Before relying on work done by the internal audit function, or on internal auditors for direct assistance, the practitioner assesses their competence, how far their status in the organisation and the relevant policies support objectivity (or, for direct assistance, the threats and safeguards), and, for the function's own work, whether it follows a systematic, disciplined approach that includes quality control.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.