The organization shall set up, operate and keep up one or more internal audit programmes that cover how often audits happen, how they are done, who is responsible, how they are planned and how results are reported. When building the programme it shall take account of how environmentally important the processes involved are, of changes that affect the organization, and of what earlier audits found. For each audit it shall set the objectives, criteria and scope, pick auditors and run the audit in a way that keeps it objective and impartial, and make sure results reach the relevant managers. Documented information shall be kept on the programme, on how it was carried out and on what the audits found.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.