The lead auditor finalizes the plan after consulting the client and shares it with the auditors and auditee. It should be flexible enough to shift emphasis as information emerges and to use resources well, and should set out objectives and scope, the activity schedule, the reference documents (the applicable system standard plus the auditee's own description and requirements), team composition, the units to be audited, meetings with auditee management, the documents the team will study, and how and when the report will be issued and distributed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.