Per PCAOB AS 2201 paragraphs 44-46, 52, 14: operating effectiveness. Requirements include (a) test Operating Effectiveness of controls that are sufficiently important to address assertion-level risk + (b) determine Nature of Tests including inquiry + observation + inspection of relevant documentation + reperformance + (c) determine Timing of Tests including interim + roll-forward + period-end procedures + (d) determine Extent of tests including sample size + selection method + considering frequency + control type + reliance on automation + (e) use evidence from other parties including internal audit + management testing where appropriate per AS 2605 + (f) document tests + results + conclusions including sample selection + (g) consider IT general controls reliance for automated controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.