At planned intervals the organization must carry out internal audits that tell it whether the management system meets both its own requirements and those of the standard, and whether it is effectively put into practice and kept up. It must plan, set up, run and maintain an audit programme covering how often audits happen, how they are done, who is responsible, what planning they need and how they are reported, giving weight to how important each process is and to earlier audit findings; set the criteria and scope for every audit; choose auditors and run audits so that the process stays objective and impartial; make sure findings reach the managers concerned; and keep documented evidence of the programme and its findings. Auditors should know the organization's structure, procedures and responsibilities well and be independent of the unit that implements the system.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.