Consider external audit or review of the fraud control system by external auditors, certification or attestation bodies, regulators or specialist fraud examiners as an independent source of assurance to the governing body, top management and interested parties: define its scope and frequency, give cooperation and access, and act on what it finds; where the financial statement auditors consider fraud, share relevant information with them. Certification bodies already issue attestations of implementation against this document.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.