The body must have procedures for internal audits that verify it fulfils the standard and that the system is effectively implemented and maintained. It must plan an audit programme that considers how much each process and area matters and what earlier audits found. Audits must normally take place at least once every twelve months, or a segmented or rolling programme must be completed within twelve months. A documented decision process must be followed to change the frequency or the time frame, based on the stability and ongoing effectiveness of the system, and the decision and its rationale must be recorded. The body must ensure that audits are conducted by people who know certification, auditing and the standard; that nobody audits their own work; that the people responsible for the area are told the outcome; that actions follow promptly and in proportion; and that opportunities for improvement are identified.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.