The auditor examines how nonconformities are reacted to, controlled and corrected, their consequences dealt with, the need for action to eliminate causes evaluated by reviewing the nonconformity, determining its causes and whether similar ones exist or could occur, the actions implemented and their effectiveness reviewed, the ISMS changed if necessary, and documented information retained on the nature of nonconformities, the actions and their results.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.