Before taking on an engagement or continuing with one, the service auditor establishes: that it has the capability and competence to do the work; that the criteria the service organisation will use to prepare the description will be suitable, and that user entities and their auditors will have access to them; and that neither the description nor what the engagement covers will be so narrow as to be of no use to them. The auditor also gets the service organisation to agree that it takes responsibility: for preparing the description and the assertion that goes with it, including that they are complete, accurate and properly presented; for having a sound basis for the assertion; for setting out in the assertion the criteria it used; for stating the control objectives and, where they were set by law, regulation or another party, who set them; for identifying the risks to the control objectives and for designing and putting in place controls that give reasonable assurance those objectives will be met; and for giving the auditor access to all relevant information, service level agreements included, any extra information the auditor asks for, and free access to the people from whom the auditor needs evidence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.