Where there is an internal audit function at the service organisation, the service auditor learns what its responsibilities are and what it does, in order to decide whether that function is likely to matter for the engagement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.