The auditee is responsible for deciding and starting corrective action. It should prepare an implementation plan naming the departments responsible and deadlines set according to the importance and safety implications of each recommendation, possibly in consultation with the client or the auditing body. The report's content and the agreed actions and target dates are communicated to the right people and to whoever implements them. Where a recommendation will not be acted on, the reasons are documented and, where implementation is not feasible, the client is told why (and may tell the auditor). The auditee should monitor implementation and periodically assess progress, may commission a follow-up audit, and plans the next audit with legal requirements in mind.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.