Those managing the programme should hand responsibility for each audit to an audit team leader early enough before the planned date for the audit to be planned effectively. They should give the team leader: the objectives of the audit; the criteria and any relevant documented information; the scope, including which parts of the organization and which of its functions and processes are to be audited; the audit processes and methods; who is on the team; contact details for the auditee, where the audit activities will take place, and when and for how long; the resources; the information needed to assess and deal with risks and opportunities to meeting the objectives; and information that helps the team leader in dealing with the auditee. Where appropriate the assignment should also cover: the language for working and reporting; which conclusions are needed and who receives them; confidentiality and information security matters; arrangements for health, safety and the environment; requirements for travel or remote access; requirements for confidentiality, security, access and authorization; actions to be reviewed, such as follow-up from an earlier audit; and coordination with other audit activities. For a joint audit, the organizations involved should agree before the audit starts what each party is responsible for and what authority the appointed team leader has.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.