Those managing the programme should: make sure the programme keeps its integrity and is not subject to undue influence; set how extensive it is, in line with its objectives and any known constraints; identify the internal and external issues, and the risks and opportunities, that could affect it, and put in place actions on them across all audit activities; make sure audit teams are selected and have the overall competence needed, by allocating roles, responsibilities and authorities and by supporting leadership as appropriate; set up processes for deciding audit objectives, scope and criteria, methods and team selection, for coordinating and scheduling audits, for evaluating the competence of auditors, for communication, for settling disputes and dealing with complaints, for following up audits where applicable, and for reporting to the audit client and interested parties; decide on and secure the resources needed; make sure suitable documented information, programme records included, is prepared and kept; monitor, review and improve the programme; communicate the programme to the relevant interested parties and to the audit client; and ask the audit client to approve it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.