ISO 19011:2018, 6.3.2 is followed (a risk-based plan, its detail matched to scope, complexity and the risk of not meeting the objectives, agreed among client, team and auditee), and the team leader should bear in mind that the audit team being there can itself create risk for the auditee: it can affect information security and add risk to the auditee's information, for example sensitive or confidential records or its system infrastructure, through unauthorized disclosure, accidental deletion or unintended change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.