the staff, funds and information it requires without asking permission; and its planning and work are shielded from pressure or partiality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.