The practitioner asks the responsible party whether it has an internal audit function, and if so inquires further into that function's activities and main findings on the subject matter, and whether it used any specialists in preparing the subject matter.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.