Where alterable storage (for example an off-the-shelf document retention system) is used, procedures giving at least the control of #39 are required and described in the written system, including version control, restricted adding and modifying, logging of all changes and an audit trail of administrator activity; otherwise the originals must be kept and the alterable media cannot be relied on for audit. (Group II ICP #26: originals are retained.)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.