A limited assurance verification accepts a higher verification risk on the assumption that the control environment is reliable and concludes in the negative form; the level of assurance shall be specified before the verification and not changed once begun (a justified change is documented and a new verification started), and insufficiency of criteria or evidence cannot be cured by changing the level; the process follows the reasonable assurance one with clarifications: strategic analysis without a detailed assessment of controls; risk assessment on the statement as a whole, categorised as inherent, control and detection risk without the assertion-level detail; evidence-gathering addressing all items and focused on likely material misstatements, primarily inquiry and analytical procedures, with control testing optional as the risk assessment indicates; an understanding of material changes during preparation obtained through inquiry; analytical tests with an expectation that need not be precise, inconsistencies resolvable through inquiry; sampling at a more aggregate level appropriate to the risk; site visit activities where included (operations, infrastructure, processes and flows, scope and boundaries, calculations and assumptions); estimate testing against the criteria with further activities optional; the aggregating site visited unless already known; the evidence-gathering plan updated mainly for potential material misstatements; and an opinion stating that the activities are less extensive than in a reasonable assurance verification, expressed in the negative form.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.