If the service auditor learns of fraud, of noncompliance with laws or regulations, or of errors the service organisation has left uncorrected and is answerable for, and the matter is more than clearly trivial and could affect user entities, the auditor establishes whether the user entities affected have been properly informed; where they have not, and the organisation will not inform them, the auditor acts as appropriate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.