The body shows that sampling does not undermine effective auditing and records its rationale against the conditions: one centrally controlled FSMS; similar sites (subcategory, location, processes, size, legal and customer requirements, hazards and controls); a central function that is part of the organisation and not subcontracted; a legal or contractual link from every site; central authority to define and maintain the FSMS; every site inside the internal audit programme and audited; site findings treated as indicative of the whole system; central collection and analysis of performance and complaints; central management review; and central authority to drive improvement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.