Findings are reached by weighing the audit evidence against the criteria, and they may show either conformity or nonconformity. Where the audit plan calls for it, individual findings should cover conformity and good practice together with the evidence for them, opportunities for improvement and any recommendations, and they should be recorded. Each nonconformity should be recorded with the evidence behind it. Nonconformities may be graded, in qualitative or quantitative terms, to reflect the organization's context and risks, with the grading criteria set out and communicated. The team should go through nonconformities with the auditee so that the auditee acknowledges the evidence is accurate and understands the nonconformities. Every effort should be made to settle differences of opinion about the evidence or findings, and anything left unsettled should be noted in the audit report. The team should get together as needed to go over findings at suitable points in the audit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.