Every audit should rest on objectives, scope and criteria that have been defined and that fit the programme's overall objectives. Audit objectives set out what the audit is meant to achieve, and may include: establishing how far the system conforms to the audit criteria; judging whether the system can help the organization meet statutory, regulatory and other requirements; judging how effective the system is at reaching its intended results; finding opportunities for improvement; judging whether the system is suitable and adequate given the organization's context and strategic direction; judging whether the system can set and reach objectives and deal with risks and opportunities as the context changes; and taking account of auditing standards specific to the sector. The scope should fit the programme and the objectives, and covers the period of time involved together with the sites, functions, activities and processes that the audit will examine. The audit criteria are the benchmark used to judge conformity, and may include policies, processes and procedures, performance criteria with objectives among them, statutory and regulatory requirements, the requirements of the management system, information on context and risk that the audit client has determined, including what interested parties require, codes of conduct for the sector, and other planned arrangements. Any change to the objectives, scope or criteria should be reflected in the programme and, where appropriate, put forward for approval. When more than one discipline is audited together, the objectives, scope and criteria should be kept consistent with the programmes of each discipline.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.