Where sampling is permitted, the body ensures, for example through the contract, that the organisation internally audited every site in the year before certification and can show corrective action effectiveness where applicable. After certification the annual internal audit covers every site in scope and ongoing corrective action effectiveness is demonstrated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.