The team leader should make sure the auditee is contacted in good time in order to: agree the channels for communicating with those who represent the auditee; confirm who has authorized the audit; tell the auditee about the audit's objectives, scope, criteria and methods and who is on the team, technical experts included; ask for access to the information needed for planning, including the organization's own view of its risks and opportunities and how it is handling them; confirm the statutory, regulatory and other requirements that apply; confirm what has been agreed on how much is disclosed and on how confidential information is stored, transferred and released; arrange the audit, the audit plan included; settle any location-specific arrangements covering access, security, confidentiality, health and safety or other matters; agree whether observers will attend and whether guides or interpreters are needed; find out which areas of the audit the auditee is interested in, concerned about or sees as risky; and settle any issues about who is on the team with the auditee or the audit client.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.