Auditors recommend improvements to the system. Where the auditee's system is well defined, pointing out nonconformities may be enough; where it is not, recommendations matter more. They fall into two kinds: improving the system's specified requirements, and implementing those requirements more effectively. The auditee decides how to act on recommendations, except that those concerning statutory and legal compliance are to be implemented in full.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.