The organization has to run internal audits at planned intervals to find out whether the records system conforms to its own requirements and to the standard, and whether it is effective. It has to plan and maintain an audit programme that considers the importance of the processes and the results of earlier audits, define the criteria and scope of each audit, choose auditors who are objective and impartial, report the results to the relevant management and keep documented information of the programme and the results.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.