Those managing the programme should decide its scope. The scope may vary with what the audit client or auditee says about its context, and in some cases the programme may be just one audit. The things that affect the scope include: the objective, scope and length of each audit, how many audits there will be, how they are reported and how they are followed up; the management system standards involved; how many activities there are, how important, complex and alike they are, and where they take place; what affects the effectiveness of the management system; the audit criteria that apply; what earlier audits, management reviews and programme reviews found; issues of language, culture and society; concerns raised by interested parties, for example complaints, failures to comply or problems in the supply chain; major changes in the auditee's operations or context; whether ICT is available to support audit activities, particularly remote methods; external and internal events, such as nonconforming products or incidents affecting information security, the environment or health and safety; and business risks and opportunities, together with the actions taken on them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.