The client should decide whether an audit is needed and why and start the process, choose the auditing organization, agree the broad audit scope with the lead auditor (including which OH&S standard or document is the reference) and the timetable, set the reporting requirements, state any confidentiality conditions, receive the report and, with the auditee, decide the follow-up action.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.