The client passes to the lead auditor what the auditee has specified for its OH&S system and how it describes that system (processes, organization and so on). The lead auditor checks whether that description, such as the safety manual, is adequate to meet the system requirements; if it is not, no further audit effort is spent until the concern is resolved with the client and auditee. Without a defined set of requirements the audit can be run against legal requirements and relevant standards. The client should state the standards or documents the auditee must comply with, which can include laws, standards, codes of practice and the auditee's own requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.