Because the practitioner alone is responsible for the opinion, the practitioner makes every significant judgement, including when to use internal audit work, and uses less of that work and does more directly the more judgement is involved, the higher the assessed risk, the weaker the support for internal audit's objectivity and the lower its competence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.