ISO 19011:2018, 5.3 is followed (the audit client is shown the programme's identified risks and opportunities, covering planning, resources, team selection, communication, implementation, records control and monitoring, and the opportunities such as combining audits or reducing travel), and the measures that protect confidentiality and information security should be decided bearing in mind what auditees and other relevant parties require, their applicable contractual and legal requirements included.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.