The report should go out within the period agreed. If it is late, the auditee and the programme manager should be told why. The report should carry a date and be reviewed and, where appropriate, accepted as the programme lays down. It should then be sent to the relevant interested parties named in the programme or audit plan, and suitable steps to protect confidentiality should be considered when doing so.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.