The client decides when audits are needed, considering specified and regulatory requirements and factors such as major change to management, organization, policy, methods, technology, products or the system itself, and recent audit results. Organizations should combine external and internal audits: an external audit about every two years or as a statute requires, an internal audit about once a year, with internal audits made more frequent where accident and dangerous occurrence records point to high-risk areas.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.