An audit programme should be set up. It may cover a single management system standard or requirement or several, audited separately or together. How extensive it is should reflect what kind of organization the auditee is and how large, and the scope, functionality, complexity, maturity and risks and opportunities of the systems to be audited; it should be scaled to the organization and take account of where key decisions are taken, of multiple sites, and of functions provided from outside. To understand the auditee's context, the programme should consider the organization's objectives, the internal and external issues it faces, what interested parties need and expect, how it uses technology (digital tools for instance), and its requirements for confidentiality and information security. Matters with higher inherent risk and weaker performance should be given priority when resources and methods are allocated. Competent people should manage the programme. The programme should set out: its objectives; the risks and opportunities linked to it and the actions on them; the scope of each audit; the schedule; the types of audit; the audit criteria; the auditing methods, remote methods included; the criteria for choosing audit teams; the criteria for observers; the organization's context; and the relevant documented information. How the programme is being implemented should be monitored and assessed continually, and the programme reviewed so it can be changed and improved.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.