The owner must re-perform audit aspects the Commissioner finds unsatisfactory, take further evaluation steps or accept a Commissioner-appointed risk assessment at its cost, carry out additional audits or assessments after material changes, and allow (and pay for) audits or inspections the Commissioner orders where non-compliance or inaccurate information is suspected; obstructing them is an offence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.