The organization should audit IRBC internally under a plan that fixes how often audits happen, their scope, the criteria applied and the method, with auditors chosen to keep the audit objective and impartial, and the results recorded and reported.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.