The organisation must establish arrangements, including documented procedures, for periodic audits that establish whether the system and each of its elements exist, are adequate, and work to protect employees and prevent incidents. An audit programme must define auditor competence, audit scope, methodology and reporting. Audits evaluate all the system elements or an appropriate subset, are carried out by competent people, from inside or outside the organisation, who are independent of what they audit, and the results and conclusions go to the people who own the corrective action.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.