The organization shall plan, set up, run and keep up one or more audit programmes, covering how often audits happen, how they are done, who is responsible, what planning they need and how results are reported, with weight given to how important each process is and to what earlier audits found. For every audit it shall set the criteria and scope, choose auditors and run the audit so that the process stays objective and impartial, make sure the findings reach the managers concerned, and keep documented evidence that the programme was carried out and of what the audits found.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.