The auditor takes on or keeps the engagement only where the section 105 preconditions hold, the scope and description are not narrowed so far that they would be of no use to user entities or their auditors, and management accepts that it is responsible for: drafting the description and assertion, including making them complete, accurate and properly presented; having reasonable grounds for the assertion; choosing the criteria and stating them; setting the control objectives and naming any other party that set them; identifying risks to those objectives and then designing, putting into operation and documenting effective, well-designed controls; and supplying the written assertion alongside the description to user entities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.