The service auditor decides whether internal audit work will probably serve the engagement's purposes and, if so, how it alters what the service auditor's own procedures involve, when they are done and how far they go.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.