Guidance to build an audit programme (ISO 19011) that steers how audits are planned and carried out and identifies which audits the programme's objectives require, having regard to what the organization does, what the risk assessment and impact analysis showed, what earlier audits found and other relevant factors. The programme rests on the full BCMS scope, although no single audit has to cover the whole system at once: audits can be split into smaller parts, provided the programme makes sure that every unit, function, activity and system element, and the scope as a whole, is audited within the audit period the organization sets. Audit results can be reported and used to correct or prevent particular nonconformities and fed into management review. Audits can be carried out by the organization's own staff or by outside people acting for it; either way they are competent and can audit impartially and objectively, and in smaller organizations independence can be shown by the auditor having no responsibility for the activity audited.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.