Controllers and processors must conduct a data protection audit within twelve months of incorporation and annually thereafter; audit reports are filed through a licensed DPCO (6.3), and controllers processing more than 2,000 data subjects in the twelve months before 15 March file annually (3.3.2).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.