The sample is partly selective and partly random, representative of the range of sites, and ensures every process in scope is audited. At least a quarter is random; the rest is chosen so that the sites visited across the certificate's validity differ as much as possible, considering internal audit, management review and previous audit results, complaints and withdrawals or recalls, variation in site characteristics and changes since the last audit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.